Skip to content

Commit 2df262f

Browse files
binglekrugerbinglekruger
committed
feat: Docker set-p + basic signing key management
1 parent 2cbcbd9 commit 2df262f

File tree

9 files changed

+861
-1
lines changed

9 files changed

+861
-1
lines changed

‎docs/installation/sgx-mvp.md

+5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ Before installing the Nautilus MVP, ensure your system meets the following requi
2727

2828
Follow the instructions in the [Gramine Installation Guide](https://gramine.readthedocs.io/en/stable/installation.html#install-gramine-packages-1) under "Install Gramine packages" and [Prepare a signing key](https://gramine.readthedocs.io/en/stable/quickstart.html#prepare-a-signing-key).
2929

30+
```sh
31+
gramine-sgx-gen-private-key keys/enclave-key.pem
32+
chmod 400 keys/enclave-key.pem
33+
```
34+
3035
3. **Rust Environment**
3136

3237
```sh

‎sgx-mvp/LICENSE

+661
Large diffs are not rendered by default.

‎sgx-mvp/Makefile

+2-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ sgx-mvp.manifest.sgx sgx-mvp.sig: sgx_sign
4646
sgx_sign: sgx-mvp.manifest $(SELF_EXE)
4747
gramine-sgx-sign \
4848
--manifest $< \
49-
--output $<.sgx
49+
--output $<.sgx \
50+
--key keys/enclave-key.pem
5051

5152
ifeq ($(SGX),)
5253
GRAMINE = gramine-direct

‎sgx-mvp/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ This directory contains all the relevant SGX code for NTC-MVP.
1414

1515
1. Follow the instructions in the [Gramine Installation Guide](https://gramine.readthedocs.io/en/stable/installation.html#install-gramine-packages-1) under "Install Gramine packages" and [Prepare a signing key](https://gramine.readthedocs.io/en/stable/quickstart.html#prepare-a-signing-key).
1616

17+
```sh
18+
gramine-sgx-gen-private-key keys/enclave-key.pem
19+
chmod 400 keys/enclave-key.pem
20+
```
21+
1722
2. Ensure that Python 3.8 is installed. If necessary, modify the path(s) in the [sgx-mvp.manifest.template](https://github.com/ntls-io/trusted-compute-MVP/blob/main/sgx-mvp/sgx-mvp.manifest.template) to match your setup.
1823

1924
Ensure that you have the necessary Python development package installed:

‎sgx-mvp/docker/Dockerfile

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
ARG UBUNTU_IMAGE=ubuntu:20.04
2+
FROM ${UBUNTU_IMAGE}
3+
4+
# ARGs cannot be grouped since each FROM in a Dockerfile initiates a new build
5+
# stage, resulting in the loss of ARG values from earlier stages.
6+
ARG UBUNTU_CODENAME=focal
7+
8+
# Base Gramine setup
9+
RUN apt-get update && \
10+
DEBIAN_FRONTEND=noninteractive apt-get install -y curl gnupg2 binutils
11+
12+
RUN curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg && \
13+
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ '${UBUNTU_CODENAME}' main' > /etc/apt/sources.list.d/gramine.list
14+
15+
RUN curl -fsSLo /usr/share/keyrings/intel-sgx-deb.key https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key && \
16+
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.key] https://download.01.org/intel-sgx/sgx_repo/ubuntu '${UBUNTU_CODENAME}' main' > /etc/apt/sources.list.d/intel-sgx.list
17+
18+
# Install Gramine and dependencies
19+
RUN apt-get update && \
20+
DEBIAN_FRONTEND=noninteractive apt-get install -y gramine \
21+
sgx-aesm-service \
22+
libsgx-aesm-launch-plugin \
23+
libsgx-aesm-epid-plugin \
24+
libsgx-aesm-quote-ex-plugin \
25+
libsgx-aesm-ecdsa-plugin \
26+
libsgx-dcap-quote-verify \
27+
psmisc \
28+
git \
29+
make \
30+
cmake \
31+
python3.8-dev \
32+
python3-numpy \
33+
python3-scipy \
34+
libffi-dev \
35+
libssl-dev \
36+
ca-certificates \
37+
pkg-config \
38+
wget \
39+
software-properties-common \
40+
clang \
41+
llvm && \
42+
apt-get clean && \
43+
rm -rf /var/lib/apt/lists/*
44+
45+
# Set Clang as the default compiler
46+
ENV CC=clang
47+
ENV CXX=clang++
48+
49+
# Install Azure DCAP client
50+
RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | apt-key add - && \
51+
DEBIAN_FRONTEND=noninteractive add-apt-repository "deb [arch=amd64] https://packages.microsoft.com/ubuntu/20.04/prod focal main" && \
