Skip to content

Commit b4d6597

Browse files
jot2rejot2re
committed
fix: merge conflict
2 parents cfacf44 + e70bf10 commit b4d6597

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+10240
-9800
lines changed

‎.github/workflows/common-nitro-enclave.yml‎

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -162,24 +162,14 @@ jobs:
162162
163163
- name: Create EIF file
164164
uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 #v3
165-
env:
166-
EIF_OUTPUT_DIR: ${{ env.EIF_OUTPUT_DIR }}
167-
DOCKER_SOCK_PATH: ${{ env.DOCKER_SOCK_PATH}}
168-
IMAGE_NAME: ${{ inputs.image-name }}
169-
DOCKER_TAG: ${{ needs.determine-tag.outputs.docker_tag }}
170-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
171165
with:
172166
image: amazonlinux@sha256:5fe11d17e56571a26e20df3fa1493bdf9139fb9f2cb6d84fad13104c7b869217 # 2023.5.20240916.0
173-
options: -v ${EIF_OUTPUT_DIR}:/output -v ${DOCKER_SOCK_PATH}:/var/run/docker.sock
167+
options: -v ${{ env.EIF_OUTPUT_DIR }}:/output -v ${{ env.DOCKER_SOCK_PATH}}:/var/run/docker.sock # zizmor: ignore[template-injection]
174168
run: |
175169
dnf install aws-nitro-enclaves-cli aws-nitro-enclaves-cli-devel docker -y
176-
177-
echo ${GITHUB_TOKEN} | docker login ghcr.io -u USERNAME --password-stdin
178-
179-
docker pull --platform=linux/amd64 ghcr.io/zama-ai/${IMAGE_NAME}:${DOCKER_TAG}
180-
181-
nitro-cli build-enclave --docker-uri ghcr.io/zama-ai/${IMAGE_NAME}:${DOCKER_TAG}} --name ${IMAGE_NAME} --output-file /output/enclave.eif
182-
170+
echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u USERNAME --password-stdin # zizmor: ignore[template-injection]
171+
docker pull --platform=linux/amd64 ghcr.io/zama-ai/${{ inputs.image-name }}:${{ needs.determine-tag.outputs.docker_tag }} # zizmor: ignore[template-injection]
172+
nitro-cli build-enclave --docker-uri ghcr.io/zama-ai/${{ inputs.image-name }}:${{ needs.determine-tag.outputs.docker_tag }} --name ${{ inputs.image-name }} --output-file /output/enclave.eif # zizmor: ignore[template-injection]
183173
nitro-cli describe-eif --eif-path /output/enclave.eif > /output/eif-info.txt
184174
185175

‎.github/workflows/common-testing-big-instance.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ on:
6868
required: true
6969
AWS_SECRET_KEY_S3_USER:
7070
required: true
71+
SLACK_CHANNEL:
72+
required: true
73+
BOT_USERNAME:
74+
required: true
75+
SLACK_WEBHOOK:
76+
required: true
7177

7278
env:
7379
CARGO_TERM_COLOR: always
@@ -102,6 +108,9 @@ jobs:
102108
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
103109
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
104110
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
111+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
112+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
113+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
105114
with:
106115
runs-on: ${{ needs.start-runner.outputs.label }}
107116
build-publish-docs: ${{ inputs.build-publish-docs }}

‎.github/workflows/common-testing.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ on:
6464
required: true
6565
AWS_SECRET_KEY_S3_USER:
6666
required: true
67+
SLACK_CHANNEL:
68+
required: true
69+
BOT_USERNAME:
70+
required: true
71+
SLACK_WEBHOOK:
72+
required: true
6773

