Feat(profile/psa): extract and consolidate PSA profile package and removes PSA/CCA-specific types from COMID by abhiraj-ku · Pull Request #253 · veraison/corim

abhiraj-ku · 2026-01-29T13:25:05Z

This PR consolidates PSA logic into the profiles package and removes PSA/CCA-specific COMID types to simplify and generalize the implementation. It reduces profile-specific coupling, and updates test fixtures accordingly, improving maintainability and extensibility for future profiles.

…pe TaggedBytes Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

…ckage Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

feat(profiles/psa): extract and consolidate PSA logic into profile package Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

thomas-fossati

Looks great. Thanks for all your careful work!

I was expecting this PR to contain the PSA-08 implementation and was a little disoriented at first. I now understand that this is a significant restructuring of the existing logic (pre-08), and I'm looking forward to seeing the next steps!

Could you please fix the organisation of the commits and the messages? (In particular, I believe there are no new features here, so the feat label should not be used in the headings.

abhiraj-ku · 2026-02-02T17:43:31Z

Hey Thomas, thanks for the review! You’re right, this PR is focused on restructuring existing logic, not new features. I’ll clean up the commit messages and squash/rewrite the commit history accordingly.

yogeshbdeshpande · 2026-02-03T12:27:03Z

profiles/psa/implid.go

@@ -0,0 +1,122 @@
+// Copyright 2021-2024 Contributors to the Veraison project.


The Headers in all files should be reflected upto 2026, now!

ok i'll fix this and amend with psa commit

yogeshbdeshpande · 2026-02-03T12:35:35Z

Started reviewing, will finish by end of day today!

abhiraj-ku · 2026-02-03T12:37:13Z

Started reviewing, will finish by end of day today!

Ok,sure

yogeshbdeshpande · 2026-02-03T13:20:40Z

profiles/psa/psa.go

+	}
+
+	// Register PSA-specific ClassID factory (psa.impl-id)
+	// CBOR tag 560 is already registered for TaggedBytes in comid/cbor.go


@abhiraj-ku I do not see the tag 560 been applied as you are NOT instantiating ImplID as Tagged Bytes in the Methoid NewImplIDClassID).

yogeshbdeshpande

The new Interface functions for Instatiating ClassID using ImplID needs to be re-written to claim that TaggedBytes are used instead:

yogeshbdeshpande · 2026-02-03T13:35:28Z

profiles/psa/psa_test.go

+	for i := range implID {
+		implID[i] = byte(i)
+	}
+	class := comid.NewClassBytes(implID)


This approach should be used when instantiating ClassID using Implementation ID

yogeshbdeshpande

see further comments...

setrofim

A note on commit messages:

do not capitalize the classification tag, so feat not Feat (note: you generally should capilize the initial word of the title, but classification tags are an exception, in the same way as you wouldn't capilize a variable name (if it's not capitalized in code) even if its the first word in a sentence.)
Keep the commit message titles (i.e. the inital line of the message) short, and use the commit body to fully describe the change, rather than trying to put everything into the commit title. (note: the common advice is the 50/72 rule, i.e. the title should be at most 50 characters, and the commit body should be formatted to 72-column lines.

setrofim · 2026-02-05T09:34:48Z

comid/classid.go

 	}
 }

+type IClassIDValue interface {


Why was this moved below SetUUID and GetUUID mothod definitions? Please revert to the original location.

setrofim · 2026-02-05T09:39:16Z

comid/classid.go

+// RegisterClassIDFactory registers a new IClassIDValue factory without registering
+// a CBOR tag. Use this when the underlying CBOR tag is already registered (e.g., for
+// profile-specific types that reuse existing CBOR tags).
+func RegisterClassIDFactory(factory IClassIDFactory) error {


This doesn't seem right. A CBOR tag identifies the type. You cannot have the same tag map to different types. And a profile cannot "re-use" a tag for a different type. This will cause problems.

