@ethernity-cloud/sdk-js 1.5.19 → 1.6.0

package/README.md

@@ -39,7 +39,16 @@ The sdk has been tested on the following operating systems:
 
 ## Blockchain compatibility
 - Bloxberg:
-    - Testnet - tested and working
+    - Testnet - tested and working. CAS-attested: the securelock is
+      provisioned by the ethernity-cas validator set exactly as on mainnet.
+      `ecld-publish` registers the securelock session on-chain in the
+      SessionRegistry (`0xcb1F389b...`, see `cas/config.js`), resolves a CAS
+      from the ValidatorRegistry (`0xC40102c0...`, or `ECLD_CAS_ADDR=host:port`)
+      for the compose and the certificate harvest, takes the trustedzone
+      session name from the ImageRegistry, and links the session to the
+      published image. `ecld-build` signs the securelock `--production`.
+      Harvesting the certificate needs SGX. The other testnets have no CAS
+      deployment and self-sign from MR_ENCLAVE as before.
     - Mainnet - to be provided during the following updates
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates

package/cas/config.js

@@ -0,0 +1,36 @@
+// ethernity-cas deployments, keyed by trustedzone template name (the value of
+// TRUSTED_ZONE_IMAGE), for the networks whose enclaves are attested by the
+// ethernity-cas validator set.
+//
+// A testnet template listed in SESSION_REGISTRY is CAS-attested: ecld-publish
+// registers the securelock session there (body pinned to IPFS as
+// CIDv1/raw/sha2-256) instead of posting it to a CAS, provisions the enclave
+// from a validator resolved out of VALIDATOR_REGISTRY, and the securelock
+// takes its certificate from the CAS session and verifies the CAS against the
+// registry baked into it. A testnet template NOT listed here has no CAS: its
+// securelock self-signs from MR_ENCLAVE. Mainnet templates are provisioned by
+// the Scontain CAS and are not listed.
+//
+// Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml
+// (cas_session_registry_address, validator_registry_address).
+const VALIDATOR_REGISTRY = {
+  'etny-pynithy-testnet': '0xC40102c0b3f87663C925083861F38e2498C2038F',
+  'etny-nodenithy-testnet': '0xC40102c0b3f87663C925083861F38e2498C2038F',
+};
+
+const SESSION_REGISTRY = {
+  'etny-pynithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
+  'etny-nodenithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
+};
+
+// The chain the registries above live on.
+const CHAIN = {
+  'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
+  'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
+};
+
+// Whether the securelock takes its certificate from a CAS session: mainnet
+// (Scontain CAS), or a testnet template with a SessionRegistry (ethernity-cas).
+const casProvisioned = (templateName, isMainnet) => isMainnet || Boolean(SESSION_REGISTRY[templateName]);
+
+module.exports = { VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned };

package/cas/resolver.js

@@ -0,0 +1,95 @@
+// Which CAS a CAS-attested testnet's enclaves are provisioned from.
+//
+// The validators are enumerated from the ValidatorRegistry and their enclave
+// endpoints read from the CasKeyStore the registry names via keyStore() --
+// the same chain data the node's own resolver uses before every task. Only
+// /dns4, /dns, /ip4 and /ip6 endpoints are dialled: the SDK runs on a
+// developer's machine with no Tor proxy. An endpoint is taken only after its
+// REST port answered GET /validator/identity.
+//
+// Multiaddrs advertise the ENCLAVE port; the REST port follows the pairing
+// convention rest = 9081 + (enclave - 19765). Enclave ports outside
+// [19765, 19965) fall back to REST 9081.
+//
+// ECLD_CAS_ADDR=host:port overrides resolution.
+const axios = require('axios');
+const { ethers } = require('ethers');
+
+const REGISTRY_ABI = [
+  'function validatorCount() view returns (uint256)',
+  'function validatorSet(uint256) view returns (address)',
+  'function isValidator(address) view returns (bool)',
+  'function keyStore() view returns (address)',
+];
+const STORE_ABI = ['function multiaddrsOf(address) view returns (string[])'];
+
+const ENCLAVE_PORT_BASE = 19765;
+const REST_PORT_BASE = 9081;
+
+// "/dns4|dns|ip4|ip6/HOST/tcp/PORT" -> {host, port}; anything else null.
+function parseMultiaddr(ma) {
+  const parts = String(ma).split('/').filter((p) => p !== '');
+  if (parts.length !== 4 || parts[2] !== 'tcp') return null;
+  if (!['dns4', 'dns6', 'dns', 'ip4', 'ip6'].includes(parts[0])) return null;
+  const port = Number(parts[3]);
+  if (!Number.isInteger(port)) return null;
+  return { host: parts[1], port };
+}
+
+function restPortFor(enclavePort) {
+  if (enclavePort >= ENCLAVE_PORT_BASE && enclavePort < ENCLAVE_PORT_BASE + 200) {
+    return REST_PORT_BASE + (enclavePort - ENCLAVE_PORT_BASE);
+  }
+  return REST_PORT_BASE;
+}
+
+// The address the CAS REST port reports for itself, or null when it did not answer.
+async function identityAnswers(host, restPort, timeoutMs) {
+  try {
+    const r = await axios.get(`http://${host}:${restPort}/validator/identity`, { timeout: timeoutMs });
+    return (r.data && r.data.address) || null;
+  } catch (e) {
+    return null;
+  }
+}
+
+// "host:port" (the ENCLAVE port) of the first active validator whose REST port
+// answers, sweeping from a rotating offset; null when none answered.
+async function resolveCas(rpcUrl, registryAddress, probeTimeoutMs = 10000, startAt = null) {
+  const provider = new ethers.providers.JsonRpcProvider({ url: rpcUrl, timeout: 30000 });
+  const reg = new ethers.Contract(registryAddress, REGISTRY_ABI, provider);
+  const total = (await reg.validatorCount()).toNumber();
+  if (total === 0) return null;
+  const store = new ethers.Contract(await reg.keyStore(), STORE_ABI, provider);
+  const offset = startAt === null ? Math.floor(Math.random() * total) : startAt % total;
+  for (let step = 0; step < total; step++) {
+    const v = await reg.validatorSet((offset + step) % total);
+    if (!(await reg.isValidator(v))) continue;
+    for (const ma of await store.multiaddrsOf(v)) {
+      const parsed = parseMultiaddr(ma);
+      if (!parsed) continue;
+      if (await identityAnswers(parsed.host, restPortFor(parsed.port), probeTimeoutMs)) {
+        return `${parsed.host}:${parsed.port}`;
+      }
+    }
+  }
+  return null;
+}
+
+// The CAS to provision against: ECLD_CAS_ADDR when set, else resolved from
+// chain. Throws when neither yields one -- a compose without a reachable CAS
+// cannot harvest a certificate.
+async function casAddressFor(rpcUrl, registryAddress) {
+  const override = String(process.env.ECLD_CAS_ADDR || '').trim();
+  if (override) return override;
+  if (!registryAddress) {
+    throw new Error('no ValidatorRegistry is known for this network and ECLD_CAS_ADDR is not set');
+  }
+  const resolved = await resolveCas(rpcUrl, registryAddress);
+  if (!resolved) {
+    throw new Error(`no CAS validator registered in ${registryAddress} answered on its REST port; set ECLD_CAS_ADDR=host:port to name one`);
+  }
+  return resolved;
+}
+
+module.exports = { parseMultiaddr, restPortFor, identityAnswers, resolveCas, casAddressFor };

