@ethernity-cloud/sdk-js 1.1.0

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -0,0 +1,421 @@
+require('dotenv').config();
+require('dotenv').config({path: './app/.env'});
+require('dotenv').config({path: '/app/.env'});
+
+const ethers = require('ethers');
+const fs = require("fs");
+const etny_crypto = require("./etny_crypto");
+const {DOReqMetadata, Order} = require("./models");
+const {getWalletAddress} = require("./wallet");
+const {executeTask} = require("./etny_exec");
+const {TaskStatus} = require("./task_status");
+const SwiftStreamService = require("./swift_stream_service");
+
+const contract_abi = require('./pox_abi');
+const image_registry_abi = require('./image_registry_abi');
+const {sha256} = require("./etny_crypto");
+
+class EtnySecureLock {
+    static debug = false;
+
+    constructor(swiftStreamClient) {
+        console.log('Initializing...');
+        this.version = 'v3';
+        this.swiftStreamService = swiftStreamClient;
+        this.etny_bucket = "__BUCKET_NAME__";
+        this.setInitializers();
+    }
+
+    setInitializers() {
+        this.is_valid_client_data = true;
+        this.key_file = "/private/__ENCLAVE_NAME_SECURELOCK__/key.pem";
+        this.cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/cert.pem";
+        this.pub_cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/enclave_pub_cert.pem";
+        this.payload = "payload.etny.securelock";
+        this.input = "input.txt.securelock";
+        this.result_file = "/app/result.txt";
+        this.transaction_file = "/app/transaction.txt";
+        this.smart_contract_address = "__SMART_CONTRACT_ADDRESS__";
+        this.image_registry_address = '__IMAGE_REGISTRY_ADDRESS__';
+        this.chain_id = __CHAIN_ID__;
+        this.web3_provider = "__RPC_URL__";
+        this.signed_tx_as_bytes = null;
+        this.client_challenge = "";
+
+        if (this.etny_mode === "TEST") {
+            this.key_file = "/private/key.pem";
+            this.cert_file = "/app/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+
+        if (this.etny_mode === "LOCAL_TEST") {
+            this.key_file = "./certs/key.pem";
+            this.cert_file = "./certs/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+    }
+
+    async create() {
+        //overriding default values with those read from .env file
+        this.loadEnv();
+        this.printEnv();
+        await this.savePublicCert();
+        this.initWeb3();
+        if (this.etny_mode === "PRODUCTION") {
+            this.resetPrivateCertFile();
+        }
+
+        return true;
+    }
+
+    loadEnv() {
+        if (process.env.ETNY_CHAIN_ID) {
+            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
+        }
+
+        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
+            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
+        }
+
+        if (process.env.ETNY_WEB3_PROVIDER) {
+            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
+        }
+
+        if (process.env.ETNY_CLIENT_CHALLENGE) {
+            this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
+        }
+        if (process.env.ETNY_ORDER_ID) {
+            this.order_id = parseInt(process.env.ETNY_ORDER_ID);
+        }
+    }
+
+    printEnv() {
+        console.log('CHAIN ID:', this.chain_id);
+        console.log('SMART CONTRACT ADDRESS:', this.smart_contract_address);
+        console.log('WEB3 PROVIDER:', this.web3_provider);
+        console.log('ENCRYPTED CHALLENGE:', this.client_challenge);
+        console.log('ORDER ID:', this.order_id);
+    }
+
+    initWeb3() {
+        // Create an ethers.js provider connected to the Bloxberg network
+        this.w3 = new ethers.providers.JsonRpcProvider(this.web3_provider);
+        // Create an instance of the contract using the ABI and address
+        this.etny = new ethers.Contract(this.smart_contract_address, contract_abi, this.w3);
+        this.image_registry = new ethers.Contract(this.image_registry_address, image_registry_abi, this.w3);
+        // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
+    }
+
+    async readEnv() {
+        try {
+            console.log('Getting .env if exists...');
+            const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
+            console.log("Env:", envFile);
+            console.log("Saving .env file...");
+            await fs.promises.writeFile('.env', envFile);
+            require('dotenv').config();
+
+            this.version = 'v3';
+            this.etny_mode = process.env.ETNY_MODE;
+            console.log(`ETNY Nodenithy [${this.version}] - running in ${this.etny_mode} MODE`);
+            //console.log(process.env);
+
+            return true;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    extractSigner(message, signature) {
+        try {
+            return ethers.utils.verifyMessage(message, signature);
+        } catch (e) {
+            console.log('extractSigner:', e)
+        }
+    }
+
+    async validateClientPayload(payload_data, input_data) {
+        await this.getDORequestMetadata();
+        if (this._metadata.payload_metadata_obj.checksum !== null) {
+            try {
+                const payload_checksum = sha256(payload_data);
+                //console.log('payload checksum: ', payload_checksum, "===", this._metadata.payload_metadata_obj.checksum);
+                // check the wallet address that signed payload checksum is the one from order metadata
