@ethernity-cloud/sdk-js 1.6.1 → 1.7.0

package/init.js

@@ -2,6 +2,7 @@ const fs = require("fs");
 const readline = require("readline");
 const { spawn, execSync } = require("child_process");
 const path = require("path");
+const casConfig = require("./cas/config.js");
 
 const rl = readline.createInterface({
   input: process.stdin,
@@ -179,6 +180,8 @@ const main = async () => {
     "IoTeX Testnet",
     "Ethereum Sepolia",
     "LitVM LiteForge",
+    "Bloxberg Testnet Unsafe",
+    "LitVM LiteForge Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -186,9 +189,20 @@ const main = async () => {
     "Bloxberg Testnet",
   );
   console.log();
+  const network = blockchainNetwork.replace(/ /g, "_");
+  if (casConfig.isUnsafeNetwork(network)) {
+    const sibling = casConfig.UNSAFE_NETWORKS[network].replace(/_/g, " ");
+    console.log(`${blockchainNetwork} runs your dApp WITHOUT a CAS, on the chain and contracts of ${sibling},`);
+    console.log("for SGX platforms the CAS cannot attest (EPID-only, SGX1). Its enclaves are debug-signed and");
+    console.log("sign their own certificates from their measurement: a result proves which image ran, not that");
+    console.log(`an enclave ran it. The securelock is registered as <project>-unsafe; choose ${sibling} for`);
+    console.log("a CAS-attested run.");
+    console.log();
+  }
+  const imageName = casConfig.nameOnNetwork(projectName.replace(/ /g, "-"), network);
 
   console.log(
-    `Checking if the project name (image name) is available on the ${blockchainNetwork.replace(/ /g, "_")} network and ownership...`,
+    `Checking if the project name (image name ${imageName}) is available on the ${network} network and ownership...`,
   );
   // const { execSync } = require('child_process');
   // execSync(`python $(pwd)/node_modules/@ethernity-cloud/sdk-js/nodenithy/run/image_registry.py "${blockchainNetwork.replace(/ /g, "_")}" "${projectName.replace(/ /g, "-")}" v3`);
@@ -198,8 +212,8 @@ const main = async () => {
     new Promise((resolve, reject) => {
       const child = spawn("node", [
         scriptPath,
-        blockchainNetwork.replace(/ /g, "_"),
-        projectName.replace(/ /g, "-"),
+        network,
+        imageName,
         "v3",
       ]);
       // Handle stdout data
@@ -342,12 +356,14 @@ const main = async () => {
     "IoTeX Testnet": `ecld-${svc}-iotex-testnet`,
     "Ethereum Sepolia": `ecld-${svc}-ethereum-sepolia`,
     "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
+    "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
+    "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);
 
 
-  writeEnv("BLOCKCHAIN_NETWORK", blockchainNetwork.replace(/ /g, "_"));
+  writeEnv("BLOCKCHAIN_NETWORK", network);
   writeEnv("IPFS_ENDPOINT", customUrl);
   console.log();
   await configureEsr();

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -1,20 +1,35 @@
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production as release
+# SCONE_NODE (build.mjs passes it) is the nodenithy trustedzone image this
+# securelock is bundled with: node:22-alpine with the SCONE 6.0.7 runtime and
+# CLI (sconecuratedimages/node:node-22-alpine, the base the etny-nodenithy CI
+# builds the trustedzones on), the release the trustedzones, the LAS and the
+# CAS run. Its own enclave is replaced below: /lib/libbinary-fs.so is
+# overwritten and /usr/local/bin/node re-signed.
+ARG SCONE_NODE
+
+# The dependencies are plain JavaScript, installed with a stock node of the
+# same major version; no SCONE binary runs at build time.
+FROM node:22-alpine AS deps
 
-RUN apk update
-
-RUN cd /
+COPY ./src /etny-securelock/
+WORKDIR /etny-securelock
+RUN npm install
 
