npm - @ethernity-cloud/sdk-js - Versions diffs - 1.1.0 → 1.2.0 - Mend

@ethernity-cloud/sdk-js 1.1.0 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/build.js +29 -0
package/init.js +22 -9
package/nodenithy/build/securelock/Dockerfile.tmpl +21 -5
package/nodenithy/build.js +6 -0
package/nodenithy/build.mjs +65 -12
package/nodenithy/ipfs.mjs +340 -426
package/nodenithy/run/docker-compose-final.yml.tmpl +3 -0
package/nodenithy/run/docker-compose.yml.tmpl +10 -8
package/nodenithy/run.js +44 -1
package/package.json +46 -46
package/pynithy/build/securelock/Dockerfile.tmpl +18 -2
package/pynithy/build.mjs +54 -12
package/pynithy/ipfs.mjs +376 -155
package/pynithy/run/docker-compose-final.yml.tmpl +9 -0
package/pynithy/run/docker-compose.yml.tmpl +10 -6
package/pynithy/run.js +40 -1

package/nodenithy/run/docker-compose-final.yml.tmpl CHANGED Viewed

@@ -28,6 +28,9 @@ services:
       - SCONE_LAS_ADDR=las
       - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
       - SCONE_HEAP=1024M
+      # Must match the --stack the securelock binary was signed with (build.mjs),
+      # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
+      - SCONE_STACK=4M
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so

package/nodenithy/run/docker-compose.yml.tmpl CHANGED Viewed

@@ -1,3 +1,10 @@
+# Publish-time compose: used by ecld-publish to compute the MRENCLAVE
+# (SCONE_HASH=1) and extract the enclave certificate LOCALLY. It intentionally
+# does NOT mount /dev/sgx_enclave so it runs on a developer machine WITHOUT SGX
+# (SCONE_HASH is a build measurement; enclaves reach SGX via LAS over TCP). When
+# no local SGX is present, cert extraction falls back to the remote
+# publickey.ethernity.cloud service. The on-node runtime uses
+# docker-compose-final.yml, which targets real SGX hardware.
 version: '3.2'
 services:
   las:
@@ -6,8 +13,6 @@ services:
     image: localhost:5000/etny-las
     entrypoint: "/las_entrypoint.sh"
     command: "/usr/local/bin/las"
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
     restart: on-failure
     ports:
       - target: 18766
@@ -26,12 +31,13 @@ services:
       - SCONE_LAS_ADDR=las
       - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
       - SCONE_HEAP=1024M
+      # Must match the --stack the securelock binary was signed with (build.mjs),
+      # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
+      - SCONE_STACK=4M
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure:5
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
     depends_on:
       - las
@@ -50,8 +56,6 @@ services:
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
     depends_on:
       - las
@@ -70,7 +74,5 @@ services:
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure:5
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
     depends_on:
       - las