+                const payload_signer = this.extractSigner(payload_checksum, this._metadata.payload_metadata_obj.checksum);
+                //console.log("payload_signer", payload_signer);
+                //console.log("this._order_metadata.do_owner.toLowerCase()", this._order_metadata.do_owner.toLowerCase());
+                if (payload_signer.toLowerCase() !== this._order_metadata.do_owner.toLowerCase()) {
+                    this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+                    this.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH';
+                    this.is_valid_client_data = false;
+                    return;
+                }
+            } catch (e) {
+                console.log(e);
+            }
+
+        }
+        if (this._metadata.input_metadata_obj.checksum !== null) {
+            try {
+                const input_checksum = sha256(input_data);
+                //console.log('input checksum: ', input_checksum, '===', this._metadata.input_metadata_obj.checksum);
+                // check the wallet address that signed input checksum is the one from order metadata
+                const input_signer = this.extractSigner(input_checksum, this._metadata.input_metadata_obj.checksum);
+                //console.log("input_signer", input_signer);
+                //console.log("this._order_metadata.do_owner.toLowerCase()", this._order_metadata.do_owner.toLowerCase());
+                if (input_signer.toLowerCase() !== this._order_metadata.do_owner.toLowerCase()) {
+                    this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+                    this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
+                    this.is_valid_client_data = false;
+                }
+            } catch (e) {
+                console.log(e);
+            }
+        }
+    }
+
+    wait(timeout) {
+        return new Promise(resolve => {
+            setTimeout(resolve, timeout);
+        });
+    }
+
+    async waitForObjectInBucket(bucketName, objectName, timeout = 600) {
+        let i = 0;
+        console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+        while (true) {
+            await this.wait(1000);
+            i++;
+            if (i % 20 === 0)
+                console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+            if (i > timeout) {
+                break;
+            }
+            const [status, result] = await this.swiftStreamService.isObjectInBucket(bucketName, objectName);
+            if (result) {
+                break;
+            }
+        }
+
+        console.log('TrustedZone finished the execution');
+    }
+
+    async waitForPayloadAndInput() {
+        console.log('Waiting for payload and input');
+        await this.waitForObjectInBucket(this.etny_bucket, this.payload);
+        await this.waitForObjectInBucket(this.etny_bucket, this.input);
+    }
+
+    async getFileContentAndDecrypt(bucketName, objectName) {
+        try {
+            const encryptedBase64 = await this.swiftStreamService.getFileContent(bucketName, objectName);
+
+            const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
+            const decryptedResult = etny_crypto.decrypt(this.key_file, encryptedTuple);
+            return decryptedResult.toString();
+        } catch (e) {
+            console.log(`Failed to get ${objectName} file`);
+            return false;
+        }
+    }
+
+    async getTrustedZonePublicKey() {
+        try {
+            console.log('Getting the public key of the trusted zone enclave');
+            let imageHash = this._metadata.image_hash;
+            console.log('imageHash:', imageHash);
+            if (EtnySecureLock.debug) {
+                imageHash = 'v3-hash-1';
+            }
+            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
+            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
+        } catch (e) {
+            console.log('getTrustedZonePublicKey', e);
+        }
+    }
+
+    async getLatestTrustedZoneImageCertPublicKey() {
+        try {
+            console.log('Getting the public key of the trusted zone enclave');
+            this.trustedZonePublicKey = (await this.image_registry.getLatestTrustedZoneImageCertPublicKey("__TRUSTED_ZONE_IMAGE__", 'v3'))[1];
+            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
+        } catch (e) {
+            console.log('getLatestTrustedZoneImageCertPublicKey', e);
+        }
+    }
+
+    async encryptFileAndPushToSwiftStream(fileData, fileName) {
+        try {
+            console.log(`Started saving file ${fileName}.securelock...`);
+            const encryptedInput = etny_crypto.encrypt(this.trustedZonePublicKey, fileData);
+            const encryptedInputBase64 = etny_crypto.encryptedDataToBase64Json(encryptedInput);
+
+            // File name should end with the '.securelock' extension
+            fileName += '.securelock';
+            // const data = Buffer.from(encryptedInputBase64, 'utf8');
+            const status = this.swiftStreamService.putFileContent(this.etny_bucket, fileName, '', encryptedInputBase64);
+            if (status) {
+                console.log(`File ${fileName} encrypted and saved to swift stream successfully`);
+            }
+        } catch (e) {
+            console.log('encryptFileAndPushToSwiftStream', e);
+        }
+    }
+
+    async getDORequestMetadata() {