-RUN apk add bash
+FROM ${SCONE_NODE} AS release
 
-ENV SCONE_HEAP=256M
+# As in the runtime release stage: the scone CLI below runs on a build host
+# without SGX.
+ENV SCONE_MODE=SIM
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
+# "mainnet" or "testnet": the securelock self-signs from MR_ENCLAVE on a
+# testnet without a ValidatorRegistry, and takes its certificate from the CAS
+# otherwise.
+ENV NETWORK_TYPE=__NETWORK_TYPE__
 ENV BUCKET_NAME=__BUCKET_NAME__
 ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
 ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
 ENV RPC_URL=__RPC_URL__
 ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
 ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # ESR (RFC §5.4): rendered by build.mjs to `ENV ESR_CONTRACT_ADDRESS=0x...` only
 # when ESR is enabled, and to nothing otherwise -- so non-ESR images keep exactly
@@ -22,36 +37,25 @@ ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # gates all ESR behaviour on this variable being non-empty.
 __ESR_ENV__
 
-RUN mkdir binary-fs-dir
+RUN mkdir /binary-fs-dir
 
-COPY ./src /etny-securelock/
+COPY --from=deps /etny-securelock /etny-securelock/
 COPY scripts/* /etny-securelock/
 
-WORKDIR /etny-securelock
-RUN pwd
-RUN npm install
-RUN ls
-
 WORKDIR /
 
 RUN ["chmod", "+x", "etny-securelock/binary-fs-build.sh"]
 RUN etny-securelock/binary-fs-build.sh
 
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers as build
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 as build
 
 COPY --from=release /binary-fs-dir /.
 
 RUN scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
 
-#
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production
+FROM ${SCONE_NODE}
 
 COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
-#
-
-RUN apk update
-
-RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
@@ -64,24 +68,22 @@ ENV SCONE_HEAP=1024M
 ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+ENV SCONE_LOG=DEBUG
 
 # Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
 # ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
-# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
-# self-sign). On testnet builds this line is a no-op comment.
+# A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry) is
+# signed --production; a self-signing testnet one is signed debug.
 __SCONE_SIGN__
 
-# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
-# measurement matches what was signed BEFORE registering the CAS session /
-# publishing. A mismatch means SCONE recomputed the enclave at load (params
-# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
-# for --production (mainnet) signs; on testnet the file is absent and the check
-# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert, for a
+# CAS-provisioned securelock, that the runtime enclave measurement matches what
+# was signed BEFORE registering the CAS session. A mismatch means SCONE
+# recomputed the enclave at load (params drift) => debug re-sign => the CAS
+# rejects it. Capture to a file first: piping scone-signer into `head` kills it
 # with SIGPIPE (exit 141) under buildkit's pipefail shell.
 __SIGNED_MRENCLAVE__
 
 RUN rm -rf /enclave-key.pem
 
-#RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer
-RUN ls /usr/local/bin
 ENTRYPOINT ["/usr/local/bin/node", "/etny-securelock/securelock.js"]

package/nodenithy/build/securelock/scripts/binary-fs-build.sh

@@ -7,12 +7,13 @@ cat .env
 echo "####################"
 
 cat securelock.js.tmpl | sed  s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > securelock.js.tmp
-sed -i "s/__BUCKET_NAME__/${BUCKET_NAME}/g" securelock.js.tmp
-sed -i "s/__SMART_CONTRACT_ADDRESS__/${SMART_CONTRACT_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.js.tmp
-sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.js.tmp
-sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.js.tmp
+# "|" delimits: the RPC URL contains "/".
+sed -i "s|__ETNY_NETWORK_TYPE__|${NETWORK_TYPE}|g" securelock.js.tmp
+sed -i "s|__ETNY_BUCKET__|${BUCKET_NAME}|g" securelock.js.tmp
+sed -i "s|__ETNY_SMART_CONTRACT_ADDRESS__|${SMART_CONTRACT_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_IMAGE_REGISTRY_ADDRESS__|${IMAGE_REGISTRY_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_WEB3_PROVIDER__|${RPC_URL}|g" securelock.js.tmp
+sed -i "s|__ETNY_CHAIN_ID__|${CHAIN_ID}|g" securelock.js.tmp
 # ethernity-cas ValidatorRegistry for CAS self-attestation. Deliberately NOT
 # overridable from the runtime environment (unlike the addresses above): the
 # session env comes from the CAS itself, and a rogue CAS must not get to