package/nodenithy/run.js CHANGED Viewed

@@ -73,6 +73,30 @@ const runDockerCommand = (service) => {
     return output.split('\n').filter(line => !/Creating|Pulling|latest|Digest/.test(line)).join('');
 };
+// Extract the runtime enclave measurement (SCONE_HASH) as a bare 64-hex string.
+// Mirrors Python extract_scone_hash: the enclave prints its MRENCLAVE somewhere
+// in the SCONE_HASH=1 output; pick the first 64-hex token.
+const extractSconeHash = (service) => {
+    const output = runDockerCommand(service);
+    const m = output.match(/\b[a-fA-F0-9]{64}\b/);
+    if (!m) throw new Error(`No SHA256 MRENCLAVE found in ${service} SCONE_HASH output.`);
+    return m[0];
+};
+// Read the MRENCLAVE that was signed at build time (baked into the image as
+// /signed_mrenclave.txt by the securelock Dockerfile on mainnet). Mirrors Python
+// extract_signed_mrenclave. Returns '' if the file is absent (testnet builds).
+const extractSignedMrenclave = (service) => {
+    try {
+        const command = `docker-compose -f docker-compose.yml run --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
+        const output = execSync(command, { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
+        const m = output.match(/\b[a-fA-F0-9]{64}\b/);
+        return m ? m[0] : '';
+    } catch (e) {
+        return '';
+    }
+};
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
     const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
@@ -86,13 +110,32 @@ const main = async () => {
     });
-    process.env.MRENCLAVE_SECURELOCK = runDockerCommand('etny-securelock');
+    process.env.MRENCLAVE_SECURELOCK = extractSconeHash('etny-securelock');
     console.log(`MRENCLAVE_SECURELOCK: ${process.env.MRENCLAVE_SECURELOCK}`);
     // process.env.MRENCLAVE_TRUSTEDZONE = runDockerCommand('etny-trustedzone');
     // console.log(`MRENCLAVE_TRUSTEDZONE: ${process.env.MRENCLAVE_TRUSTEDZONE}`);
     // process.env.MRENCLAVE_VALIDATOR = runDockerCommand('etny-validator');
     // console.log(`MRENCLAVE_VALIDATOR: ${process.env.MRENCLAVE_VALIDATOR}`);
+    // ----- MRENCLAVE match-gate (mainnet) -----
+    // The runtime enclave measured just above (SCONE_HASH, with the same env the
+    // harvest uses) MUST match the MRENCLAVE that was signed --production at build
+    // time (baked into /signed_mrenclave.txt). A mismatch means SCONE recomputed
+    // the measurement at load because the runtime enclave-creation params drifted
+    // from the signed binary -- and a runtime recompute yields a DEBUG enclave
+    // that CAS rejects ("Debug mode is enabled"). Refuse to publish rather than
+    // register an untrusted identity on-chain or fail opaquely later.
+    if (isMainnet) {
+        const signedMrenclave = extractSignedMrenclave('etny-securelock');
+        if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
+            console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
+            console.error('       The runtime enclave differs from the --production-signed binary (SCONE recomputed -> debug).');
+            console.error('       Refusing to publish. Rebuild with the current SDK (ecld-build) and retry.');
+            process.exit(1);
+        }
+        console.log('\t✔  MRENCLAVE match-gate passed: runtime enclave matches the --production-signed MRENCLAVE');
+    }
     writeEnv('MRENCLAVE_SECURELOCK', process.env.MRENCLAVE_SECURELOCK);
     // writeEnv('MRENCLAVE_TRUSTEDZONE', process.env.MRENCLAVE_TRUSTEDZONE);
     // writeEnv('MRENCLAVE_VALIDATOR', process.env.MRENCLAVE_VALIDATOR);

package/package.json CHANGED Viewed

@@ -1,48 +1,48 @@
 {
-    "name": "@ethernity-cloud/sdk-js",
-    "version": "1.1.0",
-    "description": "A package to run ethernity cloud build scripts",
-    "scripts": {
-        "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
-        "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
-        "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
-        "ecld-run": "cross-env ecld-run",
-        "postinstall": "node postinstall.js"
-    },
-    "bin": {
-        "ecld-build": "./build.js",
-        "ecld-publish": "./publish.js",
-        "ecld-init": "./init.js",
-        "postinstall": "./postinstall.js"
-    },
-    "files": [
-        "nodenithy/*",
-        "pynithy/*",
-        "build.js",
-        "init.js",
-        "publish.js",
-        "postinstall.js"
-    ],
-    "dependencies": {
-        "@ethernity-cloud/runner": "^0.0.26",
-        "axios": "^1.7.2",
-        "commander": "^12.1.0",
-        "dotenv": "^16.4.5",
-        "eth-lib": "^0.1.29",
-        "ethers": "^5.5.4",
-        "kubo-rpc-client": "^4.1.1",
-        "web3": "^4.9.0",
-        "cross-env": "^7.0.3",
-        "shelljs": "^0.8.5",
-        "shx": "^0.3.4",
-        "node-forge": "^1.3.1",
-        "cli-progress": "^3.12.0",
-        "react": "^18.3.1",
-        "react-dom": "^18.3.1",
-        "react-scripts": "^5.0.1",
-        "web-vitals": "^2.1.4",
-        "adm-zip": "^0.5.14"
-    },
-    "author": "Alexandru Luca",
-    "license": "AGPL-3.0"
+  "name": "@ethernity-cloud/sdk-js",
+  "version": "1.2.0",
+  "description": "A package to run ethernity cloud build scripts",
+  "scripts": {
+    "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
+    "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
+    "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
+    "ecld-run": "cross-env ecld-run",
+    "postinstall": "node postinstall.js"
+  },
+  "bin": {
+    "ecld-build": "./build.js",
+    "ecld-publish": "./publish.js",
+    "ecld-init": "./init.js",
+    "postinstall": "./postinstall.js"
+  },
+  "files": [
+    "nodenithy/*",
+    "pynithy/*",
+    "build.js",
+    "init.js",
+    "publish.js",
+    "postinstall.js"
+  ],
+  "dependencies": {
+    "@ethernity-cloud/runner": "^0.0.26",
+    "axios": "^1.7.2",
+    "commander": "^12.1.0",
+    "dotenv": "^16.4.5",
+    "eth-lib": "^0.1.29",
+    "ethers": "^5.5.4",
+    "kubo-rpc-client": "^4.1.1",
+    "web3": "^4.9.0",
+    "cross-env": "^7.0.3",
+    "shelljs": "^0.8.5",
+    "shx": "^0.3.4",
+    "node-forge": "^1.3.1",
+    "cli-progress": "^3.12.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-scripts": "^5.0.1",
+    "web-vitals": "^2.1.4",
+    "adm-zip": "^0.5.14"
+  },
+  "author": "Alexandru Luca",
+  "license": "AGPL-3.0"
 }