Agreed—one tag must map to one type. The factory was a leftover from exploring profile conveniences; I’ve removed it and will push the fix with the other requested changes

setrofim · 2026-02-05T09:41:18Z

comid/cryptokeys_test.go

+		Add(MustNewPKIXBase64Key(TestECPubKey))
+
+	result := keys.String()
+	assert.Contains(t, result, "[")


I'm not sure what these asserts are testing? Since all the inputs are known, you should be comparing to the exact expected output, not just that output features square brackets.

setrofim · 2026-02-05T09:43:31Z

comid/ueid_test.go

 	}
 }
+
+func Test_UEID_Empty(t *testing.T) {


Suggested change

func Test_UEID_Empty(t *testing.T) {

func TestUEID_Empty(t *testing.T) {

setrofim · 2026-02-05T09:49:27Z

corim/unsignedcorim_test.go

+	// NOTE: Test skipped because CBOR test files contain PSA-specific types (tag 601)
+	// that are now registered only in profiles/psa, not in the base comid package.
+	// TODO: Regenerate CBOR test files using generic types (UUID, bytes, etc.)
+	t.Skip("Test uses PSA-specific CBOR tags in test data; regenerate with generic types")


Instead of skipping, you should update the offending inputs to not include the now-obsolete types (since which just need a valid CoRIM for this, you can replace them with any valid alteranative, e.g. a UUID instead of PSA ImplID).

setrofim · 2026-02-05T09:52:51Z

corim/unsignedcorim_test.go

+
+	var decoded UnsignedCorim
+	err = decoded.FromJSON(jsonData)
+	assert.NoError(t, err)


In addition to making sure that there is no error, you should also check to make sure that decoded is what you expect (i.e. you can do this by comparing some if its fields to the equivalents inside valid)

setrofim · 2026-02-05T09:55:53Z

profiles/psa/psa.go

+package psa
+
+// Copyright 2025 Contributors to the Veraison project.
+// SPDX-License-Identifier: Apache-2.0


Copyright header should be above package declaration (it should be the first two lines of the file). Also, the year now needs updating.

setrofim · 2026-02-05T10:05:54Z

profiles/psa/implid.go

+	"github.com/veraison/corim/comid"
+)
+
+const ImplIDType = "psa.impl-id"


You should be getting rid of this type. The implementation ID should now be represented by TaggedBytes, not a custom type. The addtional validation should be done as on top of the type via the validation methods (which you are already doing).

This also means yo do not need the (broken) factory registration function above.

setrofim · 2026-02-05T11:00:45Z

profiles/psa/psa.go

+
+// TriplesExtensions carries PSA-specific fields and constraints for Triples
+type TriplesExtensions struct {
+	PsaSwRelTriples *PsaSwRelTriples `cbor:"5,keyasint,omitempty" json:"psa-swrel-triples,omitempty"`


Why is this field necessary? You should not be defining any extension fields -- you just want the extension for its validation methods. (Also, code point 5 clashes with domain-membership-triple-record define by the CoRIM draft).

abhiraj-ku force-pushed the impl-id-sign-id-ver branch 2 times, most recently from e8cb9a4 to 2554414 Compare January 29, 2026 14:52

abhiraj-ku added 4 commits January 29, 2026 20:25

comid: ensure implementaition ID and signer ID field values are of ty…

0615aa5

…pe TaggedBytes Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

update class-ID tag from 600 to 560 in test fixtures

815040b

Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

feat(profiles/psa): extract and consolidate PSA logic into profile pa…

5bdb172

…ckage Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

refactor(comid): remove PSA and CCA specific types and cleanup

45a470e

feat(profiles/psa): extract and consolidate PSA logic into profile package Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

abhiraj-ku force-pushed the impl-id-sign-id-ver branch from 2554414 to 45a470e Compare January 29, 2026 14:56

thomas-fossati approved these changes Feb 2, 2026

View reviewed changes

yogeshbdeshpande reviewed Feb 3, 2026

View reviewed changes

yogeshbdeshpande requested changes Feb 3, 2026

View reviewed changes

yogeshbdeshpande reviewed Feb 3, 2026

View reviewed changes

setrofim requested changes Feb 5, 2026

View reviewed changes

		@@ -0,0 +1,122 @@
		// Copyright 2021-2024 Contributors to the Veraison project.

	func Test_UEID_Empty(t *testing.T) {
	func TestUEID_Empty(t *testing.T) {

Conversation

abhiraj-ku commented Jan 29, 2026

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

abhiraj-ku commented Feb 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Feb 3, 2026

Uh oh!

abhiraj-ku commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

setrofim left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

abhiraj-ku commented Feb 3, 2026 •

edited

Loading