[nickpell]

Summary

• HandleArbitrationRequest now reports arbitrated N bids with N = the bids that were ranked and attested (len(coreBids)). It used len(req.Bids), which also counted bids whose IDs failed to parse; wireBidsToCoreBids moves those to ExcludedBids, so a request with one not-a-uuid bid and one valid bid reported "arbitrated 2 bids" while ranking one. The message is informational and is not part of the attestation; the client reads it only on failure. New test: TestHandleArbitrationRequest_MessageCountsRankedBids.
• The validateCommonAttestation doc comment now says the checks are shared by every attestation validation (arbitration and key). ValidateKeyAttestation (validation/key.go) calls it as well as the arbitration validator.
• enclave-image/scripts/setup-nitro-instance.sh no longer checks for or installs curl. Nothing on the builder instance runs curl: eif-build.yml runs this script and build-eif-ci.sh there over ssh, and neither calls curl. The workflow's only curl call (the ORAS download in "Install ORAS") runs on the GitHub-hosted runner. curl is preinstalled on the builder AMI (Build EIF run 38773132657 logs ✓ curl already installed), so no install step goes away. This follows the jq removal in ci: drop the unused jq dependency from the EIF builder setup script #58.
• The handler change is enclave code, so the EIF and its PCRs change and the post-merge update-pcrs job pushes a PCR update commit to main. The comment and setup-script changes are not EIF inputs.

Pre-merge checklist

• Build and lint pass: go build ./..., go vet ./... and mise run //:lint (golangci-lint, 0 issues).
• Tests pass: go test -count=1 ./... (CI test job, run 38907902751). TestHandleArbitrationRequest_MessageCountsRankedBids fails with len(req.Bids) (expected: "arbitrated 1 bids", actual: "arbitrated 2 bids") and passes with len(coreBids).
• Script lint: shellcheck reports only the existing SC1091 note for the runtime-sourced /etc/os-release; shfmt -i 4 -sr -d reports nothing on the changed line.
• Script behaviour: install_dependencies run with stub commands under bash 3.2 and 5.3 logs no curl line and returns 0; it logs ✓ aws already installed when aws is on PATH and runs dnf install -y awscli when it is missing.
• No builder-side curl use remains: git grep -n -w curl matches only the "Install ORAS" step in eif-build.yml, on ubuntu-latest.
• Diff contains no unintended changes: four files across three commits (handler and its test, one doc comment, one line of the setup script).
• GitHub Actions checks pass: test, lint and docker-build (run 38907902751) and Ratchet Lint (run 38907902623).

Post-deploy/apply verification

• The first Build EIF run on main after merge passes, including update-pcrs, which pushes the PCR update commit for this change; its "Setup Nitro instance" step logs no curl line and ends with ✓ Setup complete!. (Build EIF run 38912047704 on 3fd0c6b: Build EIF on Nitro EC2 and Update PCR validation file both succeeded, and update-pcrs pushed 5d76856 with the new PCRs. Setup ended ✓ Setup complete! at 14:02:32 UTC with no curl line; the only later curl is the runner-side download step.)
• The Build EIF run for the PCR update commit ends skipped, not failed. (Build EIF run 38913381773 for 5d76856: completed, skipped.)

[Copilot]

🟢 Approval recommended

The focused changes have no identified blocking issues; tests were not executed during review.

0 open findings

What changed in this PR

Corrects the arbitration success message and removes an unused EIF builder dependency, continuing the cleanup in #58.

Changes:

• Counts ranked bids rather than all submitted bids, with a regression test.
• Clarifies that common attestation checks cover arbitration and key validation.
• Removes curl from builder dependency installation.

File	Description
validation/​attestation.go	Clarifies the shared validation doc comment.
enclave/​handlers.go	Reports the ranked bid count.
enclave/​handlers_test.go	Tests that malformed bid IDs are excluded from the count.
enclave-image/​scripts/​setup-nitro-instance.sh	Removes the unused curl dependency.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.