+        const o_result = await this.etny.functions._getOrder(this.order_id);
+        const order = new Order(o_result, this.order_id);
+        //console.log('order', order);
+        this._order_metadata = order;
+        const o_metadata = await this.etny.functions._getDORequestMetadata(order.do_req);
+        this._metadata = new DOReqMetadata(o_metadata, order.do_req);
+        //console.log('metadata', this._metadata);
+    }
+
+    resetPrivateCertFile() {
+        //console.log('Resetting the cert file');
+        try {
+            // const fd = fs.openSync(this.private_key_file, 'w+');
+            fs.truncate(this.key_file, 0, function () {
+                //console.log('Private certificate file was cleaned.')
+            });
+            // fs.closeSync(fd);
+        } catch (e) {
+            //console.log('Error while removing the private key file content', e);
+        }
+        const content = fs.readFileSync(this.key_file, 'utf8');
+        //console.log('cert file content', content, '##################');
+    }
+
+    async savePublicCert() {
+        try {
+            const content = await fs.promises.readFile(this.cert_file, 'utf8');
+            await fs.promises.writeFile(this.pub_cert_file, content);
+            //console.log(`Public certificate saved to ${this.pub_cert_file}`);
+            console.log(`PUBLIC_KEY:`);
+            console.log(content);
+
+            await this.swiftStreamService.putFileContent(this.etny_bucket, 'cert.pem', this.pub_cert_file);
+        } catch (err) {
+            console.error(err);
+        }
+    }
+
+    async saveResult() {
+        try {
+            await this.getLatestTrustedZoneImageCertPublicKey();
+            await this.encryptFileAndPushToSwiftStream(this.task_result, 'result.txt');
+            await this.encryptFileAndPushToSwiftStream(this.task_code.toString(), 'result_code.txt');
+
+            const encrypted = etny_crypto.encryptWithPublicKey(this._metadata.public_key, this.task_result);
+            //console.log('Encrypted result:', encrypted.toString('hex'));
+            const result = await this.swiftStreamService.putFileContent(this.etny_bucket, 'result.txt', this.result_file, encrypted.toString('hex'));
+            //console.log('Save result put: ', result);
+        } catch (e) {
+            console.log('Save result: ', e);
+        }
+    }
+
+    async execute() {
+        const payload_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload);
+        const input_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.input);
+        console.log('Validating client payload and input...');
+        await this.validateClientPayload(payload_data, input_data);
+
+        if (this.is_valid_client_data) {
+            console.log('Client payload and input are valid');
+        } else {
+            console.log('Client payload and input are NOT valid');
+            return false;
+        }
+
+        const task_result = executeTask(payload_data, input_data);
+        console.log('TASK RESULT (code, data):', task_result);
+        this.task_code = task_result[0];
+        this.task_result = task_result[1];
+
+        return true;
+    }
+
+}
+
+function initSwiftStreamClient() {
+    console.log('Initializing SwiftStream Service...');
+    const swiftStreamClient = new SwiftStreamService(
+        EtnySecureLock.debug ? "localhost" : "etny-swift-stream",
+        9000,
+        "swiftstreamadmin",
+        "swiftstreamadmin");
+    console.log('SwiftStream Service started.');
+    console.log('################################');
+
+    return swiftStreamClient;
+}
+
+async function execute() {
+    console.log('########################################');
+    console.log('########################################');
+    console.log('########## [ETNY SecureLock] ##########');
+    console.log('########################################');
+    console.log('########################################');
+    console.log('');
+    console.log('');
+    console.log('');
+
+    const swiftStreamClient = initSwiftStreamClient();
+
+    const app = new EtnySecureLock(swiftStreamClient);
+
+    const hasReadEnvFile = await app.readEnv();
+    if (!hasReadEnvFile && !EtnySecureLock.debug) {
+        console.log(`Failed reading .env file.`);
+        await app.savePublicCert();
+        return;
+    }
+
+    if (process.env.ETNY_MODE === "PUBLIC_KEY") {
+        await app.savePublicCert();
+    } else {
+        console.log('Creating the application...');
+        const created = await app.create();
+
+        if (!created) {
+            console.log(`Failed at creation step, not able decoding input metadata, exiting.`);
+            return;
+        }
+
+        console.log('Waiting for payload and input to be downloaded...');
+        await app.waitForPayloadAndInput();
+
+        if (app.is_valid_client_data) {
+            console.log('Executing client code...');
+            const wasExecuted = await app.execute();
+            if (!wasExecuted) {
+                console.log('Failed execution of SecureLock enclave.')
+                return;
+            }
+        } else {
+            console.log(`Failed client payload and input validation, ${app.task_result}, exiting.`);
+            return;
+        }
+
+        await app.saveResult();
+        console.log('Finished process.');
+    }
+}
+
+(async () => {
+    try {
+        await execute();
+    } catch (e) {
+        console.log(e);
+    }
+})();

