Automata PCS DAO

Summary

The PcsDao contract is the core contract for managing Intel PCS (Provisioning Certification Service) collateral onchain. It handles essential certificates including the Intel SGX Root CA, intermediate CAs (PCK Platform CA, PCK Processor CA, TCB Signing CA), and their corresponding CRLs (Certificate Revocation Lists). All other DAO contracts depend on this contract to fetch issuer certificates and CRLs for signature verification.

Methods

getCertificateById

function getCertificateById(CA ca) external view returns (bytes memory cert, bytes memory crl)

Gets the certificate and its corresponding CRL for the specified Certificate Authority type.

Parameters:

• ca (CA): Certificate Authority type - CA.ROOT, CA.SIGNING, CA.PROCESSOR, or CA.PLATFORM

Returns:

• cert (bytes): DER-encoded certificate
• crl (bytes): DER-encoded CRL signed by the certificate

upsertPcsCertificates

function upsertPcsCertificates(CA ca, bytes calldata cert) external returns (bytes32 attestationId)

Upserts (inserts or updates) a PCS certificate onchain with signature verification, revocation checking, and rollback protection.

Parameters:

• ca (CA): Certificate Authority type - CA.ROOT, CA.SIGNING, CA.PROCESSOR, or CA.PLATFORM
• cert (bytes): DER-encoded certificate

Returns:

• attestationId (bytes32): The attestation ID returned by the resolver

upsertPckCrl

function upsertPckCrl(CA ca, bytes calldata crl) external returns (bytes32 attestationId)

Upserts (inserts or updates) a PCK Certificate Revocation List onchain with signature verification and rollback protection.

Parameters:

• ca (CA): Certificate Authority type - CA.PROCESSOR or CA.PLATFORM
• crl (bytes): DER-encoded CRL

Returns:

• attestationId (bytes32): The attestation ID returned by the resolver

upsertRootCACrl

function upsertRootCACrl(bytes calldata rootcacrl) external returns (bytes32 attestationId)

Upserts (inserts or updates) the Root CA Certificate Revocation List onchain with signature verification and rollback protection.

Parameters:

• rootcacrl (bytes): DER-encoded Root CA CRL

Returns:

• attestationId (bytes32): The attestation ID returned by the resolver

Reverts