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -133,8 +133,11 @@ class EtnySecureLock {
             let host = parts[1];
             const port = parseInt(parts[3], 10);
             if (!Number.isInteger(port)) continue;
-            // REST pairing convention: rest = 8081 + (enclave - 18765)
-            const restPort = (port >= 18765 && port < 18965) ? 8081 + (port - 18765) : 8081;
+            // REST pairing convention: a CAS publishes its enclave port only,
+            // and its REST port sits at the same offset from the in-container
+            // pair 18765/8081 (19768 -> 9084).
+            const restPort = 8081 + (port - 18765);
+            if (restPort < 1 || restPort > 65535) continue;
             if (kind === 'onion3') {
                 if (!host.endsWith('.onion')) host += '.onion';
                 onion.push(`http://${host}:${restPort}`);

package/nodenithy/build.mjs

@@ -31,9 +31,9 @@ const writeEnv = (key, value) => {
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml (the authoritative
 // on-chain constants). Covers all supported networks for both dApp types.
 export const ECRunner = {
-  // --- bloxberg ---
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
+  // --- bloxberg (the testnet reads ECImageRegistryV2, mainnet the original) ---
+  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   // --- polygon mainnet ---
@@ -50,7 +50,12 @@ export const ECRunner = {
   'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
   'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
+  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  // --- the -unsafe networks: the contracts of the network each is named after ---
+  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 // ethernity-cas ValidatorRegistry per template, baked into the enclave so it
@@ -63,6 +68,19 @@ const require = createRequire(import.meta.url);
 const casConfig = require('../cas/config.js');
 export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
+// An -unsafe network runs an -unsafe trustedzone and nothing else, and an
+// -unsafe trustedzone runs on no other network: the runner and the node refuse
+// either mismatch, so the build does too.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+if (unsafe !== String(process.env.TRUSTED_ZONE_IMAGE || '').endsWith('-unsafe')) {
+  console.error(`ERROR: TRUSTED_ZONE_IMAGE=${process.env.TRUSTED_ZONE_IMAGE} does not run on BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}.`);
+  console.error(unsafe
+    ? '       An -unsafe network runs only a trustedzone whose name ends in -unsafe.'
+    : '       A trustedzone whose name ends in -unsafe runs only on an -unsafe network.');
+  console.error('       Run ecld-init to choose the network again.');
+  process.exit(1);
+}
+
 const runCommand = (command, canPass = false) => {
   if (shell.exec(command).code !== 0 && !canPass) {
     console.error(`Error executing command: ${command}`);
@@ -70,25 +88,22 @@ const runCommand = (command, canPass = false) => {
   }
 };
 
+// Removes the containers this build and publish create, matched by exact name:
+// `--filter name=` matches a substring, so name=las would also match the LAS of
+// a CAS validator set on the same host.
+const removeContainer = (name) => {
+  const ids = shell.exec(`docker ps -a -q --filter "name=^/${name}$"`, { silent: true }).stdout.trim();
+  if (ids) {
+    runCommand(`docker rm -f ${ids.split('\n').join(' ')}`);
+  }
+};
+
 // Downloading dependencies
 shell.rm('-rf', './registry');
 const currentDir = process.cwd();
-// console.log(`current_dir: ${currentDir}`);
 const buildDir = path.join(currentDir, 'node_modules/@ethernity-cloud/sdk-js/nodenithy/build');
-// console.log(`build_dir: ${buildDir}`);
 
