feat: use external certificate cache

blacklight-node/Cargo.toml

@@ -1,13 +1,13 @@
 [package]
 name = "blacklight-node"
-version = "0.9.0"
+version = "0.10.0"
 edition = "2024"
 
 [dependencies]
 alloy = { version = "1.1", features = ["contract", "providers"] }
 anyhow = "1.0"
 async-trait = "0.1"
-attestation-verification = { git = "https://github.com/NillionNetwork/nilcc", rev = "b9b73bfc12141c358920b7af3bb5275292c55cc7", package = "attestation-verification" }
+attestation-verification = { git = "https://github.com/NillionNetwork/nilcc", rev = "6a40845fc21f46d2b167eb071aa14ead2647caa5", package = "attestation-verification" }
 dcap-qvl = "0.3.4"
 clap = { version = "4.5", features = ["derive", "env", "string"] }
 futures-util = "0.3"

blacklight-node/src/args.rs

@@ -44,6 +44,10 @@ pub struct CliArgs {
     /// The path where AMD certificates will be cached.
     #[clap(short, long, default_value = default_cert_cache_path().into_os_string(), env = "CERT_CACHE")]
     pub cert_cache: PathBuf,
+
+    /// The domain used to fetch processor VCEK certificates from.
+    #[clap(long, default_value = "certs.nilcc.nillion.network")]
+    pub cert_cache_domain: String,
 }
 
 /// Node configuration with all required values resolved

blacklight-node/src/main.rs

@@ -34,7 +34,11 @@ async fn main() -> Result<()> {
 
     // Load configuration
     let cli_args = CliArgs::parse();
-    let verifier = HtxVerifier::new(cli_args.artifact_cache.clone(), cli_args.cert_cache.clone())?;
+    let verifier = HtxVerifier::new(
+        cli_args.artifact_cache.clone(),
+        cli_args.cert_cache.clone(),
+        cli_args.cert_cache_domain.clone(),
+    )?;
     let config = NodeConfig::load(cli_args).await?;
 
     // Setup shutdown handler

blacklight-node/src/supervisor/version.rs

@@ -243,8 +243,4 @@ mod tests {
             VersionCompatibility::Equal
         );
     }
-    #[test]
-    fn test_package_version() {
-        assert_eq!("0.9.0", env!("CARGO_PKG_VERSION"));
-    }
 }

blacklight-node/src/verification.rs

@@ -126,14 +126,19 @@ pub struct HtxVerifier {
 }
 
 impl HtxVerifier {
-    pub fn new(artifact_cache: PathBuf, cert_cache: PathBuf) -> anyhow::Result<Self> {
+    pub fn new(
+        artifact_cache: PathBuf,
+        cert_cache: PathBuf,
+        cert_cache_domain: String,
+    ) -> anyhow::Result<Self> {
         let report_fetcher = ReportFetcher::new(
             artifact_cache.clone(),
             ARTIFACTS_URL.to_string(),
             Box::new(LockedDownloader::default()),
         );
-        let fetcher =
-            DefaultCertificateFetcher::new(cert_cache).context("Creating certificate fetcher")?;
+        let fetcher = DefaultCertificateFetcher::new(cert_cache)
+            .context("Creating certificate fetcher")?
+            .with_processor_cert_domain(cert_cache_domain);
         let report_verifier = ReportVerifier::new(Arc::new(fetcher));
         Ok(Self {
             report_fetcher: Arc::new(report_fetcher),