Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Accept an unrecognized device with an unsupported TPM and add its CA to the trusted list as "Manually added"

Aperta
  • Qualcosa non va?
#3,734 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
authentication, security

Direzione di ricerca

Begin with the device enrollment and attestation posture-check paths, then trace device status display, Accept TPM controls, EK CA settings, and activity logging. Use the listed test scenarios to validate unknown-device rejection, manual acceptance, CA reuse, and quarantined-device restrictions. Resolve the open questions about declining devices and removing manually added CAs before implementation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

User story

As an admin, I want to accept devices whose TPM isn't in Defguard's CA database, so that users with unsupported hardware can pass attestation.

Acceptance criteria
  • A device whose EK certificate doesn't chain to a CA in the database gets the status "Unrecognized" in the Devices list, the drawer and the user profile.
  • Unrecognized devices fail attestation posture checks.
  • The "Accept TPM" action is in the row menu and the drawer, only for Unrecognized devices.
  • The action opens a confirmation modal explaining that the TPM's CA will be trusted for all future devices.
  • After accepting, the device becomes "Attested manually", and the CA appears in the Settings EK CA list (US1) with a "Manually added" badge.
  • Later devices with a TPM from the same CA become "Attested" automatically.
  • The Activity log records the acceptance.
Test scenarios
  1. Enroll a device with an unknown TPM → its status is Unrecognized and it's rejected by an attestation posture check.
  2. Accept its TPM → the device becomes Attested manually and can connect.
  3. Open Settings › Device Attestation → the new CA is listed with the Manually added badge.
  4. Enroll a second device with the same TPM → it becomes Attested with no admin action.
  5. For a device that isn't quarantined → "Accept TPM" isn't available.
Notes
  • Store the issuing CA from the device's EK certificate chain when accepting.
Open questions
  • Can an admin decline a quarantined device? The design shows a "Declined" status.
  • Can a manually added CA be removed, and what happens to devices already attested through it?
Lingua principale
Rust
Stelle
2.9k
Fork
121
Merge medio
1g 1h
PR unite (30g)
68

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DefGuard/defguard

Tutte le issue di DefGuard/defguard

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.