Skip to content

Commit d11b271

Browse files
cjen1-msftcjen1-msft
authored
Merge branch 'main' into tcb_checking
2 parents 8d6f848 + da4d63e commit d11b271

39 files changed

+789
-215
lines changed

‎.azure-pipelines-templates/deploy_aci.yml

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,9 @@
11
jobs:
2-
- job: generate_ssh_key
3-
displayName: "Generate SSH Key"
4-
variables:
5-
Codeql.SkipTaskAutoInjection: true
6-
skipComponentGovernanceDetection: true
7-
pool:
8-
vmImage: ubuntu-20.04
9-
steps:
10-
- checkout: none
11-
12-
- template: generate_ssh_key.yml
13-
142
- job: deploy_primary_aci
153
displayName: "Deploy ACI"
16-
dependsOn:
17-
- generate_ssh_key
184
variables:
195
Codeql.SkipTaskAutoInjection: true
206
skipComponentGovernanceDetection: true
21-
sshKey: $[ dependencies.generate_ssh_key.outputs['generate_ssh_key.sshKey'] ]
227
pool:
238
name: ado-virtual-ccf-sub # To build CCF quickly
249
demands:
@@ -31,9 +16,7 @@ jobs:
3116
fetchDepth: 0
3217
fetchTags: true
3318

34-
- template: install_ssh_key.yml
35-
parameters:
36-
ssh_key: $(sshKey)
19+
- template: generate_ssh_key.yml
3720

3821
- template: azure_cli.yml
3922
parameters:
@@ -70,7 +53,6 @@ jobs:
7053
--memory-gb 64 \
7154
--core-count 16 \
7255
--aci-setup-timeout 300 \
73-
--aci-private-key-b64 $(sshKey) \
7456
--out ~/aci_ips
7557
# Create a ~/ipAddresses files which is a list of `<container group name> <IP address>` separated by newlines.
7658
source ./scripts/azure_deployment/escape_data.sh # Include escape_data to handle newlines.

‎.azure-pipelines-templates/generate_ssh_key.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
steps:
22
- script: |
33
set -ex
4+
mkdir -p ~/.ssh
45
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""
5-
echo "##vso[task.setvariable variable=sshKey;isOutput=true;issecret=true]`base64 -w 0 ~/.ssh/id_rsa`"
6-
name: generate_ssh_key
76
displayName: "Generate SSH Key"

‎.azure-pipelines-templates/install_ssh_key.yml

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎.github/workflows/long-test.yml

Lines changed: 107 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ jobs:
311311
git config --global --add safe.directory /__w/CCF/CCF
312312
mkdir build
313313
cd build
314-
cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TEST=ON ..
314+
cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TESTS=ON ..
315315
ninja
316316
shell: bash
317317

@@ -326,3 +326,109 @@ jobs:
326326
# All e2e tests, which are now supported on Mariner.
327327
./tests.sh --timeout 1600 --output-on-failure -LE "benchmark"
328328
shell: bash
329+
330+
long-asan-azure-linux:
331+
if: ${{ contains(github.event.pull_request.labels.*.name, 'run-long-test') || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'}}
332+
name: "Azure Linux ASAN"
333+
runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
334+
container:
335+
image: mcr.microsoft.com/azurelinux/base/core:3.0
336+
options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
337+
338+
steps:
339+
- name: "Checkout dependencies"
340+
shell: bash
341+
run: |
342+
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
343+
tdnf -y update
344+
tdnf -y install ca-certificates git
345+
346+
- uses: actions/checkout@v4
347+
with:
348+
fetch-depth: 0
349+
350+
- name: "Install dependencies"
351+
shell: bash
352+
run: |
353+
set -ex
354+
./scripts/setup-ci.sh
355+
356+
- name: "Build Debug (Long Test)"
357+
run: |
358+
set -ex
359+
git config --global --add safe.directory /__w/CCF/CCF
360+
mkdir build
361+
cd build
362+
cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TESTS=ON -DSAN=ON ..
363+
ninja
364+
365+
- name: "Test"
366+
run: |
367+
set +x
368+
cd build
369+
./tests.sh --output-on-failure --timeout 1600 -LE "benchmark"
370+
371+
- name: "Upload logs"
372+
if: success() || failure()
373+
uses: actions/upload-artifact@v4
374+
with:
375+
name: logs-asan-al
376+
path: |
377+
build/workspace/*/*.config.json
378+
build/workspace/*/out
379+
build/workspace/*/err
380+
build/workspace/*.ledger/*
381+
if-no-files-found: ignore
382+
383+
long-tsan-azure-linux:
384+
if: ${{ contains(github.event.pull_request.labels.*.name, 'run-long-test') || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'}}
385+
name: "Azure Linux TSAN"
386+
runs-on: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
387+
container:
388+
image: mcr.microsoft.com/azurelinux/base/core:3.0
389+
options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
390+
391+
steps:
392+
- name: "Checkout dependencies"
393+
shell: bash
394+
run: |
395+
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
396+
tdnf -y update
397+
tdnf -y install ca-certificates git
398+
399+
- uses: actions/checkout@v4
400+
with:
401+
fetch-depth: 0
402+
403+
- name: "Install dependencies"
404+
shell: bash
405+
run: |
406+
set -ex
407+
./scripts/setup-ci.sh
408+
409+
- name: "Build Debug (Long Test)"
410+
run: |
411+
set -ex
412+
git config --global --add safe.directory /__w/CCF/CCF
413+
mkdir build
414+
cd build
415+
cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Debug -DLONG_TESTS=ON -DTSAN=ON -DWORKER_THREADS=2 ..
416+
ninja
417+
418+
- name: "Test"
419+
run: |
420+
set +x
421+
cd build
422+
./tests.sh --output-on-failure --timeout 1600 -LE "benchmark"
423+
424+
- name: "Upload logs"
425+
if: success() || failure()
426+
uses: actions/upload-artifact@v4
427+
with:
428+
name: logs-tsan-al
429+
path: |
430+
build/workspace/*/*.config.json
431+
build/workspace/*/out
432+
build/workspace/*/err
433+
build/workspace/*.ledger/*
434+
if-no-files-found: ignore

