@ethernity-cloud/sdk-js 1.5.18 → 1.5.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -35,11 +35,22 @@ function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
|
|
|
35
35
|
enclave pushes for the trustedzone is SIGNED with its identity key, so the
|
|
36
36
|
trustedzone authors metadata rows only from verified securelock material;
|
|
37
37
|
everything read from the trustedzone is verified against the trustedzone's
|
|
38
|
-
registry certificate before it is trusted.
|
|
38
|
+
registry certificate before it is trusted. Each signature covers
|
|
39
|
+
"<challenge>:<order_id>:<object>:" ahead of the data -- the task binding
|
|
40
|
+
the trustedzone forwarded in task.securelock, extended with the object's
|
|
41
|
+
own name -- so the trustedzone can refuse a session object captured from
|
|
42
|
+
another order, another run, or another sequence position. Without a
|
|
43
|
+
binding (older trustedzone) the bare data is signed, which that trustedzone
|
|
44
|
+
verifies. */
|
|
45
|
+
|
|
46
|
+
function sessionBinding(app, baseName) {
|
|
47
|
+
return app.task_binding
|
|
48
|
+
? `${app.task_binding.challenge}:${app.task_binding.order_id}:${baseName}:` : '';
|
|
49
|
+
}
|
|
39
50
|
|
|
40
51
|
async function pushSignedForTrustedzone(app, data, baseName) {
|
|
41
52
|
await app.encryptFileAndPushToSwiftStream(data, baseName);
|
|
42
|
-
const sigHex = etny_crypto.signData(app.privateKeyMaterial(), data);
|
|
53
|
+
const sigHex = etny_crypto.signData(app.privateKeyMaterial(), sessionBinding(app, baseName) + data);
|
|
43
54
|
await app.encryptFileAndPushToSwiftStream(sigHex, baseName + '.sig');
|
|
44
55
|
}
|
|
45
56
|
|
package/package.json
CHANGED