52+
apt-get update && \
53+
DEBIAN_FRONTEND=noninteractive apt-get install -y az-dcap-client && \
54+
apt-get clean && \
55+
rm -rf /var/lib/apt/lists/*
56+
57+
# Install Rust
58+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
59+
ENV PATH="/root/.cargo/bin:${PATH}"
60+
61+
# Clone only the sgx-mvp directory
62+
WORKDIR /app
63+
RUN git clone --depth 1 --sparse https://github.com/ntls-io/trusted-compute-MVP.git && \
64+
cd trusted-compute-MVP && \
65+
git sparse-checkout set sgx-mvp
66+
67+
# Create necessary library directory
68+
RUN mkdir -p /lib/x86_64-pc-linux-gnu && \
69+
ln -s /lib/x86_64-linux-gnu/* /lib/x86_64-pc-linux-gnu/
70+
71+
RUN mkdir -p /var/run/aesmd/
72+
73+
# Build the MVP with temporarily mounted key
74+
RUN --mount=type=secret,id=enclave_key,target=/app/trusted-compute-MVP/keys/enclave-key.pem \
75+
cd /app/trusted-compute-MVP/sgx-mvp && \
76+
make SGX=1 RA_TYPE=dcap && \
77+
rm -f /app/trusted-compute-MVP/keys/enclave-key.pem
78+
79+
COPY restart_aesm.sh /restart_aesm.sh
80+
81+
# Expose the server port
82+
EXPOSE 8080
83+
ENV HOST=127.0.0.1
84+
ENV PORT=8080
85+
86+
# Add socat for port forwarding
87+
RUN apt-get update && \
88+
DEBIAN_FRONTEND=noninteractive apt-get install -y socat && \
89+
apt-get clean && \
90+
rm -rf /var/lib/apt/lists/*
91+
92+
# Create a startup script to handle port forwarding
93+
RUN echo '#!/bin/bash\n\
94+
/restart_aesm.sh\n\
95+
socat TCP-LISTEN:8081,fork TCP:127.0.0.1:8080 & \n\
96+
gramine-sgx sgx-mvp\n'\
97+
> /start.sh && chmod +x /start.sh
98+
99+
ENTRYPOINT ["/bin/sh", "-c"]
100+
CMD ["/start.sh"]

‎sgx-mvp/docker/build.sh

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
usage() {
5+
echo "Usage: build.sh [ubuntu20,ubuntu22]"
6+
exit 1
7+
}
8+
9+
if [ $# -ne 1 ]; then
10+
usage
11+
fi
12+
13+
image=""
14+
codename=""
15+
key_path="../keys/enclave-key.pem"
16+
17+
case "$1" in
18+
ubuntu20)
19+
image="ubuntu:20.04"
20+
codename="focal"
21+
;;
22+
ubuntu22)
23+
image="ubuntu:22.04"
24+
codename="jammy"
25+
;;
26+
*)
27+
usage
28+
;;
29+
esac
30+
31+
# Check if key exists
32+
if [ ! -f "$key_path" ]; then
33+
echo "No signing key found at $key_path"
34+
echo "For development:"
35+
echo " gramine-sgx-gen-private-key /keys/enclave-key.pem"
36+
echo "For production:"
37+
echo " Please use your production signing key"
38+
exit 1
39+
fi
40+
41+
# Build the image, mounting the key at build time
42+
docker build \
43+
--build-arg UBUNTU_IMAGE="${image}" \
44+
--build-arg UBUNTU_CODENAME="${codename}" \
45+
--secret id=enclave_key,src="$key_path" \
46+
-t sgx-mvp:stable-"${codename}" \
47+
.
48+
49+
echo "Build complete!"

‎sgx-mvp/docker/restart_aesm.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
killall -q aesm_service || true
6+
7+
AESM_PATH=/opt/intel/sgx-aesm-service/aesm LD_LIBRARY_PATH=/opt/intel/sgx-aesm-service/aesm exec /opt/intel/sgx-aesm-service/aesm/aesm_service --no-syslog

‎sgx-mvp/keys/.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Ignore all files in this directory
2+
*
3+
# Except this file
4+
!.gitignore
5+
!README.md

‎sgx-mvp/keys/README.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# SGX Signing Keys
2+
3+
This directory contains the SGX enclave signing key used during the build process.
4+
5+
## Development Setup
6+
7+
To generate a development key:
8+
9+
```bash
10+
cd sgx-mvp
11+
gramine-sgx-gen-private-key keys/enclave-key.pem
12+
chmod 400 keys/enclave-key.pem
13+
```
14+
15+
## Production Usage
16+
17+
For production deployments:
18+
1. Use your organization's production signing key
19+
2. Store the key securely (never commit to version control)
20+
3. Use appropriate key management systems
21+
4. Consider using different keys per environment
22+
23+
## Security Notes
24+
25+
- Keys should have restricted permissions (chmod 400)
26+
- Development keys should be generated locally
27+
- Production keys should be managed through secure key management

0 commit comments

Comments
 (0)