package/cas/session_registry.js

@@ -0,0 +1,142 @@
+// Register a securelock session ON-CHAIN, in the ethernity-cas SessionRegistry.
+//
+// On a CAS-attested testnet the CAS is a validator set that reads its sessions
+// from the chain and never accepts a POST: the publisher pins the session body
+// to IPFS and submits SessionRegistry.register itself, with the wallet that
+// owns the ImageRegistry entry. The first registration of a name fixes its
+// creator; later versions of the same name must come from that wallet.
+//
+// The body is pinned as CIDv1/raw/sha2-256, so with hashAlgo 1 the on-chain
+// sessionHash and the CID commit to the same digest (sha256 of the exact
+// bytes) -- what lets a validator check the body it fetched against the chain
+// without trusting the gateway. The same recipe as etny-pynithy's
+// v3/run/register_session.py and the Python SDK's session_registry.py.
+const crypto = require('crypto');
+const axios = require('axios');
+const { ethers } = require('ethers');
+
+const ABI = [
+  'function register(bytes32 sessionHash, string name, string bodyCid, string imageCid, uint8 hashAlgo, (string[] tolerate, string[] ignoreAdvisories, string[] mrenclaves, uint16 minIsvSvn, bool debugAllowed, bool skipQuoteVerification) rulesIn) returns (uint32)',
+  'function latest(string name) view returns (bytes32)',
+  'function linkImage(bytes32 sessionHash, string imageCid)',
+];
+
+const HASH_ALGO_SHA256 = 1;
+
+function yamlList(text) {
+  let t = text.trim();
+  if (t.startsWith('[')) {
+    const end = t.indexOf(']');
+    t = end >= 0 ? t.slice(1, end) : t.slice(1);
+  }
+  return t.split(',').map((x) => x.trim().replace(/^["']|["']$/g, '')).filter((x) => x);
+}
+
+// The session's name and the SessionRules the registry stores beside it.
+function parseNameAndRules(text) {
+  let name = '';
+  let tolerate = [], ignoreAdvisories = [], mrenclaves = [];
+  let minIsvSvn = 0, debugAllowed = false, skipQuoteVerification = false;
+  for (const raw of text.split('\n')) {
+    const line = raw.trim();
+    if (!name && line.startsWith('name:')) {
+      name = line.slice('name:'.length).trim().replace(/^["']|["']$/g, '');
+    } else if (line.startsWith('tolerate:')) {
+      tolerate = yamlList(line.slice('tolerate:'.length));
+      debugAllowed = tolerate.some((t) => t.toLowerCase().includes('debug'));
+    } else if (line.startsWith('ignore_advisories:')) {
+      ignoreAdvisories = yamlList(line.slice('ignore_advisories:'.length));
+    } else if (line.startsWith('mrenclaves:')) {
+      for (const m of yamlList(line.slice('mrenclaves:'.length))) {
+        if (m && !mrenclaves.includes(m)) mrenclaves.push(m);
+      }
+    } else if (line.startsWith('isvsvn:') || line.startsWith('min_isvsvn:')) {
+      const n = parseInt(line.split(':', 2)[1].trim(), 10);
+      if (!Number.isNaN(n)) minIsvSvn = n;
+    } else if (line.startsWith('skip_quote_verification:')) {
+      skipQuoteVerification = line.slice('skip_quote_verification:'.length).trim().replace(/^["']|["']$/g, '') === 'true';
+    }
+  }
+  return { name, rules: { tolerate, ignoreAdvisories, mrenclaves, minIsvSvn, debugAllowed, skipQuoteVerification } };
+}
+
+function sessionHash(body) {
+  return '0x' + crypto.createHash('sha256').update(body).digest('hex');
+}
+
+// Pin the exact bytes as CIDv1/raw/sha2-256 and return the CID.
+async function pinBody(ipfsApiUrl, body) {
+  const form = new FormData();
+  form.append('file', new Blob([body]), 'session');
+  const r = await axios.post(`${ipfsApiUrl}/api/v0/add?cid-version=1&raw-leaves=true&pin=true`, form, { timeout: 60000 });
+  return r.data.Hash;
+}
+
+function contract(rpcUrl, registryAddress, key) {
+  const provider = new ethers.providers.JsonRpcProvider({ url: rpcUrl, timeout: 30000 });
+  const signer = key ? new ethers.Wallet(key.startsWith('0x') ? key : `0x${key}`, provider) : provider;
+  return new ethers.Contract(registryAddress, ABI, signer);
+}
+
+// Pin `body` and register it under its own `name:`. Returns
+// {name, hash, cid, registered}: `registered` is false when the chain already
+// held these exact bytes as the name's latest version.
+async function register(rpcUrl, chainId, registryAddress, key, body, ipfsApiUrl, imageCid = '') {
