Count only ranked bids in the arbitration message; drop unused curl from the EIF builder setup

enclave-image/scripts/setup-nitro-instance.sh

@@ -155,7 +155,7 @@ install_dependencies() {
     log "Installing additional dependencies..."
 
     # command:package pairs; the awscli package provides the aws command.
-    local deps=("curl:curl" "aws:awscli")
+    local deps=("aws:awscli")
     local dep cmd pkg
 
     for dep in "${deps[@]}"; do

enclave/handlers.go

@@ -80,7 +80,7 @@ func HandleArbitrationRequest(
 	return enclaveapi.EnclaveArbitrationResponse{
 		Type:                  "arbitration_response",
 		Success:               true,
-		Message:               fmt.Sprintf("arbitrated %d bids", len(req.Bids)),
+		Message:               fmt.Sprintf("arbitrated %d bids", len(coreBids)),
 		AttestationCOSEBase64: cose.EncodeBase64(),
 		ExcludedBids:          excluded,
 		Bids:                  resolvedBids(resp.Bids),

enclave/handlers_test.go

@@ -113,6 +113,27 @@ func TestHandleArbitrationRequest_RecordsMalformedBidIDsAsExcluded(t *testing.T)
 		"attestation should bind malformed bid as excluded")
 }
 
+// TestHandleArbitrationRequest_MessageCountsRankedBids pins the success
+// message to the ranked bids: a bid excluded for a malformed ID is not
+// counted.
+func TestHandleArbitrationRequest_MessageCountsRankedBids(t *testing.T) {
+	t.Parallel()
+	km, err := NewKeyManager()
+	require.NoError(t, err)
+
+	req := enclaveapi.EnclaveArbitrationRequest{
+		RequestID: "req-count",
+		Bids: []enclaveapi.WireBid{
+			{ID: "not-a-uuid", Source: "A", CleartextRevenue: core.MicroDollars(100)},
+			{ID: uuid.NewString(), Source: "B", CleartextRevenue: core.MicroDollars(200)},
+		},
+	}
+	resp := HandleArbitrationRequest(newFakeAttester(), km, req)
+	require.True(t, resp.Success, "message=%s", resp.Message)
+	require.Len(t, resp.ExcludedBids, 1)
+	assert.Equal(t, "arbitrated 1 bids", resp.Message)
+}
+
 // TestHandleArbitrationRequest_PopulatesResolvedBids confirms the response
 // carries every ranked bid in ranked order (winner first) with its
 // Source, resolved revenue, and decryption outcome, and that this new

validation/attestation.go

@@ -11,8 +11,8 @@ import (
 )
 
 // validateCommonAttestation performs the platform-level checks shared by
-// every arbitration validation: PCR matching, certificate-chain
-// verification, and COSE signature verification.
+// every attestation validation (arbitration and key): PCR matching,
+// certificate-chain verification, and COSE signature verification.
 //
 // knownPCRs lists the PCR sets the validator trusts; pass the result of
 // [LoadPCRsFromFile] or the literal slice for a fixed deployment.