@ethernity-cloud/sdk-js 1.1.1 → 1.4.0

package/nodenithy/build/securelock/src/self_sign.js

@@ -0,0 +1,76 @@
+// Testnet non-CAS self-sign: derive a DETERMINISTIC secp384r1 key + self-signed
+// X509 from the enclave's own MR_ENCLAVE / MR_SIGNER (read via the sgx_report
+// N-API addon). Only the exact attested enclave can regenerate this key, so the
+// harvested cert (registered on-chain) survives restarts and stays consistent.
+// [TESTNET-INSECURE] -- testnet runs pre-release SGX; NOT a production guarantee.
+//
+// Cert-compatibility note: nodenithy's trustedzone fetches the securelock public
+// key from the on-chain image registry (getImageCertPublicKey) and does NOT
+// re-derive it from MR_ENCLAVE. Both enclaves are Node. So this cert only needs
+// to be a valid P-384 X509 that is STABLE per MR_ENCLAVE and readable by
+// etny_crypto (jsrsasign KEYUTIL for the key, crypto.createPublicKey/ec-key for
+// the cert). It does NOT need to be byte-identical to pynithy's Python DER.
+const rs = require('jsrsasign');
+const sgx = require('./sgx_report');
+
+// The identity-key derivation lives ENTIRELY in the compiled addon
+// (get_sgx_report.c, via sgx_report.deriveIdentityScalar). It is not present in
+// this interpreted source, so reading self_sign.js reveals nothing about how
+// the key is derived. Each enclave uses its own role tag inside the addon, so
+// the derivations are mutually decoupled. role: 0=securelock 1=trustedzone
+// 2=validator, selected from the subject CN.
+function roleForSubject(subjectCN) {
+  const cn = String(subjectCN || '').toLowerCase();
+  if (cn.includes('securelock')) return 0;
+  if (cn.includes('validator')) return 2;
+  return 1;
+}
+
+/**
+ * Generate the deterministic self-signed cert for this enclave.
+ * @param {string} subjectCN e.g. "SecureLock Enclave" / "TrustedZone Enclave [TESTNET-INSECURE]"
+ * @returns {{privateKeyPem: string, certPem: string, mrEnclaveHex: string}}
+ */
+function generateCertFromMrEnclave(subjectCN) {
+  const mrEnclaveHex = sgx.getMrEnclave();  // 64 hex chars (32 bytes)
+
+  // Derivation performed inside the compiled addon; role from the subject CN.
+  const privHex = sgx.deriveIdentityScalar(roleForSubject(subjectCN));
+
+  // Build the EC keypair from the deterministic private scalar (jsrsasign).
+  const ecKeypair = rs.KEYUTIL.generateKeypair('EC', 'secp384r1');
+  const prvKey = new rs.KJUR.crypto.ECDSA({ curve: 'secp384r1' });
+  prvKey.setPrivateKeyHex(privHex);
+  prvKey.generatePublicKeyHex();  // derive pub from priv
+  void ecKeypair;
+
+  const pubKey = new rs.KJUR.crypto.ECDSA({ curve: 'secp384r1' });
+  pubKey.setPublicKeyHex(prvKey.pubKeyHex);
+
+  // Self-signed X509: fixed serial/validity so the cert is stable per key. No
+  // custom MR_ENCLAVE extension -- unlike pynithy (whose cert carries it as an
+  // informational OID), nothing in nodenithy reads it: the trustedzone uses the
+  // securelock public key fetched from the on-chain image registry, not the cert
+  // extensions. Keeping the cert minimal avoids jsrsasign generic-extension API
+  // fragility across versions. mrEnclaveHex is still returned for logging.
+  const cert = new rs.KJUR.asn1.x509.Certificate({
+    version: 3,
+    serial: { int: 31337 },
+    issuer: { str: '/CN=' + subjectCN },
+    subject: { str: '/CN=' + subjectCN },
+    notbefore: '250101000000Z',
+    notafter: '350101000000Z',
+    sbjpubkey: pubKey,
+    sigalg: 'SHA256withECDSA',
+    cakey: prvKey,
+  });
+
+  const certPem = cert.getPEM();
+
+  // Private key as PKCS8 PEM (etny_crypto reads it via rs.KEYUTIL.getKey().prvKeyHex).
+  const privateKeyPem = rs.KEYUTIL.getPEM(prvKey, 'PKCS8PRV');
+
+  return { privateKeyPem, certPem, mrEnclaveHex };
+}
+
+module.exports = { generateCertFromMrEnclave };

