@ethernity-cloud/sdk-js 1.1.1 → 1.4.0

package/pynithy/run/docker-compose.yml.tmpl

@@ -1,3 +1,10 @@
+# Publish-time compose: used by ecld-publish to compute the MRENCLAVE
+# (SCONE_HASH=1) and extract the enclave certificate LOCALLY. It intentionally
+# does NOT mount /dev/sgx_enclave so it runs on a developer machine WITHOUT SGX
+# (SCONE_HASH is a build measurement; enclaves reach SGX via LAS over TCP). When
+# no local SGX is present, cert extraction falls back to the remote
+# publickey.ethernity.cloud service. The on-node runtime uses
+# docker-compose-final.yml, which targets real SGX hardware.
 version: '3.2'
 services:
     las:
@@ -5,8 +12,6 @@ services:
         privileged: true
         image: localhost:5000/etny-las
         command: "bash -c '/las_entrypoint.sh && /usr/local/bin/las | tee /var/log/las.log'"
-        devices:
-         - "/dev/sgx_enclave:/dev/sgx_enclave"
         restart: unless-stopped
         ports:
           - target: 18766
@@ -25,12 +30,13 @@ services:
           - SCONE_LAS_ADDR=las
           - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
           - SCONE_HEAP=1024M
+          # Must match the --stack the securelock binary was signed with (build.mjs),
+          # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
+          - SCONE_STACK=4M
           - SCONE_LOG=INFO
           - SCONE_ALLOW_DLOPEN=1
           - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
         restart: on-failure:5
-        devices:
-          - "/dev/sgx_enclave:/dev/sgx_enclave"
         depends_on:
           - las
 
@@ -49,7 +55,5 @@ services:
         - SCONE_ALLOW_DLOPEN=1
         - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
       restart: on-failure:5
-      devices:
-        - "/dev/sgx_enclave:/dev/sgx_enclave"
       depends_on:
         - las

package/pynithy/run.js

@@ -73,6 +73,29 @@ const runDockerCommand = (service) => {
     return output.split('\n').filter(line => !/Creating|Pulling|latest|Digest/.test(line)).join('');
 };
 
+// Extract the runtime enclave measurement (SCONE_HASH) as a bare 64-hex string.
+// Mirrors Python extract_scone_hash: pick the first 64-hex token in the output.
+const extractSconeHash = (service) => {
+    const output = runDockerCommand(service);
+    const m = output.match(/\b[a-fA-F0-9]{64}\b/);
+    if (!m) throw new Error(`No SHA256 MRENCLAVE found in ${service} SCONE_HASH output.`);
+    return m[0];
+};
+
+// Read the MRENCLAVE signed at build time (baked into the image as
+// /signed_mrenclave.txt on mainnet). Mirrors Python extract_signed_mrenclave.
+// Returns '' if the file is absent (testnet builds).
+const extractSignedMrenclave = (service) => {
+    try {
+        const command = `docker-compose -f docker-compose.yml run --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
+        const output = execSync(command, { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
+        const m = output.match(/\b[a-fA-F0-9]{64}\b/);
+        return m ? m[0] : '';
+    } catch (e) {
+        return '';
+    }
+};
+
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
     const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
@@ -86,13 +109,29 @@ const main = async () => {
     });
 
 
-    process.env.MRENCLAVE_SECURELOCK = runDockerCommand('etny-securelock');
+    process.env.MRENCLAVE_SECURELOCK = extractSconeHash('etny-securelock');
     console.log(`MRENCLAVE_SECURELOCK: ${process.env.MRENCLAVE_SECURELOCK}`);
     // process.env.MRENCLAVE_TRUSTEDZONE = runDockerCommand('etny-trustedzone');
     // console.log(`MRENCLAVE_TRUSTEDZONE: ${process.env.MRENCLAVE_TRUSTEDZONE}`);
     // process.env.MRENCLAVE_VALIDATOR = runDockerCommand('etny-validator');
     // console.log(`MRENCLAVE_VALIDATOR: ${process.env.MRENCLAVE_VALIDATOR}`);
 
