@ethernity-cloud/sdk-js 1.1.0 → 1.2.0

package/build.js

@@ -1,7 +1,36 @@
 const { execSync } = require('child_process');
+const fs = require('fs');
 const path = require('path');
 require('dotenv').config();
 
+// Increment VERSION on every build, mirroring the Python SDK's build.py
+// (config VERSION += 1). VERSION is the immutable per-build registry channel and
+// the enclave-name suffix, so each build must advance it. Existing projects seed
+// VERSION as "v1"; parse whatever trailing integer is present (v1 -> 1, 22 -> 22,
+// empty -> 0), increment, and persist as a plain integer. It must never equal
+// "v3" (the protocol channel that acts as the moving "latest" pointer); plain
+// integers can't collide with the "v3" string, so this is safe.
+const writeEnv = (key, value) => {
+    const envFile = '.env';
+    let content = fs.existsSync(envFile) ? fs.readFileSync(envFile, 'utf8') : '';
+    const regex = new RegExp(`^${key}=.*`, 'm');
+    if (regex.test(content)) content = content.replace(regex, `${key}=${value}`);
+    else content += (content && !content.endsWith('\n') ? '\n' : '') + `${key}=${value}`;
+    fs.writeFileSync(envFile, content, 'utf8');
+};
+
+const bumpVersion = () => {
+    const raw = (process.env.VERSION || '0').toString();
+    const digits = raw.match(/\d+/);
+    const next = (digits ? parseInt(digits[0], 10) : 0) + 1;
+    process.env.VERSION = String(next);
+    writeEnv('VERSION', String(next));
+    console.log(`Version incremented to ${next}`);
+    return next;
+};
+
+bumpVersion();
+
 const serviceType = process.env.SERVICE_TYPE;
 
 if (serviceType === "Nodenithy") {

package/init.js

@@ -129,6 +129,9 @@ const main = async () => {
     "Bloxberg Testnet",
     "Polygon Mainnet",
     "Polygon Amoy Testnet",
+    "IoTeX Testnet",
+    "Ethereum Sepolia",
+    "LitVM LiteForge",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -201,7 +204,7 @@ const main = async () => {
       ),
     );
   } else {
-    customUrl = "http://ipfs.ethernity.cloud:5001";
+    customUrl = "https://ipfs.ethernity.cloud";
   }
 
   fs.mkdirSync("src/serverless", { recursive: true });
@@ -277,14 +280,24 @@ const main = async () => {
   }
   // write TRUSTED_ZONE_IMAGE {token}_{name}{networktype} with the following rules:
   // - token should be ecld if network is polygon, etny if network is bloxberg
-  // - name should be serviceType.toLowerCase()
-  // - networktype should be "" if network contains 'mainnet' else '_testnet'
-  writeEnv(
-    "TRUSTED_ZONE_IMAGE",
-    `${blockchainNetwork.includes("Polygon") ? "ecld" : "etny"
-    }-${serviceType.toLowerCase()}${blockchainNetwork.includes("Mainnet") ? "" : "-testnet"
-    }`,
-  );
+  // TRUSTED_ZONE_IMAGE = <prefix>-<service>-<suffix>, matching image_name in
+  // etny-{pynithy,nodenithy}/v3/networks.yaml. The old code derived this from
+  // "Polygon?ecld:etny" + "Mainnet?'':'-testnet'", which only worked for
+  // bloxberg/polygon and produced wrong names for iotex/sepolia/litvm (all use
+  // the ecld prefix and network-specific suffixes). Use an explicit per-network
+  // map instead.
+  const svc = serviceType.toLowerCase();
+  const imageByNetwork = {
+    "Bloxberg Mainnet": `etny-${svc}`,
+    "Bloxberg Testnet": `etny-${svc}-testnet`,
+    "Polygon Mainnet": `ecld-${svc}`,
+    "Polygon Amoy Testnet": `ecld-${svc}-amoy`,
+    "IoTeX Testnet": `ecld-${svc}-iotex-testnet`,
+    "Ethereum Sepolia": `ecld-${svc}-ethereum-sepolia`,
+    "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
+  };
+  const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
+  writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);
 
 
   writeEnv("BLOCKCHAIN_NETWORK", blockchainNetwork.replace(/ /g, "_"));

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -6,7 +6,6 @@ RUN cd /
 
 RUN apk add bash
 
-ENV SCONE_MODE=SIM
 ENV SCONE_HEAP=256M
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
@@ -50,14 +49,31 @@ RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
-
-ENV SCONE_LOG=info
+# SCONE runtime env. These MUST match the enclave-creation params passed to
+# scone-signer below (SCONE embeds defaults for anything not signed explicitly;
+# any drift makes SCONE recompute + debug re-sign the enclave at load, which CAS
+# rejects on mainnet). Values mirror the publish/run docker-compose securelock
+# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
 ENV SCONE_HEAP=1024M
+ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
 