+  const { name, rules } = parseNameAndRules(body.toString('utf8'));
+  if (!name) throw new Error('the session body has no `name:`');
+  const hash = sessionHash(body);
+  const reg = contract(rpcUrl, registryAddress, key);
+  const cid = await pinBody(ipfsApiUrl, body);
+  if ((await reg.latest(name)).toLowerCase() === hash) {
+    return { name, hash, cid, registered: false };
+  }
+  const tx = await reg.register(hash, name, cid, imageCid, HASH_ALGO_SHA256, rules, {
+    gasLimit: 800000, gasPrice: ethers.utils.parseUnits('1', 'mwei'), chainId,
+  });
+  const rcpt = await tx.wait();
+  if (rcpt.status !== 1) {
+    throw new Error(`SessionRegistry.register reverted for ${name} (tx ${tx.hash}): this name's creator may be another wallet, or the SessionRules shape differs from the ABI`);
+  }
+  return { name, hash, cid, registered: true };
+}
+
+// Point the name's latest version at the published image CID.
+async function linkImage(rpcUrl, chainId, registryAddress, key, name, imageCid) {
+  const reg = contract(rpcUrl, registryAddress, key);
+  const hash = await reg.latest(name);
+  if (/^0x0+$/.test(hash)) throw new Error(`no registered session named ${name}`);
+  const tx = await reg.linkImage(hash, imageCid, { gasLimit: 300000, gasPrice: ethers.utils.parseUnits('1', 'mwei'), chainId });
+  const rcpt = await tx.wait();
+  if (rcpt.status !== 1) throw new Error(`SessionRegistry.linkImage reverted for ${name} (tx ${tx.hash})`);
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Block until the chain reports `name` at `hash`, then hold while the
+// validators pick it up: the elected writer's poll (ECAS_SESSION_WATCH_SECS,
+// 60 s) notices the registration and generates the secrets, its recordKey
+// transaction confirms, and the other validators' next poll adopts the
+// recorded blob. The enclave cannot retry and the validator it dials is the
+// node's choice, so the wait covers the LAST validator to adopt.
+async function waitVisible(rpcUrl, registryAddress, name, hash, timeoutMs = 180000) {
+  const reg = contract(rpcUrl, registryAddress, null);
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    let got;
+    try { got = (await reg.latest(name)).toLowerCase(); } catch (e) { got = `(read failed: ${e.message})`; }
+    if (got === hash.toLowerCase()) {
+      console.log(`\t✔  session ${name} visible on chain at ${got}`);
+      break;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`session ${name} did not become visible within ${timeoutMs / 1000}s (chain reports ${got}, expected ${hash})`);
+    }
+    await sleep(5000);
+  }
+  const poll = parseInt(process.env.CAS_SESSION_POLL_SECS || '60', 10);
+  const hold = 2 * poll + 60;
+  console.log(`\t   holding ${hold}s for the CAS validators to generate and mirror it`);
+  await sleep(hold * 1000);
+}
+
+module.exports = { parseNameAndRules, sessionHash, pinBody, register, linkImage, waitVisible, HASH_ALGO_SHA256 };

package/nodenithy/build/securelock/src/esr_wallet.js

@@ -109,15 +109,18 @@ function deriveWalletAddress(identityPrivDer) {
  *     testnet tradeoff — treat these wallets as disposable.
  *
  * @param {string} networkType "mainnet" | "testnet"
+ * @param {boolean} attested whether this build is provisioned by a CAS (its
+ *   key comes from the CAS session): true on mainnet and on a testnet whose
+ *   enclaves are attested by the ethernity-cas validator set
  * @returns {boolean}
  */
-function isSecretIdentity(networkType) {
+function isSecretIdentity(networkType, attested = false) {
   const override = String(process.env.ESR_IDENTITY_SECRET || '').trim().toLowerCase();
   if (override === '1' || override === 'true' || override === 'yes') return true;
   if (override === '0' || override === 'false' || override === 'no') return false;
   // Secrecy tracks attestation, not the network name: mainnet is attested,
-  // testnet is not. The override exists for a future attested-testnet build.
-  return String(networkType || '').trim().toLowerCase() === 'mainnet';
+  // and so is a testnet whose securelock is provisioned by a CAS.
+  return attested || String(networkType || '').trim().toLowerCase() === 'mainnet';
 }
 
