Add gramine-manifest to GSC build

finalize_manifest.py

@@ -23,28 +23,6 @@ def is_utf8(filename_bytes):
     except UnicodeError:
         return False
 
-def uri2path(uri):
-    if not uri.startswith('file:'):
-        raise ManifestError(f'Unsupported URI type: {uri}')
-    return pathlib.Path(uri[len('file:'):])
-
-def compute_sha256(filename):
-    sha256 = hashlib.sha256()
-    with open(filename, 'rb') as f:
-        for byte_block in iter(lambda: f.read(128 * sha256.block_size), b''):
-            sha256.update(byte_block)
-    return sha256.hexdigest()
-
-def expand_trusted_files(trusted_files):
-    expanded_files = []
-    for uri in trusted_files:
-        file_path = uri2path(uri)
-        if file_path.exists():
-            expanded_files.append({'uri': uri, 'sha256': compute_sha256(file_path)})
-        else:
-            raise ManifestError(f'File not found: {file_path}')
-    return expanded_files
-
 def extract_files_from_user_manifest(manifest):
     files = []
 
@@ -163,7 +141,7 @@ def main(args=None):
 
     if 'allow_all_but_log' not in rendered_manifest_dict['sgx'].get('file_check_policy', ''):
         trusted_files = generate_trusted_files(args.dir, already_added_files)
-        rendered_manifest_dict['sgx']['trusted_files'] = expand_trusted_files(trusted_files + already_added_files)
+        rendered_manifest_dict['sgx'].setdefault('trusted_files', []).extend(trusted_files)
     else:
         print(f'\t[from inside Docker container] Skipping trusted files generation. This image must not be used in production.')
 

templates/Dockerfile.common.build.template

@@ -62,7 +62,8 @@ RUN chmod u+x /gramine/app_files/apploader.sh \
     && rm -f /gramine/app_files/finalize_manifest.py
 
 RUN {% block path %}{% endblock %} \
-    && gramine-manifest-check /gramine/app_files/entrypoint.manifest
+    && gramine-manifest /gramine/app_files/entrypoint.manifest \
+    /gramine/app_files/entrypoint.manifest
 
 # Define default command
 ENTRYPOINT ["/bin/bash", "/gramine/app_files/apploader.sh"]