6874
env:
6975
CARGO_TERM_COLOR: always
@@ -271,6 +277,7 @@ jobs:
271277

272278
# Test execution
273279
- name: Run Tests
280+
id: tests
274281
if: ${{ ! inputs.test-coverage || !contains(github.event.pull_request.labels.*.name, 'coverage') }}
275282
env:
276283
# some integration tests run docker compose
@@ -295,6 +302,30 @@ jobs:
295302
cat ~/.aws/config &&
296303
RUST_BACKTRACE=full cargo test ${ARGS_TESTS:+$ARGS_TESTS}
297304
305+
- name: Set Slack color
306+
id: slack_color
307+
env:
308+
JOB_RESULT: ${{ steps.tests.outcome }}
309+
run: |
310+
if [ "${JOB_RESULT}" = "success" ]; then
311+
echo "color=good" >> "$GITHUB_OUTPUT"
312+
else
313+
echo "color=danger" >> "$GITHUB_OUTPUT"
314+
fi
315+
316+
- name: Post nightly tests results in a channel
317+
if: always() && github.event_name == 'schedule'
318+
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
319+
env:
320+
ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
321+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
322+
SLACK_USERNAME: ${{ secrets.BOT_USERNAME }}
323+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
324+
SLACK_ICON_EMOJI: ":github-octocat:"
325+
SLACK_TITLE: "Nightly Tests Result"
326+
SLACK_COLOR: ${{ steps.slack_color.outputs.color }}
327+
SLACK_MESSAGE: "${{ steps.tests.outcome }} \nFor args: ${{ inputs.args-tests }}"
328+
298329
- name: Generate unique ID
299330
id: unique-id
300331
run: echo "id=$(date "+%s%N" | md5sum | head -c 8)" >> "$GITHUB_OUTPUT"

‎.github/workflows/global-common-workflow.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,9 @@ jobs:
169169
JOB_SECRET: ${{ secrets.JOB_SECRET }}
170170
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
171171
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
172+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
173+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
174+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
172175

173176
############################################################################
174177
# Core Client Pipeline
@@ -228,6 +231,9 @@ jobs:
228231
JOB_SECRET: ${{ secrets.JOB_SECRET }}
229232
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
230233
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
234+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
235+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
236+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
231237

232238
# Builds Docker image for core-client
233239
# Only runs on main/release branches after successful tests
@@ -281,6 +287,9 @@ jobs:
281287
JOB_SECRET: ${{ secrets.JOB_SECRET }}
282288
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
283289
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
290+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
291+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
292+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
284293

285294
############################################################################
286295
# Core Service Pipeline
@@ -359,6 +368,9 @@ jobs:
359368
JOB_SECRET: ${{ secrets.JOB_SECRET }}
360369
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
361370
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
371+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
372+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
373+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
362374

363375
# Builds the core service Docker image
364376
# Only runs on main/release branches after successful tests
@@ -450,6 +462,9 @@ jobs:
450462
JOB_SECRET: ${{ secrets.JOB_SECRET }}
451463
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
452464
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
465+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
466+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
467+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
453468

454469
# Runs extended threshold tests on main/release branches
455470
# Includes Redis integration and all test suites
@@ -472,6 +487,9 @@ jobs:
472487
JOB_SECRET: ${{ secrets.JOB_SECRET }}
473488
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
474489
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
490+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
491+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
492+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
475493

476494
# Simplified build process for Dependabot PRs
477495
# Only runs library tests without integration components
@@ -490,6 +508,9 @@ jobs:
490508
BLOCKCHAIN_ACTIONS_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
491509
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
492510
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
511+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
512+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
513+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
493514

494515

495516
############################################################################

‎.github/workflows/npm-release.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,6 @@ jobs:
2929
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
3030
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
3131
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
32+
SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }}
33+
BOT_USERNAME: ${{ secrets.BOT_USERNAME }}
34+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

‎charts/kms-core/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: kms-service
22
description: A helm chart to distribute and deploy the Zama KMS application stack
3-
version: 1.0.5
3+
version: 1.0.7
44
apiVersion: v2
55
keywords:
66
- kms-service