‎.snpcc_canary

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
___ ___ ___ \_/
2-
(. =) Y (0 0) (x X) Y (___)
2+
(. =) Y (0 0) (x X) Y (v-v)
33
O \ o | / |
44
/-xXx--//-----x=x--/-xXx--/---x-/--->>>--/
55
...
66
/\/\d(-_-)b/\/\
7-
----vmpl----
7+
----vmpl----

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
1212
### Fixed
1313

1414
- `ccf.ledger`/`read_ledger.py` previously enforced too strict a condition on node membership when validating ledger files (#6849).
15+
- Restore low CPU usage on idle nodes, which had increased in dev20 (#6816).
1516

1617
## [6.0.0-dev20]
1718

‎CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -716,6 +716,7 @@ if(BUILD_TESTS)
716716
${CMAKE_CURRENT_SOURCE_DIR}/src/ds/test/unit_strings.cpp
717717
${CMAKE_CURRENT_SOURCE_DIR}/src/ds/test/dl_list.cpp
718718
${CMAKE_CURRENT_SOURCE_DIR}/src/ds/test/nonstd.cpp
719+
${CMAKE_CURRENT_SOURCE_DIR}/src/ds/test/work_beacon.cpp
719720
)
720721
target_link_libraries(ds_test PRIVATE ${CMAKE_THREAD_LIBS_INIT})
721722

‎doc/audit/builtin_maps.rst

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -376,9 +376,6 @@ JWT issuers.
376376
:project: CCF
377377
:members:
378378