-const dockerPS = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerPS) {
-  runCommand(`docker stop ${dockerPS.split('\n').join(' ')}`);
-}
-const dockeri = shell.exec('docker ps --filter name=las -q', { silent: true }).stdout.trim();
-if (dockeri) {
-  runCommand(`docker stop ${dockeri.split('\n').join(' ')}`);
-}
-const dockerRm = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerRm) {
-  runCommand(`docker rm ${dockerRm.split('\n').join(' ')} -f`);
-}
+['registry', 'las', 'etny-securelock', 'etny-trustedzone', 'etny-swift-stream'].forEach(removeContainer);
 const dockerImg = shell.exec('docker images --filter reference="*etny*" -q', { silent: true }).stdout.trim();
 if (dockerImg) {
   runCommand(`docker rmi ${dockerImg.split('\n').join(' ')} -f`);
@@ -97,7 +112,6 @@ const dockerImgReg = shell.exec('docker images --filter reference="*registry*" -
 if (dockerImgReg) {
   runCommand(`docker rmi ${dockerImgReg.split('\n').join(' ')} -f`);
 }
-runCommand(`docker rm registry -f`);
 
 
 
@@ -168,7 +182,7 @@ process.chdir(buildDir);
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
 
 const ENCLAVE_NAME_TRUSTEDZONE = templateName;
 
@@ -178,10 +192,37 @@ runCommand('docker run -d --restart=always -p 5000:5000 --name registry registry
 
 // const CI_COMMIT_BRANCH = process.env.PROJECT_NAME;
 // aleXPRoj-securelock-v3-testnet-0.1.0...
-const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${process.env.BLOCKCHAIN_NETWORK.split('_')[1].toLowerCase()}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
+const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${casConfig.sessionTag(process.env.BLOCKCHAIN_NETWORK)}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
 console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
 writeEnv('ENCLAVE_NAME_SECURELOCK', ENCLAVE_NAME_SECURELOCK);
 
+// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
+// registers it on-chain, and publishes that exact image to the ethernity registry
+// under <image_name>/trustedzone:<network>, with image_name and network the keys
+// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
+// anything else would pair the securelock with a trustedzone whose key does not
+// match the on-chain cert, so a failed pull fails the build.
+const trustedZoneNetByBlockchain = {
+  Bloxberg_Mainnet: 'bloxberg',
+  Bloxberg_Testnet: 'bloxberg_testnet',
+  Polygon_Mainnet: 'polygon',
+  Polygon_Amoy_Testnet: 'amoy',
+  IoTeX_Testnet: 'iotex_testnet',
+  Ethereum_Sepolia: 'ethereum_sepolia',
+  LitVM_LiteForge: 'litvm_liteforge',
+  Bloxberg_Testnet_Unsafe: 'bloxberg_testnet_unsafe',
+  LitVM_LiteForge_Unsafe: 'litvm_liteforge_unsafe',
+};
+const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
+if (!trustedZoneNet) {
+  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
+  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
+  process.exit(1);
+}
+const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
+console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
+runCommand(`docker pull ${trustedZoneImage}`);
+
 console.log('Building etny-securelock');
 process.chdir('securelock');
 
@@ -217,7 +258,7 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
 // Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
 // run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
@@ -247,74 +288,45 @@ const signedMrenclaveStep =
   '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
   '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
-let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
-
 // A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry)
 // is signed --production: the CAS session admits production enclaves only,
-// and a debug-signed one is refused at attestation.
-if (casConfig.casProvisioned(templateName, isMainnet)) {
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
-    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
-  if (isMainnet) imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
-} else {
-  // Testnet: non-CAS self-sign path -- no --production sign and no signed
-  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
-    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
-}
+// and a debug-signed one is refused at attestation. A self-signing testnet
+// securelock is signed debug with the same explicit params.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+dockerfileSecureContent = dockerfileSecureContent
+  .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags}${cas ? ' --production' : ''} /usr/local/bin/node`)
+  .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
 
 fs.writeFileSync('Dockerfile', dockerfileSecureContent);
 
 
 