 const INSECURE_IDENTITY_WARNING =

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -111,16 +111,18 @@ class EtnySecureLock {
      * preferred (matching the node-side resolver). Returns REST base URLs.
      */
     async casEndpointsFromChain(casAddress) {
-        const vrAbi = [
-            'function multiaddrsOf(address) view returns (string[])',
-            'function ensNamesOf(address) view returns (string[])',
-        ];
-        const vr = new ethers.Contract(this.validator_registry_address, vrAbi, this.w3);
+        // Endpoints live in the CasKeyStore the registry names via keyStore();
+        // the registry's own forwarders were removed when it reached the
+        // EIP-170 size limit.
+        const registryAbi = ['function keyStore() view returns (address)'];
+        const storeAbi = ['function multiaddrsOf(address) view returns (string[])'];
         let mas;
         try {
-            mas = await vr.multiaddrsOf(casAddress);
+            const vr = new ethers.Contract(this.validator_registry_address, registryAbi, this.w3);
+            const store = new ethers.Contract(await vr.keyStore(), storeAbi, this.w3);
+            mas = await store.multiaddrsOf(casAddress);
         } catch (e) {
-            console.warn(`CAS attestation: multiaddrsOf failed: ${e.message || e}`);
+            console.warn(`CAS attestation: reading the CAS endpoints from chain failed: ${e.message || e}`);
             return [];
         }
         const onion = [], rest = [];
@@ -323,7 +325,9 @@ class EtnySecureLock {
 
         const vrAbi = [
             'function isValidator(address) view returns (bool)',
-            'function validators(address) view returns (bytes32 mrenclave, bytes32 certHash, bool active, uint64 admittedBlock, uint64 lastVoteBlock)',
+            // The registry's Validator struct: the measurement is `bytes` at
+            // its platform width (32 for SGX MRENCLAVE), not bytes32.
+            'function validators(address) view returns (bytes measurement, bytes32 certHash, bool active, uint64 admittedBlock, uint64 lastVoteBlock, uint16 teeType, address operator)',
         ];
         let active = false, record = null, lastErr = null;
         let casAddress = null, boundCert = null;
@@ -362,7 +366,7 @@ class EtnySecureLock {
         if (!active) {
             return fault(`CAS ${casAddress} is NOT an active validator`);
         }
-        const registeredMr = record.mrenclave.replace(/^0x/, '');
+        const registeredMr = record.measurement.replace(/^0x/, '');
         if (registeredMr !== quoteMrenclave) {
             return fault(`CAS quote MRENCLAVE ${quoteMrenclave} != registered ${registeredMr}`);
         }
@@ -515,7 +519,23 @@ class EtnySecureLock {
     // input carries no checksum (has_checksum === false) and is skipped. Kept
     // identical across securelock / trustedzone / validator so all three agree.
     async validateClientPayload(payload_data, input_data) {
-        await this.getDORequestMetadata();
+        // The order metadata comes from the chain; a transient RPC failure
+        // must end in a signed failure result the trustedzone can hand over,
+        // not in a task that produces nothing until the trustedzone times out.
+        const maxRetries = 5;
+        for (let attempt = 1; ; attempt++) {
+            try {
+                await this.getDORequestMetadata();
+                break;
+            } catch (e) {
+                if (attempt === maxRetries) {
+                    this.task_code = TaskStatus.SYSTEM_ERROR;
+                    this.task_result = `Failed to fetch metadata after ${maxRetries} attempts: ${e && e.message ? e.message : e}`;
+                    this.is_valid_client_data = false;
+                    return;
+                }
+            }
+        }
 
         const pmeta = this._metadata.payload_metadata_obj;
         if (pmeta.has_checksum) {
@@ -677,7 +697,11 @@ class EtnySecureLock {
     // Idempotent: the key is a pure function of the enclave identity, so it is
     // identical across restarts without needing to persist it.
     generateSelfSignedCertIfTestnet() {
-        if (NETWORK_TYPE !== "testnet") return;
+        // A testnet build with a ValidatorRegistry baked in is CAS-provisioned
+        // (ethernity-cas): its key and cert are injected into key_file and
+        // cert_file by the CAS session, exactly as on mainnet, and the same
+        // registry is what verifyCasAttestation checks the CAS against.
+        if (NETWORK_TYPE !== "testnet" || this.casProvisioned()) return;
         console.log("[SecureLock] TESTNET: self-signing certificate from MR_ENCLAVE (no CAS) [TESTNET-INSECURE]");
         const {privateKeyPem, certPem, mrEnclaveHex} = generateCertFromMrEnclave("SecureLock Enclave");
         console.log(`[SecureLock] MR_ENCLAVE: ${mrEnclaveHex}`);
@@ -689,9 +713,17 @@ class EtnySecureLock {
         fs.writeFileSync(this.cert_file, certPem);
     }
 