‎charts/kms-core/templates/kms-gen-keys-configmap.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,6 @@ data:
8686
echo "kmsGenKey.forceRecreate is enabled, deleting existing configmap"
8787
kubectl delete configmap "$CONFIGMAP_NAME"
8888
{{- end }}
89-
if [ ! -z "$(cat /keygen/key_id)" ]; then
90-
echo "Key ID found, skipping configmap creation"
91-
exit 0
92-
fi
9389
echo "creating kubernetes configmap: $CONFIGMAP_NAME"
9490
kubectl create configmap "$CONFIGMAP_NAME" \
9591
--from-literal=KMS_BUCKET_URL="$(cat /keygen/bucket_url)" \

‎charts/kms-core/templates/kms-gen-keys-job.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,11 @@ spec:
3535
- name: S3_ENDPOINT
3636
value: "http://minio:9000/{{ .Values.kmsCore.publicVault.s3.bucket }}/{{ .Values.kmsCore.publicVault.s3.path }}"
3737
{{- else }}
38-
- name: S3_ENDPOINT
39-
value: "https://{{ .Values.kmsCore.publicVault.s3.bucket }}.s3.{{ .Values.kmsCore.aws.region }}.amazonaws.com{{ if .Values.kmsCore.publicVault.s3.path }}/{{ .Values.kmsCore.publicVault.s3.path }}{{ end }}"
38+
- name: CORE_CLIENT__S3_ENDPOINT
39+
valueFrom:
40+
configMapKeyRef:
41+
name: {{ .Values.kmsCore.envFrom.configmap.name }}
42+
key: {{ .Values.kmsCore.envFrom.configmap.key.coreClientS3Endpoint }}
4043
{{- end }}
4144
- name: OBJECT_FOLDER
4245
{{- if .Values.kmsCore.thresholdMode.peersList }}

‎core-client/src/lib.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ use kms_grpc::kms::v1::{
1717
use kms_grpc::kms_service::v1::core_service_endpoint_client::CoreServiceEndpointClient;
1818
use kms_grpc::rpc_types::{protobuf_to_alloy_domain, InternalCustodianRecoveryOutput, PubDataType};
1919
use kms_grpc::{KeyId, RequestId};
20-
use kms_lib::client::{Client, ParsedUserDecryptionRequest};
20+
use kms_lib::client::{client_wasm::Client, user_decryption_wasm::ParsedUserDecryptionRequest};
2121
use kms_lib::consts::{DEFAULT_PARAM, SIGNING_KEY_ID, TEST_PARAM};
2222
use kms_lib::engine::base::{compute_external_pubdata_message_hash, compute_pt_message_hash};
2323
use kms_lib::util::file_handling::{read_element, write_element};
@@ -954,7 +954,7 @@ fn check_external_decryption_signature(
954954
for response in responses {
955955
let payload = response.payload.as_ref().unwrap();
956956
check_ext_pt_signature(
957-
response.external_signature(),
957+
&response.external_signature,
958958
&payload.plaintexts,
959959
external_handles.to_owned(),
960960
domain.clone(),

‎core/grpc/proto/kms-service-insecure.v1.proto‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -3,77 +3,51 @@ package kms_service.v1;
33

44
import "kms.v1.proto";
55

6+
// WARNING: This service is insecure and should not be used in production.
7+
//
8+
// Since this is the insecure endpoint, we do not duplicate
9+
// the documentation. Please see the documentation of the secure endpoint.
10+
// All insecure RPCs (i.e., the ones that have `Insecure` in the prefix)
11+
// have the same semantics as the secure ones.
612
service CoreServiceEndpoint {
7-
// Perform the threshold KMS initialization.
8-
// This call returns an error on the centralized KMS.
913
rpc Init(kms.v1.InitRequest) returns (kms.v1.Empty);
1014

11-
// Start generating preprocessing materials for key generation asynchronously.
12-
// This call returns an error on the centralized KMS.
1315
rpc KeyGenPreproc(kms.v1.KeyGenPreprocRequest) returns (kms.v1.Empty);
1416