379-
.. doxygenenum:: ccf::JwtIssuerKeyFilter
380-
:project: CCF
381-
382379
``jwt.public_signing_keys``
383380
~~~~~~~~~~~~~~~~~~~~~~~~~~~
384381

‎doc/build_apps/auth/jwt.rst

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ Before adding public token signing keys to a running CCF network, the IdP has to
2121
"name": "set_jwt_issuer",
2222
"args": {
2323
"issuer": "my_issuer",
24-
"key_filter": "all",
2524
"auto_refresh": false
2625
}
2726
}
@@ -95,7 +94,6 @@ Now the issuer can be created with auto-refresh enabled:
9594
"name": "set_jwt_issuer",
9695
"args": {
9796
"issuer": "https://login.microsoftonline.com/common/v2.0",
98-
"key_filter": "all",
9997
"ca_cert_bundle_name": "jwt_ms",
10098
"auto_refresh": true
10199
}

‎doc/host_config_schema/cchost_config.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@
1313
},
1414
"platform": {
1515
"type": "string",
16-
"enum": ["SGX", "SNP", "Virtual"],
17-
"default": "SGX",
16+
"enum": ["SNP", "Virtual"],
17+
"default": "SNP",
1818
"description": "Trusted Execution Environment platform"
1919
},
2020
"type": {
2121
"type": "string",
2222
"enum": ["Release", "Debug", "Virtual"],
2323
"default": "Release",
24-
"description": "Type of enclave application (only if platform is SGX). \"Virtual\" is deprecated (use ``platform`` instead)"
24+
"description": "Type of enclave application (only if platform is SGX, now deprecated). \"Virtual\" is deprecated (use ``platform`` instead)"
2525
}
2626
},
2727
"description": "This section includes configuration for the enclave application launched by this node",
@@ -522,7 +522,7 @@
522522
"description": "List of servers used to retrieve attestation report endorsement certificates (SEV-SNP only). The first server in the list is always used and other servers are only specified as fallback. If set, attestation endorsements from ``--snp-security-context-dir-var`` are ignored, but uvm endorsements from that directory are still used."
523523
}
524524
},
525-
"description": "This section includes configuration for the attestation for AMD SEV-SNP platform (ignored for SGX)",
525+
"description": "This section includes configuration for the attestation for AMD SEV-SNP platform.",
526526
"additionalProperties": false
527527
},
528528
"service_data_json_file": {

‎doc/schemas/gov/2023-06-01-preview/examples/ServiceState_GetJwkInfo.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
"body": {
1010
"issuers": {
1111
"idprovider.myservice.example.com": {
12-
"keyFilter": "All",
1312
"autoRefresh": true,
1413
"caCertBundleName": "MyIdProviderCa"
1514
}

‎doc/schemas/gov/2024-07-01/examples/ServiceState_GetJwkInfo.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
"body": {
1010
"issuers": {
1111
"idprovider.myservice.example.com": {
12-
"keyFilter": "All",
1312
"autoRefresh": true,
1413
"caCertBundleName": "MyIdProviderCa"
1514
}

‎doc/schemas/gov/2024-07-01/gov.json

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1914,10 +1914,6 @@
19141914
"type": "object",
19151915
"description": "Description of a JWT issuer or identity provider that the current service will trust tokens from.",
19161916
"properties": {
1917-
"keyFilter": {
1918-
"$ref": "#/definitions/ServiceState.JwtIssuerKeyFilter",
1919-
"description": "Adds restrictions on whether keys should be accepted from this issuer."
1920-
},
19211917
"keyPolicy": {
19221918
"type": "object",
19231919
"description": "Collection of claims which must be present in SGX attestation to permit updates from this issuer.",
@@ -1935,34 +1931,9 @@
19351931
}
19361932
},
19371933
"required": [
1938-
"keyFilter",
19391934
"autoRefresh"
19401935
]
19411936
},
1942-
"ServiceState.JwtIssuerKeyFilter": {
1943-
"type": "string",
1944-
"description": "Possible restrictions on what keys will be accepted from a JWT issuer.",
1945-
"enum": [
1946-
"All",
1947-
"Sgx"
1948-
],
1949-
"x-ms-enum": {
1950-
"name": "JwtIssuerKeyFilter",
1951-
"modelAsString": true,
1952-
"values": [
1953-
{
1954-
"name": "All",
1955-
"value": "All",
1956-
"description": "Accepts any JWT issuer."
1957-
},
1958-
{
1959-
"name": "Sgx",
1960-
"value": "Sgx",
1961-
"description": "Only accepts JWTs issued by a token provider running in SGX, which provides a suitable attestation and additional claims."
1962-
}
1963-
]
1964-
}
1965-
},
19661937
"ServiceState.Member": {
19671938
"type": "object",
19681939
"description": "Information on individual members within a consortium.",

‎doc/schemas/gov_openapi.json

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -271,22 +271,13 @@
271271
},
272272
"type": "object"
273273
},
274-
"JwtIssuerKeyFilter": {
275-
"enum": [
276-
"all"
277-
],
278-
"type": "string"
279-
},
280274
"JwtIssuerMetadata": {
281275
"properties": {
282276
"auto_refresh": {
283277
"$ref": "#/components/schemas/boolean"
284278
},
285279
"ca_cert_bundle_name": {
286280
"$ref": "#/components/schemas/string"
287-
},
288-
"key_filter": {
289-
"$ref": "#/components/schemas/JwtIssuerKeyFilter"
290281
}
291282
},
292283
"type": "object"
@@ -1348,7 +1339,7 @@
13481339
"info": {
13491340
"description": "This API is used to submit and query proposals which affect CCF's public governance tables.",
13501341
"title": "CCF Governance API",
1351-
"version": "4.6.0"
1342+
"version": "4.6.1"
13521343
},
13531344
"openapi": "3.0.0",
13541345
"paths": {

‎include/ccf/service/tables/jwt.h

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,6 @@ namespace ccf
2121

2222
struct JwtIssuerMetadata
2323
{
24-
/// JWT issuer key filter, kept for compatibility with existing ledgers
25-
JwtIssuerKeyFilter key_filter = JwtIssuerKeyFilter::All;
2624
/// Optional CA bundle name used for authentication when auto-refreshing
2725
std::optional<std::string> ca_cert_bundle_name;
2826
/// Whether to auto-refresh keys from the issuer
@@ -32,7 +30,7 @@ namespace ccf
3230
DECLARE_JSON_TYPE_WITH_OPTIONAL_FIELDS(JwtIssuerMetadata);
3331
DECLARE_JSON_REQUIRED_FIELDS(JwtIssuerMetadata);
3432
DECLARE_JSON_OPTIONAL_FIELDS(
35-
JwtIssuerMetadata, key_filter, ca_cert_bundle_name, auto_refresh);
33+
JwtIssuerMetadata, ca_cert_bundle_name, auto_refresh);
3634

3735
using JwtIssuer = std::string;
3836
using JwtKeyId = std::string;

‎samples/config/join_config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"enclave": {
33
"file": "libjs_generic.enclave.so.signed",
4-
"platform": "SGX",
4+
"platform": "SNP",
55
"type": "Release"
66
},
77
"network": {

‎samples/config/minimal_config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"enclave": {
33
"file": "libjs_generic.enclave.so.signed",
4-
"platform": "SGX",
4+
"platform": "SNP",
55
"type": "Release"
66
},
77
"network": {

0 commit comments

Comments
 (0)