Skip to content

Commit 12864aa

Browse files
bvavalabvavala
committed
move attestation api dependencies for pdo to separate script, and call that from pdo docker build
Signed-off-by: Bruno Vavala <[email protected]>
1 parent 6b602ed commit 12864aa

File tree

6 files changed

+91
-43
lines changed

6 files changed

+91
-43
lines changed

Diff for: ‎build/common-config.sh

+6
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,12 @@ var_set() {
3434
"
3535
env_key_sort[$i]="WASM_SRC"; i=$i+1; export WASM_SRC=${env_val[WASM_SRC]};
3636

37+
env_val[DCAP_PRIMITIVES]="${DCAP_PRIMITIVES:-/tmp/SGXDataCenterAttestationPrimitives}"
38+
env_desc[DCAP_PRIMITIVES]="
39+
DCAP_PRIMITIVES points to the source repo of DCAP
40+
"
41+
env_key_sort[$i]="DCAP_PRIMITIVES"; i=$i+1; export DCAP_PRIMITIVES=${env_val[DCAP_PRIMITIVES]};
42+
3743
env_val[PDO_MEMORY_CONFIG]="${PDO_MEMORY_CONFIG:-MEDIUM}"
3844
env_desc[PDO_MEMORY_CONFIG]="
3945
PDO_MEMORY_CONFIG indicates the memory configuration for the

Diff for: ‎common/crypto/attestation-api/CMakeLists.txt

+5
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ set(CMAKE_CXX_EXTENSIONS OFF)
1212

1313
INCLUDE(CMakeVariables.txt)
1414

15+
IF (NOT DEFINED ENV{DCAP_PRIMITIVES})
16+
MESSAGE(FATAL_ERROR "DCAP_PRIMITIVES variable with source repo path not defined")
17+
ENDIF()
18+
1519
###################################################################################################
1620
# First run cmake in common
1721
###################################################################################################
@@ -95,6 +99,7 @@ ADD_CUSTOM_COMMAND(TARGET ${B64ATTESTATION_TO_B64COLLATERAL}
9599

96100
TARGET_INCLUDE_DIRECTORIES(${B64ATTESTATION_TO_B64COLLATERAL} PRIVATE common)
97101

102+
# newer DCAP (1.22) libs need the qal (older, 1.19, don't)
98103
SET(DCAP_LINK_LIBS ${DCAP_QV_PATH}/appraisal/qal/libdcap_qal.a)
99104

100105
TARGET_LINK_LIBRARIES(${B64ATTESTATION_TO_B64COLLATERAL}

Diff for: ‎common/crypto/attestation-api/docker/container/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This directory contains scripts to set up the attestation API dependencies in the docker container.
2+
3+
The scripts are obviously meant to be run before the attestation API build and, possibly, during the docker build.

Diff for: ‎common/crypto/attestation-api/docker/container/setup.sh

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/bin/bash
2+
# Copyright 2024 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
set -e
17+
18+
apt-get update
19+
20+
# install quote library, necessary for dcap attestation generation
21+
# install quote verify library, necessary for attestation conversion and verification
22+
# (though inside the enclave we use the static libraries of DCAP)
23+
apt-get install -y \
24+
--no-install-recommends \
25+
libsgx-dcap-ql-dev \
26+
libsgx-dcap-quote-verify-dev
27+
28+
# -----------------------------------------------------------------
29+
# SGX DCAP Primitives
30+
# -----------------------------------------------------------------
31+
apt-get install -y -q \
32+
libboost-dev \
33+
libboost-system-dev \
34+
libboost-thread-dev \
35+
protobuf-c-compiler \
36+
libprotobuf-c-dev \
37+
protobuf-compiler
38+
39+
# Note: libsgx-dcap-default-qpl-dev adds libdcap_quoteprov.so and /usr/include/sgx_default_quote_provider.h
40+
apt-get install -y \
41+
basez \
42+
clang \
43+
libsgx-dcap-default-qpl \
44+
libsgx-dcap-default-qpl-dev \
45+
jq
46+
47+
export DCAP=1.22
48+
49+
git clone https://github.com/intel/SGXDataCenterAttestationPrimitives.git ${DCAP_PRIMITIVES} \
50+
&& cd ${DCAP_PRIMITIVES}/QuoteVerification \
51+
&& git checkout DCAP_${DCAP} \
52+
&& git submodule update --init --recursive
53+
54+
cd ${DCAP_PRIMITIVES}/QuoteGeneration \
55+
&& ./download_prebuilt.sh \
56+
&& make GEN_STATIC=1
57+
58+
# NOTE: below the build (./release) is run twice. Unfortunately, this is necessary because both builds fails
59+
# when run separately in a clean environment, but succeed if they run in sequence, and produce the expected result.
60+
# This issue has been communicated to the developers of the DCAP primitives.
61+
cd ${DCAP_PRIMITIVES}/QuoteVerification/QVL/Src
62+
./release -DBUILD_ENCLAVE=ON -DBUILD_TESTS=OFF || true
63+
./release -DBUILD_ENCLAVE=ON -DBUILD_ATTESTATION_APP=OFF -DBUILD_TESTS=OFF
64+
65+
# set up the qcnl to connect to the local pccs for dcap verification collateral
66+
echo '{\n\
67+
"pccs_url": "https://localhost:8081/sgx/certification/v4/", \n\
68+
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",\n\
69+
"use_secure_cert": false\n\
70+
}' > /etc/sgx_default_qcnl.conf
71+