package/nodenithy/build/securelock/src/sgx_report.js

@@ -0,0 +1,50 @@
+// Loader for the SGX EREPORT N-API addon (sgx_report.node), which exposes the
+// enclave's own MR_ENCLAVE / MR_SIGNER (used to deterministically derive the
+// testnet self-signed cert). The addon is compiled from sgx_report_napi.c +
+// get_sgx_report.c at build time and baked into binary-fs (see the Dockerfile).
+const path = require('path');
+
+let addon = null;
+function load() {
+  if (addon) return addon;
+  // The addon sits next to the enclave sources in the image; try a couple of
+  // resolutions so it works in the enclave (/etny-securelock) and in local test.
+  const candidates = [
+    path.join(__dirname, 'sgx_report.node'),
+    '/etny-trustedzone/sgx_report.node',
+    './sgx_report.node',
+  ];
+  let lastErr;
+  for (const p of candidates) {
+    try {
+      addon = require(p);
+      return addon;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw new Error('Failed to load sgx_report.node addon: ' + (lastErr && lastErr.message));
+}
+
+function getMrEnclave() {
+  const v = load().getMrEnclave();
+  if (!v) throw new Error('get_mr_enclave() returned null (EREPORT failed)');
+  return v;
+}
+
+function getMrSigner() {
+  const v = load().getMrSigner();
+  if (!v) throw new Error('get_mr_signer() returned null (EREPORT failed)');
+  return v;
+}
+
+// Consolidated identity-key derivation, performed inside the compiled addon
+// (get_sgx_report.c). role: 0=securelock, 1=trustedzone, 2=validator.
+// Returns the 96-hex secp384r1 scalar. The algorithm is NOT in self_sign.js.
+function deriveIdentityScalar(role) {
+  const v = load().deriveIdentityScalar(role | 0);
+  if (!v) throw new Error('deriveIdentityScalar() returned null');
+  return v;
+}
+
+module.exports = { getMrEnclave, getMrSigner, deriveIdentityScalar };

package/nodenithy/build/securelock/src/task_status.js

@@ -8,6 +8,9 @@ class TaskStatus {
     static PAYLOAD_CHECKSUM_ERROR = 6;
     static INPUT_CHECKSUM_ERROR = 7;
     static EVAL_ERROR = 8;
+    // Extended diagnostic (matches the trustedzone's extended enum): the
+    // serverless backend failed to load, so none of its functions exist.
+    static IMPORT_ERROR = 28;
 }
 
 module.exports = {

package/nodenithy/build.js

@@ -67,6 +67,28 @@ runCommand(`docker rm registry -f`);
 
 const srcDir = './src/serverless';
 const destDir = path.join(buildDir, 'securelock/src/serverless');
+
+// Fail the build NOW if the backend is missing or unparseable. An enclave
+// built without a valid backend runs every task into "X is not defined" /
+// IMPORT_ERROR on-chain — expensive to discover after building, publishing
+// and paying for a task.
+const backendFile = path.join(srcDir, 'backend.js');
+if (!fs.existsSync(backendFile)) {
+  console.error(`ERROR: ${backendFile} not found.`);
+  console.error('       The securelock enclave loads your functions from src/serverless/backend.js;');
+  console.error('       without it no backend function will exist inside the enclave.');
+  console.error('       Run ecld-init to scaffold it, or create the file before building.');
+  process.exit(1);
+}
+try {
+  require(path.resolve(backendFile));
+} catch (e) {
+  console.error('ERROR: src/serverless/backend.js failed to load and would fail inside the enclave:');
+  console.error(`       ${e.name || 'Error'}: ${e.message}`);
+  console.error('       Fix the module (missing dependency? bad require?) before building.');
+  process.exit(1);
+}
+
 console.log(`Creating destination directory: ${destDir}`);
 fs.mkdirSync(destDir, { recursive: true });
 

package/nodenithy/build.mjs

@@ -92,6 +92,29 @@ runCommand(`docker rm registry -f`);
 