package/nodenithy/build/securelock/src/swift_stream_service.js

@@ -0,0 +1,147 @@
+const Minio = require('minio');
+const fs = require("fs");
+class SwiftStreamService {
+    constructor(endpoint, port, accessKey, secretKey) {
+        this.client = new Minio.Client({
+            endPoint: endpoint,
+            port: port,
+            accessKey: accessKey,
+            secretKey: secretKey,
+            useSSL: false,
+        });
+    }
+
+    createBucket(bucketName) {
+        return new Promise((resolve, reject) => {
+            this.client.bucketExists(bucketName, (err, exists) => {
+                if (err) {
+                    return reject(err);
+                }
+
+                if (!exists) {
+                    this.client.makeBucket(bucketName, (err) => {
+                        if (err) {
+                            reject(err);
+                        } else {
+                            resolve(`Bucket ${bucketName} successfully created!`);
+                        }
+                    });
+                } else {
+                    resolve(`Bucket ${bucketName} already exists!`);
+                }
+            });
+        });
+    }
+
+    getFileContentBytes(bucketName, fileName) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            this.client.getObject(bucketName, fileName, (err, dataStream) => {
+                if (err) {
+                    return reject(err);
+                }
+
+                dataStream.on('data', (chunk) => {
+                    chunks.push(chunk);
+                });
+
+                dataStream.on('end', () => {
+                    const fileData = Buffer.concat(chunks);
+                    resolve(fileData);
+                });
+
+                dataStream.on('error', (err) => {
+                    reject(err);
+                });
+            });
+        });
+    }
+
+    getFileContent(bucketName, fileName) {
+        return this.getFileContentBytes(bucketName, fileName)
+            .then((fileData) => {
+                return fileData.toString('utf-8');
+            })
+            .catch((err) => {
+                throw err;
+            });
+    }
+
+    putFileContent(bucketName, objectName, objectPath, objectData = null) {
+        return new Promise((resolve, reject) => {
+            this.client.bucketExists(bucketName, (err, exists) => {
+                if (err) {
+                    return reject(err);
+                }
+
+                if (!exists) {
+                    this.createBucket(bucketName)
+                        .then(() => {
+                            if (objectData) {
+                                this.client.putObject(bucketName, objectName, objectData, (err) => {
+                                    if (err) {
+                                        reject(err);
+                                    } else {
+                                        resolve(`${objectName} is successfully uploaded to bucket ${bucketName}.`);
+                                    }
+                                });
+                            } else {
+                                const fileStat = fs.statSync(objectPath);
+                                const fileStream = fs.createReadStream(objectPath);
+
+                                this.client.putObject(bucketName, objectName, fileStream, fileStat.size, (err) => {
+                                    if (err) {
+                                        reject(err);
+                                    } else {
+                                        resolve(`${objectName} is successfully uploaded to bucket ${bucketName}.`);
+                                    }
+                                });
+                            }
+                        })
+                        .catch((err) => {
+                            reject(err);
+                        });
+                } else {
+                    if (objectData) {
+                        this.client.putObject(bucketName, objectName, objectData, (err) => {
+                            if (err) {
+                                reject(err);
+                            } else {
+                                resolve(`${objectName} is successfully uploaded to bucket ${bucketName}.`);
+                            }
+                        });
+                    } else {
+                        const fileStat = fs.statSync(objectPath);
+                        const fileStream = fs.createReadStream(objectPath);
+
+                        this.client.putObject(bucketName, objectName, fileStream, fileStat.size, (err) => {
+                            if (err) {
+                                reject(err);
+                            } else {
+                                resolve(`${objectName} is successfully uploaded to bucket ${bucketName}.`);
+                            }
+                        });
+                    }
+                }
+            });
+        });
+    }
+
+    isObjectInBucket(bucketName, objectName) {
+        return new Promise((resolve, reject) => {
+            this.client.statObject(bucketName, objectName, (err, stat) => {
+                if (err && err.code === 'NotFound') {
+                    resolve([stat, false]);
+                } else if (err) {
+                    reject(err);
+                } else {
+                    // resolve(`Object ${objectName} exists inside ${bucketName}.`);
+                    resolve([stat, true]);
+                }
+            });
+        });
+    }
+
+}
+
+module.exports = SwiftStreamService;