+    // Whether this build's certificate comes from a CAS session: mainnet, or a
+    // testnet with a ValidatorRegistry baked in.
+    casProvisioned() {
+        const registry = String(this.validator_registry_address || '');
+        return NETWORK_TYPE === "mainnet" || (registry !== '' && !registry.startsWith('__'));
+    }
+
     // The enclave's identity private key, in whatever form this network provides
-    // it: the in-memory PEM on testnet, or the CAS-injected key_file path on
-    // mainnet. etny_crypto accepts either, so callers do not branch on network.
+    // it: the in-memory PEM on a self-signing testnet, or the CAS-injected
+    // key_file path otherwise. etny_crypto accepts either, so callers do not
+    // branch on network.
     privateKeyMaterial() {
         return this.identity_private_key_pem || this.key_file;
     }
@@ -734,7 +766,7 @@ class EtnySecureLock {
                 || fs.readFileSync(this.key_file, 'utf8');
             const esrAddress = esr_wallet.deriveWalletAddress(identityPriv);
             console.log(`ESR_WALLET_ADDRESS: ${esrAddress}`);
-            if (!esr_wallet.isSecretIdentity(NETWORK_TYPE)) {
+            if (!esr_wallet.isSecretIdentity(NETWORK_TYPE, this.casProvisioned())) {
                 console.warn(esr_wallet.INSECURE_IDENTITY_WARNING);
             }
         } catch (e) {

package/nodenithy/build.mjs

@@ -1,6 +1,7 @@
 import shell from 'shelljs';
 import fs from 'fs';
 import path from 'path';
+import { createRequire } from 'module';
 import dotenv from 'dotenv';
 dotenv.config();
 
@@ -56,10 +57,11 @@ export const ECRunner = {
 // can verify the CAS that provisions it (ECAS_CAS_QUOTE self-attestation).
 // Build-side on purpose: a rogue CAS must not choose the registry that judges
 // it. Missing key = no registry on that network; the enclave skips the check.
-export const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0xC4Fcd83743b76fB3081328cFe354De89995eaECD',
-  'etny-nodenithy-testnet': '0xC4Fcd83743b76fB3081328cFe354De89995eaECD',
-};
+// Shared with publish (cas/config.js), which registers the session in the
+// matching SessionRegistry.
+const require = createRequire(import.meta.url);
+const casConfig = require('../cas/config.js');
+export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
 const runCommand = (command, canPass = false) => {
   if (shell.exec(command).code !== 0 && !canPass) {
@@ -247,12 +249,14 @@ const signedMrenclaveStep =
 
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 
-if (isMainnet) {
-  // Mainnet: production sign the executed node binary + bake the signed MRENCLAVE.
+// A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry)
+// is signed --production: the CAS session admits production enclaves only,
+// and a debug-signed one is refused at attestation.
+if (casConfig.casProvisioned(templateName, isMainnet)) {
   dockerfileSecureContent = dockerfileSecureContent
     .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
     .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+  if (isMainnet) imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
 } else {
   // Testnet: non-CAS self-sign path -- no --production sign and no signed
   // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).

package/nodenithy/run/etny-securelock-test.yaml.tpl

@@ -4,8 +4,13 @@ __PREDECESSOR__
 
 security:
   attestation:
-    tolerate: [hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]
-    ignore_advisories: ["INTEL-SA-00220", "INTEL-SA-00270", "INTEL-SA-00293", "INTEL-SA-00320", "INTEL-SA-00329", "INTEL-SA-00334", "INTEL-SA-00381", "INTEL-SA-00389", "INTEL-SA-00477", "INTEL-SA-00614", "INTEL-SA-00615", "INTEL-SA-00617", "INTEL-SA-00828"]
+    # Both substituted per network by run.js. Mainnet attests production
+    # enclaves only and lists the advisories it accepts; a testnet tolerates a
+    # debug-signed enclave and takes the wildcard ["*"], so an operator's
+    # platform is not refused for a TCB level that has no bearing on a test
+    # network.
+    tolerate: __TOLERATE__
+    ignore_advisories: __IGNORE_ADVISORIES__
 
 services:
    - name: application

package/nodenithy/run/image_registry.js

@@ -301,6 +301,15 @@ class ImageRegistry {
             console.log(public);
             return public;
         }
+        // The CAS session name recorded for the trustedzone template's latest
+        // image: what the compose's SCONE_CONFIG_ID for the trustedzone must name.
+        if (action === 'getTrustedZoneSession') {
+            const imageRegistry = new ImageRegistry();
+            const latest = await imageRegistry.imageRegistryContract.getLatestTrustedZoneImageCertPublicKey(projectName, version);
+            const session = await imageRegistry.imageRegistryContract.getTrustedZoneImageSession(latest[0]);
+            console.log(session);
+            return session;
+        }
 
         const imageRegistry = new ImageRegistry();
         if (action === 'registerSecureLockImage') {

package/nodenithy/run.js

@@ -5,6 +5,9 @@ const readline = require('readline');
 const forge = require('node-forge');
 const axios = require('axios');
 const https = require('https');
+const casConfig = require('../cas/config.js');
+const casResolver = require('../cas/resolver.js');
+const sessionRegistry = require('../cas/session_registry.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -58,6 +61,12 @@ const writeEnv = (key, value) => {
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
 const isMainnet = !templateName.includes('testnet');
+// A testnet template with a SessionRegistry is CAS-attested by the
+// ethernity-cas validator set: the session is registered on-chain, the
+// enclave is provisioned from a validator, and the certificate comes out of
+// the CAS session. Other testnets self-sign and register nothing.
+const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const casChain = casConfig.CHAIN[templateName] || {};
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -125,7 +134,7 @@ const main = async () => {
     // from the signed binary -- and a runtime recompute yields a DEBUG enclave
     // that CAS rejects ("Debug mode is enabled"). Refuse to publish rather than
     // register an untrusted identity on-chain or fail opaquely later.
-    if (isMainnet) {
+    if (isMainnet || casTestnet) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -155,9 +164,15 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        if (isMainnet) {
-            content = content.replace(", debug-mode", "").replace('ignore_advisories: ["INTEL-SA-00220", "INTEL-SA-00270", "INTEL-SA-00293", "INTEL-SA-00320", "INTEL-SA-00329", "INTEL-SA-00334", "INTEL-SA-00381", "INTEL-SA-00389", "INTEL-SA-00477", "INTEL-SA-00614", "INTEL-SA-00615", "INTEL-SA-00617", "INTEL-SA-00828"]', '');
-        }
+        // Mainnet attests production enclaves only; a testnet tolerates a
+        // debug-signed one. Both lines were edited by text replacement, which
+        // had to repeat the advisory list verbatim to delete it and broke the
+        // moment either string moved. Written out per network instead.
+        content = content
+            .replace(/__TOLERATE__/g, isMainnet
+                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
+                : '[hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]')
+            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
 