-# Enable production mode for mainnet
-# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/bin/node
+# Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
+# ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
+# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
+# self-sign). On testnet builds this line is a no-op comment.
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing. A mismatch means SCONE recomputed the enclave at load (params
+# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
+# for --production (mainnet) signs; on testnet the file is absent and the check
+# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# with SIGPIPE (exit 141) under buildkit's pipefail shell.
+__SIGNED_MRENCLAVE__
+
 RUN rm -rf /enclave-key.pem
 
 #RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer

package/nodenithy/build.js

@@ -94,6 +94,12 @@ if (process.env.BLOCKCHAIN_NETWORK === 'Bloxberg_Testnet') {
   // image_name in etny-nodenithy v3/networks.yaml (amoy) is ecld-nodenithy-amoy,
   // NOT ecld-nodenithy-testnet -- must match or the registry pull 404s.
   templateName = 'ecld-nodenithy-amoy'; trustedZoneNet = 'amoy';
+} else if (process.env.BLOCKCHAIN_NETWORK === 'IoTeX_Testnet') {
+  templateName = 'ecld-nodenithy-iotex-testnet'; trustedZoneNet = 'iotex_testnet';
+} else if (process.env.BLOCKCHAIN_NETWORK === 'Ethereum_Sepolia') {
+  templateName = 'ecld-nodenithy-ethereum-sepolia'; trustedZoneNet = 'ethereum_sepolia';
+} else if (process.env.BLOCKCHAIN_NETWORK === 'LitVM_LiteForge') {
+  templateName = 'ecld-nodenithy-litvm-testnet'; trustedZoneNet = 'litvm_liteforge';
 } else {
   templateName = 'etny-nodenithy-testnet'; trustedZoneNet = 'bloxberg_testnet';
 }

package/nodenithy/build.mjs

@@ -26,14 +26,30 @@ const writeEnv = (key, value) => {
   fs.writeFileSync(envFile, envContent, 'utf8');
 };
 // runner name: [smart contract address, image registry address, rpc url, chainid]
+// [templateName]: [smart_contract_address, image_registry_address, rpc_url, chain_id]
+// Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml (the authoritative
+// on-chain constants). Covers all supported networks for both dApp types.
 export const ECRunner = {
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'ecld-nodenithy-testnet': ['0x4274b1188ABCfa0d864aFdeD86bF9545B020dCDf', '0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049', 'https://rpc-mumbai.matic.today', 80001],
-  'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-rpc.com', 137],
-  'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-rpc.com', 137]
+  // --- bloxberg ---
+  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  // --- polygon mainnet ---
+  'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
+  'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
+  // --- polygon amoy testnet (replaces deprecated mumbai) ---
+  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- iotex testnet ---
+  'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
+  'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
+  // --- ethereum sepolia ---
+  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
+  'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 const runCommand = (command, canPass = false) => {
@@ -106,17 +122,54 @@ console.log('Building etny-securelock');
 process.chdir('securelock');
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-const dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
-
-fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
+
+// Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
+// run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
+const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
+
+// CRITICAL (mainnet DCAP): sign /usr/local/bin/node -- the binary the enclave
+// actually EXECUTES (ENTRYPOINT + the run/publish compose command both run
+// /usr/local/bin/node). Signing anything else leaves the executed binary as the
+// base image's DEBUG-signed one, so at load SCONE recomputes MRENCLAVE and
+// re-signs it as debug -> CAS rejects the DCAP quote ("Debug mode enabled").
+//
+// The enclave-creation params (--heap/--stack/--dlopen/--extensions) MUST be
+// passed explicitly and match the runtime env exactly (scone-signer embeds SCONE
+// defaults for anything not passed as a flag) -- any drift triggers the same
+// debug re-sign. Values mirror the run/docker-compose securelock service.
+const signFlags =
+  `--key=/enclave-key.pem --env --heap=${MEMORY_TO_ALLOCATE} ` +
+  `--stack=4M --dlopen=1 --extensions=/lib/libbinary-fs.so`;
+
+// scone-signer prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+// runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+// to a file first -- piping into head/grep kills scone-signer with SIGPIPE
+// (exit 141) under buildkit's pipefail shell.
+const signedMrenclaveStep =
+  'RUN scone-signer info /usr/local/bin/node > /tmp/siginfo.txt 2>&1; \\\n' +
+  '    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n \'1p\' \\\n' +
+  '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
+  '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 
 if (isMainnet) {
-  fs.writeFileSync('Dockerfile', dockerfileSecureContent.replace('# RUN scone-signer sign', 'RUN scone-signer sign'));
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase()
+  // Mainnet: production sign the executed node binary + bake the signed MRENCLAVE.
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
+    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
+  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+} else {
+  // Testnet: non-CAS self-sign path -- no --production sign and no signed
+  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
+    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
 }
 
+fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+