Diff for: ‎docker/pdo_services_base.dockerfile

+5-43
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@ RUN echo "deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu ${U
3636
--no-install-recommends \
3737
libsgx-urts \
3838
libsgx-uae-service \
39-
libsgx-dcap-ql-dev \
40-
libsgx-dcap-quote-verify-dev \
4139
&& apt-get clean \
4240
&& rm -rf /var/lib/apt/lists/*
4341

@@ -86,50 +84,14 @@ RUN . /opt/intel/sgxsdk/environment \
8684

8785
ENV SGX_SSL="/opt/intel/sgxssl"
8886

89-
9087
# -----------------------------------------------------------------
91-
# SGX DCAP Primitives
88+
# Install dependencies for Attestation API
9289
# -----------------------------------------------------------------
93-
RUN apt-get update
94-
RUN apt-get install -y -q \
95-
libboost-dev \
96-
libboost-system-dev \
97-
libboost-thread-dev \
98-
protobuf-c-compiler \
99-
libprotobuf-c-dev \
100-
protobuf-compiler
101-
RUN apt-get install -y \
102-
basez \
103-
clang \
104-
libsgx-dcap-default-qpl \
105-
#libsgx-dcap-default-qpl-dev adds libdcap_quoteprov.so and /usr/include/sgx_default_quote_provider.h
106-
libsgx-dcap-default-qpl-dev \
107-
jq
108-
109-
ARG DCAP=1.22
110-
ENV DCAP_PRIMITIVES=/tmp/SGXDataCenterAttestationPrimitives
111-
112-
RUN git clone https://github.com/intel/SGXDataCenterAttestationPrimitives.git ${DCAP_PRIMITIVES} \
113-
&& cd ${DCAP_PRIMITIVES}/QuoteVerification \
114-
&& git checkout DCAP_${DCAP} \
115-
&& git submodule update --init --recursive
116-
117-
RUN cd ${DCAP_PRIMITIVES}/QuoteGeneration \
118-
&& ./download_prebuilt.sh \
119-
&& make GEN_STATIC=1
120-
121-
# NOTE: below the build (./release) is run twice. Unfortunately, this is necessary because both builds fails
122-
# when run separately in a clean environment, but succeed if they run in sequence, and produce the expected result.
123-
# This issue has been communicated to the developers of the DCAP primitives.
124-
RUN cd ${DCAP_PRIMITIVES}/QuoteVerification/QVL/Src \
125-
&& ./release -DBUILD_ENCLAVE=ON -DBUILD_TESTS=OFF ; ./release -DBUILD_ENCLAVE=ON -DBUILD_ATTESTATION_APP=OFF -DBUILD_TESTS=OFF
126-
127-
RUN echo '{\n\
128-
"pccs_url": "https://localhost:8081/sgx/certification/v4/", \n\
129-
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",\n\
130-
"use_secure_cert": false\n\
131-
}' > /etc/sgx_default_qcnl.conf
13290

91+
# as the pdo repo is not available at this point, we copy the script in the container
92+
COPY repository/common/crypto/attestation-api/docker/container/setup.sh /tmp
93+
RUN DCAP_PRIMITIVES=/tmp/SGXDataCenterAttestationPrimitives /tmp/setup.sh
94+
RUN rm /tmp/setup.sh
13395

13496
# -----------------------------------------------------------------
13597
# -----------------------------------------------------------------

Diff for: ‎docker/tools/environment.sh

+1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ export PDO_HOME=${PDO_INSTALL_ROOT}/opt/pdo
3535
export PDO_LEDGER_KEY_ROOT=${PDO_HOME}/keys/ledger
3636
export PDO_LEDGER_KEY_SKF=${PDO_LEDGER_KEY_ROOT}/pdo_validator.priv
3737
export WASM_SRC="${PDO_SOURCE_ROOT}/interpreters/wasm-micro-runtime"
38+
export DCAP_PRIMITIVES=${DCAP_PRIMITIVES:-/tmp/SGXDataCenterAttestationPrimitives}
3839

3940
if [ ${PDO_LEDGER_TYPE,,} = "ccf" ]; then
4041
export PDO_DEFAULT_SIGCURVE=SECP384R1

0 commit comments

Comments
 (0)