package/nodenithy/build/securelock/src/task_status.js

@@ -0,0 +1,15 @@
+class TaskStatus {
+    static SUCCESS = 0;
+    static SYSTEM_ERROR = 1;
+    static KEY_ERROR = 2;
+    static SYNTAX_WARNING = 3;
+    static BASE_EXCEPTION = 4;
+    static PAYLOAD_NOT_DEFINED = 5;
+    static PAYLOAD_CHECKSUM_ERROR = 6;
+    static INPUT_CHECKSUM_ERROR = 7;
+    static EVAL_ERROR = 8;
+}
+
+module.exports = {
+    TaskStatus,
+};

package/nodenithy/build/securelock/src/wallet.js

@@ -0,0 +1,29 @@
+const ethers = require('ethers');
+const {sha256} = require('./etny_crypto');
+
+function getWalletAddress(clientChallenge, enclaveChallenge) {
+    const encoded = clientChallenge + enclaveChallenge;
+    //console.log(encoded);
+    const walletPrivate = sha256(sha256(encoded));
+    //console.log(`0x${walletPrivate}`);
+
+    const wallet = new ethers.Wallet(walletPrivate);
+    //console.log(wallet);
+    console.log('Enclave wallet address:', wallet.address);
+    return [wallet.address, walletPrivate];
+}
+
+function generateWalletFromPrivate(hash) {
+    return new ethers.Wallet(hash);
+}
+
+// const firstString = 'test';
+// const secondString = 'test';
+// const [addr, private] = getWalletAddress(firstString, secondString);
+// console.log('account address =', addr); // 0xf63106856F7007A30025f0fFD5A534EA880878C3
+// console.log('private =', private);
+
+module.exports = {
+    getWalletAddress,
+    generateWalletFromPrivate
+}

package/nodenithy/build/squash/Dockerfile

@@ -0,0 +1,7 @@
+FROM etny-nodenithy:latest as initial
+
+FROM scratch
+
+COPY --from=initial / /
+
+ENTRYPOINT ["/usr/local/bin/node", "/etny_results.js"]

package/nodenithy/build/trustedzone/Dockerfile.tmpl

@@ -0,0 +1,57 @@
+FROM registry.scontain.com:5050/ethernity/node:16.13.1-alpine3.15-scone5.8-production as release
+
+RUN apk update
+
+RUN cd /
+
+RUN apk add bash
+
+ENV SCONE_MODE=SIM
+ENV SCONE_HEAP=256M
+ENV SCONE_LOG=DEBUG
+ENV ENCLAVE_NAME_TRUSTEDZONE=etny-nodenithy
+
+RUN mkdir binary-fs-dir
+
+COPY src/* /etny-trustedzone/
+COPY scripts/* /etny-trustedzone/
+
+WORKDIR /etny-trustedzone
+RUN pwd
+RUN npm install
+RUN ls
+
+WORKDIR /
+
+RUN ["chmod", "+x", "etny-trustedzone/binary-fs-build.sh"]
+RUN etny-trustedzone/binary-fs-build.sh
+
+FROM registry.scontain.com:5050/sconecuratedimages/crosscompilers as build
+
+COPY --from=release /binary-fs-dir /.
+
+RUN scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
+
+#
+FROM registry.scontain.com:5050/ethernity/node:16.13.1-alpine3.15-scone5.8-production
+
+COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
+#
+
+RUN apk update
+
+RUN apk add openssl
+
+RUN openssl genrsa -3 -out /enclave-key.pem 3072
+
+ENV SCONE_LOG=info
+ENV SCONE_HEAP=256M
+ENV SCONE_ALLOW_DLOPEN=1
+ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+
+# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/bin/node
+RUN rm -rf /enclave-key.pem
+
+#RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer
+RUN ls /usr/local/bin
+ENTRYPOINT ["/usr/local/bin/node", "/etny-trustedzone/trustedzone.js"]