+    // ----- MRENCLAVE match-gate (mainnet) -----
+    // The runtime enclave measured just above (SCONE_HASH) MUST match the
+    // MRENCLAVE signed --production at build time (/signed_mrenclave.txt). A
+    // mismatch means SCONE recomputed the measurement at load (params drift) and
+    // re-signed as DEBUG, which CAS rejects on mainnet. Refuse to publish.
+    if (isMainnet) {
+        const signedMrenclave = extractSignedMrenclave('etny-securelock');
+        if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
+            console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
+            console.error('       The runtime enclave differs from the --production-signed binary (SCONE recomputed -> debug).');
+            console.error('       Refusing to publish. Rebuild with the current SDK (ecld-build) and retry.');
+            process.exit(1);
+        }
+        console.log('\t✔  MRENCLAVE match-gate passed: runtime enclave matches the --production-signed MRENCLAVE');
+    }
+
     writeEnv('MRENCLAVE_SECURELOCK', process.env.MRENCLAVE_SECURELOCK);
     // writeEnv('MRENCLAVE_TRUSTEDZONE', process.env.MRENCLAVE_TRUSTEDZONE);
     // writeEnv('MRENCLAVE_VALIDATOR', process.env.MRENCLAVE_VALIDATOR);

package/test.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+/* ecld-test — run a Nodenithy payload locally, without SGX, exactly as the
+ * enclave would.
+ *
+ * Stages the project's src/serverless next to the vendored securelock
+ * executor (the same layout ecld-build produces inside the enclave image) and
+ * executes the payload with that executor: same backend reflection, same
+ * ___etny_result___ / ___etny_data_set___ scope, same TaskStatus codes.
+ * Validates the CALL — names, arguments, result wiring — before anything is
+ * paid for on-chain. It does not validate attestation, checksums or
+ * encryption; those need a real (testnet) run.
+ *
+ * Usage, from the project root:
+ *
+ *   npx ecld-test 'hello("World")'              one-shot, in-process
+ *   npx ecld-test --file payload.js
+ *   npx ecld-test --input data.json 'processData(___etny_data_set___)'
+ *   npx ecld-test --input-text '{"x":1}' 'processData(___etny_data_set___)'
+ *
+ *   npx ecld-test serve [--port 8745]           local API for runner LOCAL mode
+ *
+ * `serve` starts the local test API so a dApp can exercise its real runner
+ * integration end to end: new EthernityCloudRunner('LOCAL') in
+ * @ethernity-cloud/runner >= 0.3.6 executes every run() against this API
+ * instead of the blockchain.
+ *
+ * Exit code 0 on TaskStatus SUCCESS, 1 otherwise.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+const crypto = require('crypto');
+
+const TASK_STATUS_NAMES = {
+  0: 'SUCCESS',
+  1: 'SYSTEM_ERROR',
+  2: 'KEY_ERROR',
+  3: 'SYNTAX_WARNING',
+  4: 'BASE_EXCEPTION',
+  5: 'PAYLOAD_NOT_DEFINED',
+  6: 'PAYLOAD_CHECKSUM_ERROR',
+  7: 'INPUT_CHECKSUM_ERROR',
+  8: 'EVAL_ERROR',
+  28: 'IMPORT_ERROR',
+  32: 'CONFIG_ERROR',
+};
+
+const VENDORED_SRC = path.join(__dirname, 'nodenithy', 'build', 'securelock', 'src');
+
+function copyDir(src, dest) {
+  fs.mkdirSync(dest, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const from = path.join(src, entry.name);
+    const to = path.join(dest, entry.name);
+    if (entry.isDirectory()) copyDir(from, to);
+    else fs.copyFileSync(from, to);
+  }
+}
+
+/* Stage the executor + the project's backend the way ecld-build does inside
+ * the enclave image, then load the REAL executor from the staged copy. */
+function loadExecutor(projectSrc) {
+  const stage = fs.mkdtempSync(path.join(os.tmpdir(), 'ecld-test-'));
+  for (const f of ['etny_exec.js', 'task_status.js']) {
+    fs.copyFileSync(path.join(VENDORED_SRC, f), path.join(stage, f));
+  }
+  const backendDir = path.join(projectSrc, 'serverless');
+  const backendJs = path.join(backendDir, 'backend.js');
+  if (fs.existsSync(backendJs)) {
+    copyDir(backendDir, path.join(stage, 'serverless'));
+    console.log(`backend : ${backendJs}`);
+  } else if (fs.existsSync(path.join(backendDir, 'backend.py'))) {
+    console.log('backend : backend.py found — this is a Pynithy project; use');
+    console.log('          ecld-test from ethernity-cloud-sdk-py instead.');
+    console.log('          Continuing with bare globals (stock-enclave mode).');
+  } else {
+    console.log('backend : none found — running with bare globals, like a stock enclave');
+  }
+  return require(path.join(stage, 'etny_exec.js'));
+}
+
+function runTask(executor, payload, input) {
