Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Accept an unrecognized device with an unsupported TPM and add its CA to the trusted list as "Manually added"

Abierto
  • ¿Algo no está bien?
#3,734 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
authentication, security

Línea de trabajo

Begin with the device enrollment and attestation posture-check paths, then trace device status display, Accept TPM controls, EK CA settings, and activity logging. Use the listed test scenarios to validate unknown-device rejection, manual acceptance, CA reuse, and quarantined-device restrictions. Resolve the open questions about declining devices and removing manually added CAs before implementation.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

User story

As an admin, I want to accept devices whose TPM isn't in Defguard's CA database, so that users with unsupported hardware can pass attestation.

Acceptance criteria
  • A device whose EK certificate doesn't chain to a CA in the database gets the status "Unrecognized" in the Devices list, the drawer and the user profile.
  • Unrecognized devices fail attestation posture checks.
  • The "Accept TPM" action is in the row menu and the drawer, only for Unrecognized devices.
  • The action opens a confirmation modal explaining that the TPM's CA will be trusted for all future devices.
  • After accepting, the device becomes "Attested manually", and the CA appears in the Settings EK CA list (US1) with a "Manually added" badge.
  • Later devices with a TPM from the same CA become "Attested" automatically.
  • The Activity log records the acceptance.
Test scenarios
  1. Enroll a device with an unknown TPM → its status is Unrecognized and it's rejected by an attestation posture check.
  2. Accept its TPM → the device becomes Attested manually and can connect.
  3. Open Settings › Device Attestation → the new CA is listed with the Manually added badge.
  4. Enroll a second device with the same TPM → it becomes Attested with no admin action.
  5. For a device that isn't quarantined → "Accept TPM" isn't available.
Notes
  • Store the issuing CA from the device's EK certificate chain when accepting.
Open questions
  • Can an admin decline a quarantined device? The design shows a "Declined" status.
  • Can a manually added CA be removed, and what happens to devices already attested through it?
Lenguaje dominante
Rust
Estrellas
2.9k
Forks
121
Merge medio
1 d 1 h
PR fusionados (30 d)
68

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DefGuard/defguard

Todos los issues de DefGuard/defguard

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.