package/pynithy/build/securelock/Dockerfile.tmpl CHANGED Viewed

@@ -64,13 +64,29 @@ COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
+# SCONE runtime env. Must match the enclave-creation params passed to
+# scone-signer below (any drift makes SCONE recompute + debug re-sign at load,
+# which CAS rejects on mainnet). Values mirror the run/docker-compose securelock
+# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
 ENV SCONE_LOG=INFO
 ENV SCONE_HEAP=1024M
+ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-# Disabled production mode for testnet
-# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/local/bin/python3
+# Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/python -- the
+# ENTRYPOINT and the run/publish compose command both run /usr/local/bin/python;
+# python3 is a SEPARATE symlink, signing it leaves the executed binary
+# debug-signed). Mainnet adds --production (CAS/DCAP); testnet omits it (non-CAS
+# self-sign). On testnet builds this line is a no-op comment.
+__SCONE_SIGN__
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
+# measurement matches what was signed before registering the CAS session. Only
+# produced for --production (mainnet); on testnet the file is absent and the
+# check is skipped. Capture to a file first (piping scone-signer into head/grep
+# kills it with SIGPIPE / exit 141 under buildkit's pipefail shell).
+__SIGNED_MRENCLAVE__
 RUN rm -rf /enclave-key.pem

package/pynithy/build.mjs CHANGED Viewed

@@ -26,14 +26,30 @@ const writeEnv = (key, value) => {
   fs.writeFileSync(envFile, envContent, 'utf8');
 };
 // runner name: [smart contract address, image registry address, rpc url, chainid]
+// [templateName]: [smart_contract_address, image_registry_address, rpc_url, chain_id]
+// Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml (the authoritative
+// on-chain constants). Covers all supported networks for both dApp types.
 export const ECRunner = {
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://core.bloxberg.org', 8995],
-  'ecld-nodenithy-testnet': ['0x4274b1188ABCfa0d864aFdeD86bF9545B020dCDf', '0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049', 'https://rpc-mumbai.matic.today', 80001],
-  'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-rpc.com', 137],
-  'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-rpc.com', 137]
+  // --- bloxberg ---
+  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  // --- polygon mainnet ---
+  'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
+  'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
+  // --- polygon amoy testnet (replaces deprecated mumbai) ---
+  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- iotex testnet ---
+  'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
+  'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
+  // --- ethereum sepolia ---
+  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
+  'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 const runCommand = (command, canPass = false) => {
@@ -106,17 +122,43 @@ console.log('Building etny-securelock');
 process.chdir('securelock');
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-const dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
-fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
+// Amount of enclave heap to allocate (SCONE_HEAP); overridable, in sync with the
+// run/docker-compose securelock service.
+const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
+// CRITICAL (mainnet DCAP): sign /usr/local/bin/python -- the binary the enclave
+// actually EXECUTES (ENTRYPOINT + run/publish compose command both run
+// /usr/local/bin/python). /usr/local/bin/python3 is a SEPARATE symlink; signing
+// it leaves the executed binary DEBUG-signed, so SCONE recomputes MRENCLAVE at
+// load and re-signs as debug -> CAS rejects the DCAP quote on mainnet.
+// The enclave-creation params MUST match the runtime env exactly.
+const signFlags =
+  `--key=/enclave-key.pem --env --heap=${MEMORY_TO_ALLOCATE} ` +
+  `--stack=4M --dlopen=1 --extensions=/lib/libbinary-fs.so`;
+const signedMrenclaveStep =
+  'RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \\\n' +
+  '    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n \'1p\' \\\n' +
+  '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
+  '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 if (isMainnet) {
-  fs.writeFileSync('Dockerfile', dockerfileSecureContent.replace('# RUN scone-signer sign', 'RUN scone-signer sign'));
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase()
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/python`)
+    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
+  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+} else {
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
+    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
 }
+fs.writeFileSync('Dockerfile', dockerfileSecureContent);