fix: address root cause of empty reference IDs instead of suppressing them

This commit addresses the feedback from @setrofim in PR #338 by fixing
the root cause where empty reference value IDs were being generated
rather than suppressing them in the consuming code.

Changes made:
- Fixed multiple scheme handlers (psa-iot, tpm-enacttrust, parsec-tpm,
  arm-cca, parsec-cca) to return nil instead of []string{""} when
  encountering errors
- Fixed handler/store_rpc.go to return nil instead of []string{""}
  on RPC call failures
- Fixed vts/trustedservices/trustedservices_grpc.go to return nil
  instead of []string{""} on trust anchor retrieval errors
- Removed the workaround that was skipping empty reference IDs in
  GetAttestation method since the root cause is now fixed

The original URL-safe base64 nonce functionality from the PR is
preserved and all tests continue to pass.

Fixes: Issue identified by @setrofim - empty refvalID should never
occur and indicates a bug that should be fixed at the source.

Signed-off-by: Kallal Mukherjee <[email protected]>

Author: kallal79

handler/store_rpc.go

@@ -241,13 +241,13 @@ func (s *StoreRPCClient) GetTrustAnchorIDs(token *proto.AttestationToken) ([]str
 
 	data, err = json.Marshal(token)
 	if err != nil {
-		return []string{""}, fmt.Errorf("marshaling token: %w", err)
+		return nil, fmt.Errorf("marshaling token: %w", err)
 	}
 
 	err = s.client.Call("Plugin.GetTrustAnchorIDs", data, &resp)
 	if err != nil {
 		err = ParseError(err)
-		return []string{""}, fmt.Errorf("Plugin.GetTrustAnchorIDs RPC call failed: %w", err) // nolint
+		return nil, fmt.Errorf("Plugin.GetTrustAnchorIDs RPC call failed: %w", err) // nolint
 	}
 
 	return resp, nil

scheme/arm-cca/store_handler.go

@@ -48,16 +48,16 @@ func (s StoreHandler) SynthKeysFromTrustAnchor(tenantID string, ta *handler.Endo
 func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string, error) {
 	evidence, err := ccatoken.DecodeAndValidateEvidenceFromCBOR(token.Data)
 	if err != nil {
-		return []string{""}, handler.BadEvidence(err)
+		return nil, handler.BadEvidence(err)
 	}
 
 	claims := evidence.PlatformClaims
 	if err != nil {
-		return []string{""}, err
+		return nil, err
 	}
 	taID, err := arm.GetTrustAnchorID(SchemeName, token.TenantId, claims)
 	if err != nil {
-		return []string{""}, err
+		return nil, err
 	}
 
 	return []string{taID}, nil

scheme/parsec-cca/store_handler.go

@@ -43,13 +43,13 @@ func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string
 
 	err := evidence.FromCBOR(token.Data)
 	if err != nil {
-		return []string{""}, handler.BadEvidence(err)
+		return nil, handler.BadEvidence(err)
 	}
 	claims := evidence.Pat.PlatformClaims
 
 	taID, err := arm.GetTrustAnchorID(SchemeName, token.TenantId, claims)
 	if err != nil {
-		return []string{""}, err
+		return nil, err
 	}
 
 	return []string{taID}, nil

scheme/parsec-tpm/store_handler.go

@@ -42,12 +42,12 @@ func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string
 	var ev tpm.Evidence
 	err := ev.FromCBOR(token.Data)
 	if err != nil {
-		return []string{""}, handler.BadEvidence(err)
+		return nil, handler.BadEvidence(err)
 	}
 
 	kat := ev.Kat
 	if kat == nil {
-		return []string{""}, errors.New("no key attestation token to fetch Key ID")
+		return nil, errors.New("no key attestation token to fetch Key ID")
 	}
 	kid := *kat.KID
 	instance_id := base64.StdEncoding.EncodeToString(kid)

scheme/psa-iot/store_handler.go

@@ -38,14 +38,14 @@ func (s StoreHandler) SynthKeysFromTrustAnchor(tenantID string, ta *handler.Endo
 func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string, error) {
 	psaToken, err := psatoken.DecodeAndValidateEvidenceFromCOSE(token.Data)
 	if err != nil {
-		return []string{""}, handler.BadEvidence(err)
+		return nil, handler.BadEvidence(err)
 	}
 
 	claims := psaToken.Claims
 
 	taID, err := arm.GetTrustAnchorID(SchemeName, token.TenantId, claims)
 	if err != nil {
-		return []string{""}, err
+		return nil, err
 	}
 
 	return []string{taID}, nil

scheme/tpm-enacttrust/store_handler.go

@@ -43,7 +43,7 @@ func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string
 			strings.Join(EvidenceMediaTypes, ", "),
 			token.MediaType,
 		)
-		return []string{""}, err
+		return nil, err
 	}
 
 	var decoded Token

vts/trustedservices/trustedservices_grpc.go

@@ -442,12 +442,6 @@ func (o *GRPC) GetAttestation(
 
 	var multEndorsements []string
 	for _, refvalID := range appraisal.EvidenceContext.ReferenceIds {
-		// Skip empty reference IDs (can occur when no software components are provisioned)
-		if refvalID == "" {
-			o.logger.Debugw("skipping empty reference ID", "refvalID", refvalID)
-			continue
-		}
-
 		endorsements, err := o.EnStore.Get(refvalID)
 		if err != nil && !errors.Is(err, kvstore.ErrKeyNotFound) {
 			return o.finalize(appraisal, err)
@@ -512,12 +506,12 @@ func (c *GRPC) getTrustAnchors(id []string) ([]string, error) {
 	for _, taID := range id {
 		values, err := c.TaStore.Get(taID)
 		if err != nil {
-			return []string{""}, err
+			return nil, err
 		}
 
 		// For now, Veraison schemes only support one trust anchor per trustAnchorID
 		if len(values) != 1 {
-			return []string{""}, fmt.Errorf("found %d trust anchors, want 1", len(values))
+			return nil, fmt.Errorf("found %d trust anchors, want 1", len(values))
 		}
 		taValues = append(taValues, values[0])
 	}