Put IPCC behind a default-on cargo feature

tls/Cargo.toml

@@ -9,8 +9,8 @@ attest-data.workspace = true
 camino.workspace = true
 cfg-if.workspace = true
 dice-mfg-msgs = { workspace = true, features = ["std"] }
-dice-verifier = { workspace = true, features = ["ipcc", "mock"] }
-libipcc.workspace = true
+dice-verifier = { workspace = true, features = ["mock"] }
+libipcc = { workspace = true, optional = true }
 ed25519-dalek.workspace = true
 hubpack = "0.1.2"
 pem-rfc7468 = { workspace = true, features = ["std"] }
@@ -37,6 +37,8 @@ camino = { workspace = true, optional = true }
 pki-playground = { workspace = true, optional = true }
 
 [features]
+default = ["ipcc"]
+ipcc = ["dep:libipcc", "dice-verifier/ipcc"]
 unittest = ["attest-mock", "camino", "pki-playground"]
 
 [dev-dependencies]

tls/src/client.rs

@@ -155,6 +155,7 @@ impl Client {
                 config.roots,
                 log.clone(),
             )?,
+            #[cfg(feature = "ipcc")]
             ResolveSetting::Ipcc => {
                 Client::new_tls_ipcc_client_config(config.roots, log.clone())?
             }
@@ -205,6 +206,7 @@ impl Client {
         Ok(config)
     }
 
+    #[cfg(feature = "ipcc")]
     fn new_tls_ipcc_client_config(
         roots: Vec<Utf8PathBuf>,
         log: slog::Logger,

tls/src/keys.rs

@@ -20,12 +20,15 @@ use slog::{error, info};
 use std::io::prelude::*;
 use std::iter;
 
+#[cfg(feature = "ipcc")]
 use crate::ipcc::Ipcc;
 use crate::Error;
 use serde::Deserialize;
 use std::{fs::File, sync::Arc};
+#[cfg(feature = "ipcc")]
+use x509_cert::der::{self, Reader};
 use x509_cert::{
-    der::{self, Decode, Encode, Reader},
+    der::{Decode, Encode},
     Certificate,
 };
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -34,6 +37,7 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 #[serde(tag = "which", rename_all = "snake_case")]
 pub enum ResolveSetting {
     // Use certificates gathered over IPCC
+    #[cfg(feature = "ipcc")]
     Ipcc,
     // Use specified chain/key
     Local {
@@ -53,6 +57,7 @@ impl CertResolver {
         CertResolver { log, resolve }
     }
 
+    #[cfg(feature = "ipcc")]
     fn load_ipcc_key(&self) -> Result<Arc<CertifiedKey>, crate::Error> {
         let ipcc = Ipcc::new().map_err(crate::Error::RotRequest)?;
         let cert_chain_bytes = ipcc.rot_get_tq_cert_chain()?;
@@ -117,6 +122,7 @@ impl CertResolver {
 
     pub fn load_certified_key(&self) -> Result<Arc<CertifiedKey>, Error> {
         match &self.resolve {
+            #[cfg(feature = "ipcc")]
             ResolveSetting::Ipcc => self.load_ipcc_key(),
             ResolveSetting::Local {
                 priv_key,
@@ -191,9 +197,11 @@ impl SigningKey for LocalEd25519SigningKey {
 }
 
 /// Represents the underlying key returned over IPCC
+#[cfg(feature = "ipcc")]
 #[derive(Debug)]
 pub struct IpccKey {}
 
+#[cfg(feature = "ipcc")]
 impl SigningKey for IpccKey {
     fn choose_scheme(
         &self,
@@ -210,9 +218,11 @@ impl SigningKey for IpccKey {
     }
 }
 
+#[cfg(feature = "ipcc")]
 #[derive(Debug)]
 pub struct IpccSigner {}
 
+#[cfg(feature = "ipcc")]
 impl Signer for IpccSigner {
     fn sign(&self, message: &[u8]) -> Result<Vec<u8>, rustls::Error> {
         // We require sha3_256
@@ -384,6 +394,7 @@ pub struct SprocketsConfig {
 /// Configuration for attestation interface / artifacts.
 pub enum AttestConfig {
     // Use `dice-verifier::AttestIpcc`.
+    #[cfg(feature = "ipcc")]
     Ipcc,
     // Use artifacts from local files with `dice_verifier::AttestMock`.
     Local {
@@ -414,11 +425,14 @@ pub async fn get_attest_data(
     config: &AttestConfig,
     nonce: &dice_verifier::Nonce,
 ) -> Result<AttestArtifacts, Error> {
-    use dice_verifier::{ipcc::AttestIpcc, Attest, AttestMock};
+    #[cfg(feature = "ipcc")]
+    use dice_verifier::ipcc::AttestIpcc;
+    use dice_verifier::{Attest, AttestMock};
 
     // create the `Attest` impl prescribed by the config
     let (attest, test_corpus): (Box<dyn Attest + Send>, Vec<Utf8PathBuf>) =
         match config {
+            #[cfg(feature = "ipcc")]
             AttestConfig::Ipcc => (Box::new(AttestIpcc {}), vec![]),
             AttestConfig::Local {
                 priv_key,

tls/src/lib.rs

@@ -28,6 +28,7 @@ use x509_cert::{
 };
 
 pub mod client;
+#[cfg(feature = "ipcc")]
 pub mod ipcc;
 pub mod keys;
 pub mod server;
@@ -57,6 +58,7 @@ pub enum Error {
         err: io::Error,
     },
 
+    #[cfg(feature = "ipcc")]
     #[error("RotRequest")]
     RotRequest(#[from] ipcc::RotRequestError),
 
@@ -66,6 +68,7 @@ pub enum Error {
     #[error("Failed to create mock attester")]
     AttestMock(#[from] dice_verifier::mock::AttestMockError),
 
+    #[cfg(feature = "ipcc")]
     #[error("Failed to create IPCC attester")]
     AttestIpcc(#[from] dice_verifier::ipcc::IpccError),
 
@@ -380,13 +383,16 @@ mod tests {
 
     #[tokio::test]
     async fn toml_config() {
-        let ipcc = r#"
-        resolve = {which = "ipcc"}
-        roots = ["/path/to/root1", "/path/to/root2"]
-        attest = {which = "ipcc"}
-        "#;
+        #[cfg(feature = "ipcc")]
+        {
+            let ipcc = r#"
+            resolve = {which = "ipcc"}
+            roots = ["/path/to/root1", "/path/to/root2"]
+            attest = {which = "ipcc"}
+            "#;
 
-        let _: keys::SprocketsConfig = toml::from_str(ipcc).unwrap();
+            let _: keys::SprocketsConfig = toml::from_str(ipcc).unwrap();
+        }
 
         let local = r#"
         resolve = { which = "local", priv_key = "/path/to/tq-priv.pem", cert_chain = "/path/to/tq-chain.pem" }

tls/src/server.rs

@@ -398,6 +398,7 @@ impl Server {
         Ok(config)
     }
 
+    #[cfg(feature = "ipcc")]
     fn new_tls_ipcc_server_config(
         roots: Vec<Utf8PathBuf>,
         log: slog::Logger,
@@ -445,6 +446,7 @@ impl Server {
                 config.roots,
                 log.clone(),
             )?,
+            #[cfg(feature = "ipcc")]
             ResolveSetting::Ipcc => {
                 Server::new_tls_ipcc_server_config(config.roots, log.clone())?
             }