+  const [code, resultRaw] = executor.executeTask(payload, input || '');
+  const result = typeof resultRaw === 'string' ? resultRaw : JSON.stringify(resultRaw);
+  const checksum = crypto.createHash('sha256').update(result, 'utf8').digest('hex');
+  const challenge = Array.from({ length: 20 }, () =>
+    'abcdefghijklmnopqrstuvwxyz0123456789'[Math.floor(Math.random() * 36)]
+  ).join('');
+  return {
+    task_code: code,
+    task_code_name: TASK_STATUS_NAMES[code] || `UNKNOWN_${code}`,
+    result,
+    checksum,
+    enclave_challenge: challenge,
+    result_string: `v3:${code}:${checksum}:${challenge}:`,
+  };
+}
+
+function serve(executor, host, port) {
+  const server = http.createServer((req, res) => {
+    const send = (status, obj) => {
+      const body = JSON.stringify(obj);
+      res.writeHead(status, {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Allow-Headers': 'Content-Type',
+      });
+      res.end(body);
+    };
+    if (req.method === 'OPTIONS') return send(204, {});
+    if (req.method === 'GET' && req.url === '/v1/health') {
+      // Probe with an expression that lists scope? Keep it simple: report ok.
+      return send(200, { status: 'ok', backend: serve.backendFunctions || [] });
+    }
+    if (req.method === 'POST' && req.url === '/v1/task') {
+      let raw = '';
+      req.on('data', (c) => { raw += c; });
+      req.on('end', () => {
+        try {
+          const body = JSON.parse(raw || '{}');
+          if (typeof body.payload !== 'string' || !body.payload.trim()) {
+            return send(400, { error: 'payload (string) is required' });
+          }
+          let input = body.input;
+          if (input !== undefined && input !== null && typeof input !== 'string') {
+            input = JSON.stringify(input);
+          }
+          const out = runTask(executor, body.payload, input);
+          console.log(`[local-api] task -> ${out.task_code} (${out.task_code_name})`);
+          return send(200, out);
+        } catch (e) {
+          if (e instanceof SyntaxError) return send(400, { error: 'invalid JSON body' });
+          return send(500, { error: e.message });
+        }
+      });
+      return;
+    }
+    send(404, { error: 'not found' });
+  });
+  server.listen(port, host, () => {
+    console.log(`[local-api] listening on http://${host}:${port}  (POST /v1/task, GET /v1/health)`);
+  });
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  const opts = { src: 'src', host: '127.0.0.1', port: 8745 };
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--file' || a === '-f') opts.file = argv[++i];
+    else if (a === '--input' || a === '-i') opts.inputFile = argv[++i];
+    else if (a === '--input-text') opts.inputText = argv[++i];
+    else if (a === '--src') opts.src = argv[++i];
+    else if (a === '--host') opts.host = argv[++i];
+    else if (a === '--port') opts.port = parseInt(argv[++i], 10);
+    else positional.push(a);
+  }
+
+  const projectSrc = path.resolve(opts.src);
+  const executor = loadExecutor(projectSrc);
+  // Record the backend's exported names once for /v1/health.
+  try {
+    serve.backendFunctions = Object.keys(require(path.join(projectSrc, 'serverless', 'backend.js')));
+  } catch (e) {
+    serve.backendFunctions = [];
+  }
+
+  if (positional[0] === 'serve') {
+    return serve(executor, opts.host, opts.port);
+  }
+
+  let payload;
+  if (opts.file) payload = fs.readFileSync(opts.file, 'utf8');
+  else if (positional.length) payload = positional.join(' ');
+  else {
+    console.error("usage: ecld-test 'hello(\"World\")' | ecld-test --file payload.js | ecld-test serve");
+    process.exit(2);
+  }
+
+  let input = null;
+  if (opts.inputFile && opts.inputText !== undefined) {
+    console.error('--input and --input-text are mutually exclusive');
+    process.exit(2);
+  }
+  if (opts.inputFile) input = fs.readFileSync(opts.inputFile, 'utf8');
+  else if (opts.inputText !== undefined) input = opts.inputText;
+
+  console.log(`payload : ${JSON.stringify(payload)}`);
+  console.log(`input   : ${input === null ? '<empty>' : JSON.stringify(input.slice(0, 80))}`);
+  const out = runTask(executor, payload, input);
+  console.log(`task code: ${out.task_code} (${out.task_code_name})`);
+  console.log(`result   : ${JSON.stringify(out.result)}`);
+  if (out.task_code !== 0) {
+    console.log('\nThis is exactly what the network would write on-chain — the failed');
+    console.log('attempt would still cost gas. Fix locally, then submit.');
+  }
+  process.exit(out.task_code === 0 ? 0 : 1);
+}
+
+main();