15-
// This call returns an error on the centralized KMS.
1617
rpc GetKeyGenPreprocResult(kms.v1.RequestId) returns (kms.v1.KeyGenPreprocResult);
1718

18-
// Generate new keys asynchronously.
1919
rpc KeyGen(kms.v1.KeyGenRequest) returns (kms.v1.Empty);
2020

21-
// Return a URI where they can be accessed.
22-
// The keys at the URI contains signature and authentication information.
23-
// NOTE: Unprivileged and insecure call
2421
rpc GetKeyGenResult(kms.v1.RequestId) returns (kms.v1.KeyGenResult);
2522

26-
// Generate new keys asynchronously.
2723
rpc InsecureKeyGen(kms.v1.KeyGenRequest) returns (kms.v1.Empty);
2824

29-
// Return a URI where they can be accessed.
30-
// The keys at the URI contains signature and authentication information.
31-
// NOTE: Unprivileged and insecure call
3225
rpc GetInsecureKeyGenResult(kms.v1.RequestId) returns (kms.v1.KeyGenResult);
3326

34-
// Perform public decryption of a ciphertext and return the signed plaintext.
3527
rpc PublicDecrypt(kms.v1.PublicDecryptionRequest) returns (kms.v1.Empty);
3628

37-
// Get the public decryption result.
38-
// This query fails if the result is not available yet.
3929
rpc GetPublicDecryptionResult(kms.v1.RequestId) returns (kms.v1.PublicDecryptionResponse);
4030

41-
// Perform user decryption of a ciphertext under a user-specified key and return a signcrypted
42-
// share of the decrypted plaintext.
4331
rpc UserDecrypt(kms.v1.UserDecryptionRequest) returns (kms.v1.Empty);
4432

45-
// Get the user decryption result.
46-
// This query fails if the result is not available yet.
4733
rpc GetUserDecryptionResult(kms.v1.RequestId) returns (kms.v1.UserDecryptionResponse);
4834

49-
// Start the CRS generation protocol asynchronously.
5035
rpc CrsGen(kms.v1.CrsGenRequest) returns (kms.v1.Empty);
5136

52-
// Get a reference to the CRS.
53-
// This query fails if the result is not available yet.
5437
rpc GetCrsGenResult(kms.v1.RequestId) returns (kms.v1.CrsGenResult);
5538

56-
// Start the insecure CRS generation protocol asynchronously.
5739
rpc InsecureCrsGen(kms.v1.CrsGenRequest) returns (kms.v1.Empty);
5840

59-
// Get a reference to the insecure CRS.
60-
// This query fails if the result is not available yet.
6141
rpc GetInsecureCrsGenResult(kms.v1.RequestId) returns (kms.v1.CrsGenResult);
6242

63-
// Create a new KMS context, it may be created without an existing one.
6443
rpc NewKmsContext(kms.v1.NewKmsContextRequest) returns (kms.v1.Empty);
6544

66-
// Destroy an existing KMS context.
6745
rpc DestroyKmsContext(kms.v1.DestroyKmsContextRequest) returns (kms.v1.Empty);
6846

69-
// Create a new custodian context, it may be created without an existing one.
7047
rpc NewCustodianContext(kms.v1.NewCustodianContextRequest) returns (kms.v1.Empty);
7148

72-
// Destroy an existing custodian context.
7349
rpc DestroyCustodianContext(kms.v1.DestroyCustodianContextRequest) returns (kms.v1.Empty);
7450

75-
// Get the public key that a custodian can use to encrypt a backup share
76-
// before sending it to the KMS.
7751
rpc GetOperatorPublicKey(kms.v1.Empty) returns (kms.v1.OperatorPublicKey);
7852

7953
// Restore the contents of the KMS private storage from the backup vault.

0 commit comments

Comments
 (0)