From 7e0b0754aaee04d3ffc395db61c03b2d42104f57 Mon Sep 17 00:00:00 2001 From: hannahbrodheim Date: Mon, 19 Oct 2026 13:49:20 -0400 Subject: [PATCH] Update verify_attestation_chains with new manufacturer cert The certificate expired and a new certificate to the same key now exists. Update the script to point to the new certificate instead of the expired certificate. --- kms/attestations/verify_attestation_chains.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kms/attestations/verify_attestation_chains.py b/kms/attestations/verify_attestation_chains.py index 2a530dd64c5..cd3df4d366f 100644 --- a/kms/attestations/verify_attestation_chains.py +++ b/kms/attestations/verify_attestation_chains.py @@ -36,7 +36,10 @@ ATTESTATION_SIGNATURE_LEN = 256 -MANUFACTURER_CERT_URL = "https://www.marvell.com/content/dam/marvell/en/public-collateral/security-solutions/liquid_security_certificate.zip" +MANUFACTURER_CERT_URL = ( + "https://www.marvell.com/content/dam/marvell/en/public-collateral/" + "security-solutions/liquidsecurity-certificate-cnxxxxx-nfbe-x.0-g-v3.zip" +) # MANUFACTURER_CERT_SUBJECT_BYTES = ( @@ -134,7 +137,7 @@ def get_manufacturer_root_certificate(): resp = requests.get(MANUFACTURER_CERT_URL) tmp_file = io.BytesIO(resp.content) zip_file = zipfile.ZipFile(tmp_file) - with zip_file.open("liquid_security_certificate.crt") as f: + with zip_file.open("cavium_cert.crt") as f: return x509.load_pem_x509_certificate(f.read(), backends.default_backend())