@ethernity-cloud/sdk-js 1.1.1 → 1.2.0

package/build.js

@@ -1,7 +1,36 @@
 const { execSync } = require('child_process');
+const fs = require('fs');
 const path = require('path');
 require('dotenv').config();
 
+// Increment VERSION on every build, mirroring the Python SDK's build.py
+// (config VERSION += 1). VERSION is the immutable per-build registry channel and
+// the enclave-name suffix, so each build must advance it. Existing projects seed
+// VERSION as "v1"; parse whatever trailing integer is present (v1 -> 1, 22 -> 22,
+// empty -> 0), increment, and persist as a plain integer. It must never equal
+// "v3" (the protocol channel that acts as the moving "latest" pointer); plain
+// integers can't collide with the "v3" string, so this is safe.
+const writeEnv = (key, value) => {
+    const envFile = '.env';
+    let content = fs.existsSync(envFile) ? fs.readFileSync(envFile, 'utf8') : '';
+    const regex = new RegExp(`^${key}=.*`, 'm');
+    if (regex.test(content)) content = content.replace(regex, `${key}=${value}`);
+    else content += (content && !content.endsWith('\n') ? '\n' : '') + `${key}=${value}`;
+    fs.writeFileSync(envFile, content, 'utf8');
+};
+
+const bumpVersion = () => {
+    const raw = (process.env.VERSION || '0').toString();
+    const digits = raw.match(/\d+/);
+    const next = (digits ? parseInt(digits[0], 10) : 0) + 1;
+    process.env.VERSION = String(next);
+    writeEnv('VERSION', String(next));
+    console.log(`Version incremented to ${next}`);
+    return next;
+};
+
+bumpVersion();
+
 const serviceType = process.env.SERVICE_TYPE;
 
 if (serviceType === "Nodenithy") {

package/init.js

@@ -204,7 +204,7 @@ const main = async () => {
       ),
     );
   } else {
-    customUrl = "http://ipfs.ethernity.cloud:5001";
+    customUrl = "https://ipfs.ethernity.cloud";
   }
 
   fs.mkdirSync("src/serverless", { recursive: true });

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -6,7 +6,6 @@ RUN cd /
 
 RUN apk add bash
 
-ENV SCONE_MODE=SIM
 ENV SCONE_HEAP=256M
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
@@ -50,14 +49,31 @@ RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
-
-ENV SCONE_LOG=info
+# SCONE runtime env. These MUST match the enclave-creation params passed to
+# scone-signer below (SCONE embeds defaults for anything not signed explicitly;
+# any drift makes SCONE recompute + debug re-sign the enclave at load, which CAS
+# rejects on mainnet). Values mirror the publish/run docker-compose securelock
+# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
 ENV SCONE_HEAP=1024M
+ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
 
-# Enable production mode for mainnet
-# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/bin/node
+# Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
+# ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
+# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
+# self-sign). On testnet builds this line is a no-op comment.
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing. A mismatch means SCONE recomputed the enclave at load (params
+# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
+# for --production (mainnet) signs; on testnet the file is absent and the check
+# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# with SIGPIPE (exit 141) under buildkit's pipefail shell.
+__SIGNED_MRENCLAVE__
+
 RUN rm -rf /enclave-key.pem
 
 #RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer

package/nodenithy/build.mjs

@@ -122,17 +122,54 @@ console.log('Building etny-securelock');
 process.chdir('securelock');
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-const dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
-
-fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
+
+// Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
+// run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
+const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
+
+// CRITICAL (mainnet DCAP): sign /usr/local/bin/node -- the binary the enclave
+// actually EXECUTES (ENTRYPOINT + the run/publish compose command both run
+// /usr/local/bin/node). Signing anything else leaves the executed binary as the
+// base image's DEBUG-signed one, so at load SCONE recomputes MRENCLAVE and
+// re-signs it as debug -> CAS rejects the DCAP quote ("Debug mode enabled").
+//
+// The enclave-creation params (--heap/--stack/--dlopen/--extensions) MUST be
+// passed explicitly and match the runtime env exactly (scone-signer embeds SCONE
+// defaults for anything not passed as a flag) -- any drift triggers the same
+// debug re-sign. Values mirror the run/docker-compose securelock service.
+const signFlags =
+  `--key=/enclave-key.pem --env --heap=${MEMORY_TO_ALLOCATE} ` +
+  `--stack=4M --dlopen=1 --extensions=/lib/libbinary-fs.so`;
+
+// scone-signer prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+// runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+// to a file first -- piping into head/grep kills scone-signer with SIGPIPE
+// (exit 141) under buildkit's pipefail shell.
+const signedMrenclaveStep =
+  'RUN scone-signer info /usr/local/bin/node > /tmp/siginfo.txt 2>&1; \\\n' +
+  '    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n \'1p\' \\\n' +
+  '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
+  '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 
 if (isMainnet) {
-  fs.writeFileSync('Dockerfile', dockerfileSecureContent.replace('# RUN scone-signer sign', 'RUN scone-signer sign'));
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase()
+  // Mainnet: production sign the executed node binary + bake the signed MRENCLAVE.
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
+    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
+  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+} else {
+  // Testnet: non-CAS self-sign path -- no --production sign and no signed
+  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
+    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
 }
 
+fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+