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -208,7 +223,25 @@ const main = async () => {
     };
     processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
 
-
+    // Where the session goes depends on who provisions the securelock. On a
+    // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
+    // SessionRegistry, which the validator set reads and which accepts no
+    // POST; the publish then waits until the validators serve it, because the
+    // public-key harvest below provisions the enclave from them. Every other
+    // network keeps the Scontain CAS registration that follows.
+    if (casTestnet) {
+        const registered = await sessionRegistry.register(
+            casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
+            process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
+            process.env.IPFS_ENDPOINT, '');
+        if (registered.registered) {
+            console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
+            await sessionRegistry.waitVisible(
+                casChain.rpcUrl, casConfig.SESSION_REGISTRY[templateName], registered.name, registered.hash);
+        } else {
+            console.log(`\t✔  Session ${registered.name} already registered on-chain with this body (${registered.hash})`);
+        }
+    } else {
     // don't generate new keys if PREDECESSOR_HASH_SECURELOCK is not empty and the key.pem and cert.pem files exist
     if (PREDECESSOR_HASH_SECURELOCK !== 'EMPTY' && fs.existsSync('key.pem') && fs.existsSync('cert.pem')) {
         console.log("Skipping keypair generation and certificate creation.");
@@ -322,6 +355,7 @@ const main = async () => {
             console.log("Please change the name/version of your project (using ecld-init or by editing .env file) and run the scripts again. Exiting.");
             process.exit(1);
         });
+    }
 
 
     // const ENCLAVE_NAME_TRUSTEDZONE = generateEnclaveName(process.env.ENCLAVE_NAME_TRUSTEDZONE);
@@ -356,6 +390,23 @@ const main = async () => {
 
     console.log("# Update docker-compose files");
 
+    // On a CAS-attested testnet the compose names the CAS both enclaves are
+    // provisioned from (a validator resolved from the registry, or
+    // ECLD_CAS_ADDR; the node re-resolves it before each task) and the
+    // trustedzone session the ImageRegistry records for this template.
+    let casAddr = null;
+    let trustedZoneSession = null;
+    if (casTestnet) {
+        casAddr = await casResolver.casAddressFor(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
+        console.log(`\t✔  CAS for this network: ${casAddr}`);
+        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneSession"`).toString().trim();
+        if (!trustedZoneSession) {
+            console.error(`ERROR! The ImageRegistry records no trustedzone session for ${templateName}.`);
+            process.exit(1);
+        }
+        console.log(`\t✔  Trustedzone session: ${trustedZoneSession}`);
+    }
+
     const files = ['docker-compose.yml', 'docker-compose-final.yml'];
 
     files.forEach(file => {
@@ -385,9 +436,15 @@ const main = async () => {
         if (isMainnet) {
             ENCLAVE_NAME_TRUSTEDZONE = 'ecld-nodenithy-trustedzone-v3-3.0.0'
         }
-        const updatedContent = fileContentBefore
+        if (casTestnet) {
+            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
+        }
+        let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
+        if (casTestnet) {
+            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${casAddr}`);
+        }
 
         fs.writeFileSync(file, updatedContent, 'utf8');
 
@@ -596,6 +653,14 @@ const main = async () => {
     if (!existing) {
         const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
     }
+    // The on-chain session points at the image it admits, so a validator can
+    // pin the image beside the body it serves.
+    if (casTestnet) {
+        await sessionRegistry.linkImage(
+            casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
+            process.env.PRIVATE_KEY, ENCLAVE_NAME_SECURELOCK, process.env.IPFS_HASH);
+        console.log(`\t✔  Session ${ENCLAVE_NAME_SECURELOCK} linked to image ${process.env.IPFS_HASH}`);
+    }
     console.log("Script completed successfully. You can start testing the application now. (eg. npm run start)");
     process.exit(0);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.5.19",
+  "version": "1.6.0",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
@@ -23,6 +23,7 @@
   "files": [
     "nodenithy/*",
     "pynithy/*",
+    "cas/*",
     "build.js",
     "init.js",
     "publish.js",

