In production, generate TDX quote using configfs-tsm

crates/threshold-signature-server/Cargo.toml

@@ -74,6 +74,7 @@ project-root={ version="0.2.2", optional=true }
 tdx-quote={ git="https://github.com/entropyxyz/tdx-quote", rev="f7968ff", optional=true, features=[
   "mock",
 ] }
+configfs-tsm={ git="https://github.com/entropyxyz/configfs-tsm", rev="f32c166", optional=true }
 
 [dev-dependencies]
 serial_test ="3.1.1"
@@ -104,10 +105,11 @@ entropy-testing-utils={ path="../testing-utils" }
 vergen={ version="8.3.2", features=["build", "git", "gitcl"] }
 
 [features]
-default     =['std']
+default     =["std", "dep:tdx-quote"]
 std         =["sp-core/std"]
 test_helpers=["dep:project-root"]
-unsafe      =["dep:tdx-quote"]
+unsafe      =[]
+production  =["std", "dep:configfs-tsm"]
 alice       =[]
 bob         =[]
 # Enable this feature to run the integration tests for the wasm API of entropy-protocol

crates/threshold-signature-server/src/attestation/api.rs

@@ -71,7 +71,7 @@ pub async fn attest(
 }
 
 /// Create a mock quote for testing on non-TDX hardware
-#[cfg(any(test, feature = "unsafe"))]
+#[cfg(not(feature = "production"))]
 pub async fn create_quote(
     block_number: u32,
     nonce: [u8; 32],
@@ -97,14 +97,22 @@ pub async fn create_quote(
     Ok(quote)
 }
 
-/// Once implemented, this will create a TDX quote in production
-#[cfg(not(any(test, feature = "unsafe")))]
+/// Create a TDX quote in production
+#[cfg(feature = "production")]
 pub async fn create_quote(
-    _block_number: u32,
-    _nonce: [u8; 32],
-    _signer: &PairSigner<EntropyConfig, sp_core::sr25519::Pair>,
-    _x25519_secret: &StaticSecret,
+    block_number: u32,
+    nonce: [u8; 32],
+    signer: &PairSigner<EntropyConfig, sp_core::sr25519::Pair>,
+    x25519_secret: &StaticSecret,
 ) -> Result<Vec<u8>, AttestationErr> {
-    // Non-mock attestation (the real thing) will go here
-    Err(AttestationErr::NotImplemented)
+    let public_key = x25519_dalek::PublicKey::from(x25519_secret);
+
+    let input_data = entropy_shared::QuoteInputData::new(
+        signer.signer().public(),
+        *public_key.as_bytes(),
+        nonce,
+        block_number,
+    );
+
+    Ok(configfs_tsm::create_quote(input_data.0)?)
 }

crates/threshold-signature-server/src/attestation/errors.rs

@@ -27,9 +27,6 @@ pub enum AttestationErr {
     GenericSubstrate(#[from] subxt::error::Error),
     #[error("User Error: {0}")]
     UserErr(#[from] crate::user::UserErr),
-    #[cfg(not(any(test, feature = "unsafe")))]
-    #[error("Not yet implemented")]
-    NotImplemented,
     #[error("Input must be 32 bytes: {0}")]
     TryFromSlice(#[from] TryFromSliceError),
     #[error("Could not get block number")]
@@ -40,6 +37,9 @@ pub enum AttestationErr {
     Unexpected,
     #[error("Could not decode message: {0}")]
     Codec(#[from] parity_scale_codec::Error),
+    #[cfg(feature = "production")]
+    #[error("Quote generation: {0}")]
+    QuoteGeneration(#[from] std::io::Error),
 }
 
 impl IntoResponse for AttestationErr {

deny.toml

@@ -40,6 +40,7 @@ exceptions=[
   { allow=["AGPL-3.0"], name="entropy-programs-runtime" },
   { allow=["AGPL-3.0"], name="synedrion" },
   { allow=["AGPL-3.0"], name="tdx-quote" },
+  { allow=["AGPL-3.0"], name="configfs-tsm" },
 
   # These are the only crates using these licenses, put them here instead of globally allowing
   # them