 const srcDir = './src/serverless';
 const destDir = path.join(buildDir, 'securelock/src/serverless');
+
+// Fail the build NOW if the backend is missing or unloadable. An enclave
+// built without a valid backend runs every task into "X is not defined" /
+// IMPORT_ERROR on-chain — expensive to discover after building, publishing
+// and paying for a task.
+const backendFile = path.join(srcDir, 'backend.js');
+if (!fs.existsSync(backendFile)) {
+  console.error(`ERROR: ${backendFile} not found.`);
+  console.error('       The securelock enclave loads your functions from src/serverless/backend.js;');
+  console.error('       without it no backend function will exist inside the enclave.');
+  console.error('       Run ecld-init to scaffold it, or create the file before building.');
+  process.exit(1);
+}
+try {
+  const { createRequire } = await import('module');
+  createRequire(import.meta.url)(path.resolve(backendFile));
+} catch (e) {
+  console.error('ERROR: src/serverless/backend.js failed to load and would fail inside the enclave:');
+  console.error(`       ${e.name || 'Error'}: ${e.message}`);
+  console.error('       Fix the module (missing dependency? bad require?) before building.');
+  process.exit(1);
+}
+
 console.log(`Creating destination directory: ${destDir}`);
 fs.mkdirSync(destDir, { recursive: true });
 
@@ -120,19 +143,69 @@ writeEnv('ENCLAVE_NAME_SECURELOCK', ENCLAVE_NAME_SECURELOCK);
 
 console.log('Building etny-securelock');
 process.chdir('securelock');
+
+// The SGX key-gen module ships as a PREBUILT sgx_report.node (never the .c
+// source). It is a build artifact of the etny-nodenithy pipeline; the
+// securelock Dockerfile bakes it into binary-fs but does not compile it. Fail
+// fast with a clear message if it is missing, rather than producing an enclave
+// that crashes on the missing addon at runtime.
+if (!fs.existsSync('src/sgx_report.node')) {
+  console.error('ERROR: securelock/src/sgx_report.node not found.');
+  console.error('       The SDK ships the SGX key-gen module as a prebuilt .node, not source.');
+  console.error('       It is a build artifact of the etny-nodenithy pipeline; copy it into');
+  console.error('       securelock/src/ (see src/README-keygen.md) before building.');
+  process.exit(1);
+}
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-const dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
-
-fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName);
+
+// Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
+// run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
+const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
+
+// CRITICAL (mainnet DCAP): sign /usr/local/bin/node -- the binary the enclave
+// actually EXECUTES (ENTRYPOINT + the run/publish compose command both run
+// /usr/local/bin/node). Signing anything else leaves the executed binary as the
+// base image's DEBUG-signed one, so at load SCONE recomputes MRENCLAVE and
+// re-signs it as debug -> CAS rejects the DCAP quote ("Debug mode enabled").
+//
+// The enclave-creation params (--heap/--stack/--dlopen/--extensions) MUST be
+// passed explicitly and match the runtime env exactly (scone-signer embeds SCONE
+// defaults for anything not passed as a flag) -- any drift triggers the same
+// debug re-sign. Values mirror the run/docker-compose securelock service.
+const signFlags =
+  `--key=/enclave-key.pem --env --heap=${MEMORY_TO_ALLOCATE} ` +
+  `--stack=4M --dlopen=1 --extensions=/lib/libbinary-fs.so`;
+
+// scone-signer prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+// runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+// to a file first -- piping into head/grep kills scone-signer with SIGPIPE
+// (exit 141) under buildkit's pipefail shell.
+const signedMrenclaveStep =
+  'RUN scone-signer info /usr/local/bin/node > /tmp/siginfo.txt 2>&1; \\\n' +
+  '    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n \'1p\' \\\n' +
+  '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
+  '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 
 if (isMainnet) {
-  fs.writeFileSync('Dockerfile', dockerfileSecureContent.replace('# RUN scone-signer sign', 'RUN scone-signer sign'));
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase()
+  // Mainnet: production sign the executed node binary + bake the signed MRENCLAVE.
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
+    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
+  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+} else {
+  // Testnet: non-CAS self-sign path -- no --production sign and no signed
+  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
+  dockerfileSecureContent = dockerfileSecureContent
+    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
+    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
 }
 
+fs.writeFileSync('Dockerfile', dockerfileSecureContent);
+