package/pynithy/build/securelock/src/securelock.py.tmpl

@@ -214,17 +214,25 @@ class EtnySecureLock:
         itself. /onion3 is preferred, then the rest, matching the node-side
         resolver. Returns REST base URLs.
         """
-        vr_abi = [
+        # Endpoints live in the CasKeyStore the registry names via keyStore();
+        # the registry's own forwarders were removed when it reached the
+        # EIP-170 size limit.
+        registry_abi = [
+            {"name": "keyStore", "type": "function", "stateMutability": "view",
+             "inputs": [], "outputs": [{"type": "address"}]},
+        ]
+        store_abi = [
             {"name": "multiaddrsOf", "type": "function", "stateMutability": "view",
              "inputs": [{"type": "address"}], "outputs": [{"type": "string[]"}]},
         ]
-        vr = self.w3.eth.contract(
-            address=self.w3.toChecksumAddress(self.validator_registry_address),
-            abi=vr_abi)
         try:
-            mas = vr.caller().multiaddrsOf(self.w3.toChecksumAddress(cas_address))
+            vr = self.w3.eth.contract(
+                address=self.w3.toChecksumAddress(self.validator_registry_address),
+                abi=registry_abi)
+            store = self.w3.eth.contract(address=vr.caller().keyStore(), abi=store_abi)
+            mas = store.caller().multiaddrsOf(self.w3.toChecksumAddress(cas_address))
         except Exception as e:
-            print(f'CAS attestation: multiaddrsOf failed: {e}')
+            print(f'CAS attestation: reading the CAS endpoints from chain failed: {e}')
             return []
         onion, rest = [], []
         for ma in mas:
@@ -378,13 +386,17 @@ class EtnySecureLock:
         vr_abi = [
             {"name": "isValidator", "type": "function", "stateMutability": "view",
              "inputs": [{"type": "address"}], "outputs": [{"type": "bool"}]},
+            # The registry's Validator struct: the measurement is `bytes` at
+            # its platform width (32 for SGX MRENCLAVE), not bytes32.
             {"name": "validators", "type": "function", "stateMutability": "view",
              "inputs": [{"type": "address"}],
-             "outputs": [{"name": "mrenclave", "type": "bytes32"},
+             "outputs": [{"name": "measurement", "type": "bytes"},
                          {"name": "certHash", "type": "bytes32"},
                          {"name": "active", "type": "bool"},
                          {"name": "admittedBlock", "type": "uint64"},
-                         {"name": "lastVoteBlock", "type": "uint64"}]},
+                         {"name": "lastVoteBlock", "type": "uint64"},
+                         {"name": "teeType", "type": "uint16"},
+                         {"name": "operator", "type": "address"}]},
         ]
         last_err = None
         cas_address, bound_cert, active, record = None, None, False, None

package/pynithy/build.mjs

@@ -1,6 +1,7 @@
 import shell from 'shelljs';
 import fs from 'fs';
 import path from 'path';
+import { createRequire } from 'module';
 import dotenv from 'dotenv';
 dotenv.config();
 
@@ -56,10 +57,11 @@ export const ECRunner = {
 // can verify the CAS that provisions it (ECAS_CAS_QUOTE self-attestation).
 // Build-side on purpose: a rogue CAS must not choose the registry that judges
 // it. Missing key = no registry on that network; the enclave skips the check.
-export const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0xC4Fcd83743b76fB3081328cFe354De89995eaECD',
-  'etny-nodenithy-testnet': '0xC4Fcd83743b76fB3081328cFe354De89995eaECD',
-};
+// Shared with publish (cas/config.js), which registers the session in the
+// matching SessionRegistry.
+const require = createRequire(import.meta.url);
+const casConfig = require('../cas/config.js');
+export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
 const runCommand = (command, canPass = false) => {
   if (shell.exec(command).code !== 0 && !canPass) {
@@ -155,11 +157,14 @@ const signedMrenclaveStep =
 
 let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
 
-if (isMainnet) {
+// A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry)
+// is signed --production: the CAS session admits production enclaves only,
+// and a debug-signed one is refused at attestation.
+if (casConfig.casProvisioned(templateName, isMainnet)) {
   dockerfileSecureContent = dockerfileSecureContent
     .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/python`)
     .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
-  imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
+  if (isMainnet) imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
 } else {
   dockerfileSecureContent = dockerfileSecureContent
     .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')

package/pynithy/run/etny-securelock-test.yaml.tpl

@@ -4,8 +4,14 @@ __PREDECESSOR__
 
 security:
   attestation:
-    tolerate: [debug-mode, hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]
-    ignore_advisories: "*"
+    # Both substituted per network by run.js. Mainnet attests production
+    # enclaves only and lists the advisories it accepts; a testnet tolerates a
+    # debug-signed enclave and takes the wildcard ["*"], so an operator's
+    # platform is not refused for a TCB level that has no bearing on a test
+    # network. (A bare "*" is not a list: the CAS reads it as a literal
+    # advisory id, which ignores nothing.)
+    tolerate: __TOLERATE__
+    ignore_advisories: __IGNORE_ADVISORIES__
 
 services:
    - name: application

package/pynithy/run/image_registry.js

@@ -301,6 +301,15 @@ class ImageRegistry {
             console.log(public);
             return public;
         }
+        // The CAS session name recorded for the trustedzone template's latest
+        // image: what the compose's SCONE_CONFIG_ID for the trustedzone must name.
+        if (action === 'getTrustedZoneSession') {
+            const imageRegistry = new ImageRegistry();
+            const latest = await imageRegistry.imageRegistryContract.getLatestTrustedZoneImageCertPublicKey(projectName, version);
+            const session = await imageRegistry.imageRegistryContract.getTrustedZoneImageSession(latest[0]);
+            console.log(session);
+            return session;
+        }
 
         const imageRegistry = new ImageRegistry();
         if (action === 'registerSecureLockImage') {

package/pynithy/run.js

@@ -5,6 +5,9 @@ const readline = require('readline');
 const forge = require('node-forge');
 const axios = require('axios');
 const https = require('https');
+const casConfig = require('../cas/config.js');
+const casResolver = require('../cas/resolver.js');
+const sessionRegistry = require('../cas/session_registry.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -58,6 +61,12 @@ const writeEnv = (key, value) => {
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-pynithy-testnet';
 
 const isMainnet = !templateName.includes('testnet');
+// A testnet template with a SessionRegistry is CAS-attested by the
+// ethernity-cas validator set: the session is registered on-chain, the
+// enclave is provisioned from a validator, and the certificate comes out of
+// the CAS session. Other testnets self-sign and register nothing.
+const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const casChain = casConfig.CHAIN[templateName] || {};
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -121,7 +130,7 @@ const main = async () => {
     // MRENCLAVE signed --production at build time (/signed_mrenclave.txt). A
     // mismatch means SCONE recomputed the measurement at load (params drift) and
     // re-signed as DEBUG, which CAS rejects on mainnet. Refuse to publish.
-    if (isMainnet) {
+    if (isMainnet || casTestnet) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -151,9 +160,16 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        if (isMainnet) {
-            content = content.replace(", debug-mode", "");
-        }
+        // Mainnet attests production enclaves only; a testnet tolerates a
+        // debug-signed one. The tolerate list was edited by text replacement
+        // ('", debug-mode"'), which never matched this template's LEADING
+        // "debug-mode," -- so mainnet sessions were published tolerating debug
+        // enclaves. Written out per network instead.
+        content = content
+            .replace(/__TOLERATE__/g, isMainnet
+                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
+                : '[debug-mode, hyperthreading, outdated-tcb, software-hardening-needed]')
+            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
 
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -204,7 +220,25 @@ const main = async () => {
     };
     processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
 
-
+    // Where the session goes depends on who provisions the securelock. On a
+    // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
+    // SessionRegistry, which the validator set reads and which accepts no
+    // POST; the publish then waits until the validators serve it, because the
+    // public-key harvest below provisions the enclave from them. Every other
+    // network keeps the Scontain CAS registration that follows.
+    if (casTestnet) {
+        const registered = await sessionRegistry.register(
+            casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
+            process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
+            process.env.IPFS_ENDPOINT, '');
+        if (registered.registered) {
+            console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
+            await sessionRegistry.waitVisible(
+                casChain.rpcUrl, casConfig.SESSION_REGISTRY[templateName], registered.name, registered.hash);
+        } else {
+            console.log(`\t✔  Session ${registered.name} already registered on-chain with this body (${registered.hash})`);
+        }
+    } else {
     // don't generate new keys if PREDECESSOR_HASH_SECURELOCK is not empty and the key.pem and cert.pem files exist
     if (PREDECESSOR_HASH_SECURELOCK !== 'EMPTY' && fs.existsSync('key.pem') && fs.existsSync('cert.pem')) {
         console.log("Skipping key pair generation and certificate creation.");
@@ -318,6 +352,7 @@ const main = async () => {
             console.log("Please change the name/version of your project (using ecld-init or by editing .env file) and run the scripts again. Exiting.");
             process.exit(1);
         });
+    }
 
 
     // const ENCLAVE_NAME_TRUSTEDZONE = generateEnclaveName(process.env.ENCLAVE_NAME_TRUSTEDZONE);
@@ -352,6 +387,23 @@ const main = async () => {
 
     console.log("# Update docker-compose files");
 
+    // On a CAS-attested testnet the compose names the CAS both enclaves are
+    // provisioned from (a validator resolved from the registry, or
+    // ECLD_CAS_ADDR; the node re-resolves it before each task) and the
+    // trustedzone session the ImageRegistry records for this template.
+    let casAddr = null;
+    let trustedZoneSession = null;
+    if (casTestnet) {
+        casAddr = await casResolver.casAddressFor(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
+        console.log(`\t✔  CAS for this network: ${casAddr}`);
+        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneSession"`).toString().trim();
+        if (!trustedZoneSession) {
+            console.error(`ERROR! The ImageRegistry records no trustedzone session for ${templateName}.`);
+            process.exit(1);
+        }
+        console.log(`\t✔  Trustedzone session: ${trustedZoneSession}`);
+    }
+
     const files = ['docker-compose.yml', 'docker-compose-final.yml'];
 
     files.forEach(file => {
@@ -381,9 +433,15 @@ const main = async () => {
         if (isMainnet) {
             ENCLAVE_NAME_TRUSTEDZONE = 'ecld-pynithy-trustedzone-v3-3.0.0'
         }
-        const updatedContent = fileContentBefore
+        if (casTestnet) {
+            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
+        }
+        let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
+        if (casTestnet) {
+            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${casAddr}`);
+        }
 
         fs.writeFileSync(file, updatedContent, 'utf8');
 
@@ -570,6 +628,14 @@ const main = async () => {
     if (!existing) {
         const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
     }
+    // The on-chain session points at the image it admits, so a validator can
+    // pin the image beside the body it serves.
+    if (casTestnet) {
+        await sessionRegistry.linkImage(
+            casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
+            process.env.PRIVATE_KEY, ENCLAVE_NAME_SECURELOCK, process.env.IPFS_HASH);
+        console.log(`\t✔  Session ${ENCLAVE_NAME_SECURELOCK} linked to image ${process.env.IPFS_HASH}`);
+    }
     console.log("Script completed successfully. You can start testing the application now. (eg. npm run start)");
     process.exit(0);
 };