 
-runCommand(`docker build --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
+// The trustedzone image is also the securelock's SCONE node (Dockerfile.tmpl,
+// SCONE_NODE).
+runCommand(`docker build --build-arg SCONE_NODE=${trustedZoneImage} --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
 runCommand('docker tag etny-securelock localhost:5000/etny-securelock');
 runCommand('docker push localhost:5000/etny-securelock');
-// runCommand('docker save etny-securelock:latest -o etny-securelock.tar');
 process.chdir('..');
 
 console.log(`ENCLAVE_NAME_TRUSTEDZONE: ${ENCLAVE_NAME_TRUSTEDZONE}`);
 writeEnv('ENCLAVE_NAME_TRUSTEDZONE', ENCLAVE_NAME_TRUSTEDZONE);
 
-// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
-// registers it on-chain, and publishes that exact image to the ethernity registry
-// under <image_name>/trustedzone:<network>, with image_name and network the keys
-// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
-// anything else would pair the securelock with a trustedzone whose key does not
-// match the on-chain cert, so a failed pull fails the build.
-const trustedZoneNetByBlockchain = {
-  Bloxberg_Mainnet: 'bloxberg',
-  Bloxberg_Testnet: 'bloxberg_testnet',
-  Polygon_Mainnet: 'polygon',
-  Polygon_Amoy_Testnet: 'amoy',
-  IoTeX_Testnet: 'iotex_testnet',
-  Ethereum_Sepolia: 'ethereum_sepolia',
-  LitVM_LiteForge: 'litvm_liteforge',
-};
-const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
-if (!trustedZoneNet) {
-  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
-  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
-  process.exit(1);
-}
-const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
-console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
-runCommand(`docker pull ${trustedZoneImage}`);
 runCommand(`docker tag ${trustedZoneImage} localhost:5000/etny-trustedzone`);
 runCommand('docker push localhost:5000/etny-trustedzone');
 
 
-console.log('Building etny-las');
-process.chdir('las');
-// runCommand('docker build -t etny-las .');
-// runCommand('docker tag etny-las localhost:5000/etny-las');
-// runCommand('docker push localhost:5000/etny-las');
-runCommand(`docker pull registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag}`);
-runCommand(`docker tag registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag} localhost:5000/etny-las`);
-runCommand('docker push localhost:5000/etny-las');
+// Every network but an -unsafe one runs a LAS beside the enclaves: the SCONE
+// 6.0.7 LAS the trustedzones are built and attested with (etny-nodenithy
+// v3/build/las). An -unsafe network's compose carries none, and its bundle
+// none either.
+if (!unsafe) {
+  const lasImage = 'registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/las:scone6.0.7';
+  console.log('Pulling etny-las');
+  runCommand(`docker pull ${lasImage}`);
+  runCommand(`docker tag ${lasImage} localhost:5000/etny-las`);
+  runCommand('docker push localhost:5000/etny-las');
+}
 
 
 process.chdir(currentDir);

package/nodenithy/run/docker-compose-final.yml.tmpl

@@ -1,25 +1,30 @@
+# The compose a node runs for this dApp; its SCONE_* values match
+# docker-compose.yml.tmpl, which measured the securelock at publish. Tagged
+# lines are kept, untagged, only where they apply (cas/config.js
+# renderCompose): __CAS_ONLY__ serves CAS attestation, and __SAFE_ONLY__ is the
+# LAS, which every network but an -unsafe one runs.
 version: '3.2'
 services:
-  las:
-    container_name: las
-    privileged: true
-    image: localhost:5000/etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1, so it
-    # crash-loops and every task on that node times out with no attestation.
-    # The enclaves reach it over IPv4 either way.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    restart: on-failure
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
+  las:  # __SAFE_ONLY__
+    container_name: las  # __SAFE_ONLY__
+    privileged: true  # __SAFE_ONLY__
+    image: localhost:5000/etny-las  # __SAFE_ONLY__
+    entrypoint: "/las_entrypoint.sh"  # __SAFE_ONLY__
+    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot  # __SAFE_ONLY__
+    # allocate the socket on a host booted with ipv6.disable=1, so it  # __SAFE_ONLY__
+    # crash-loops and every task on that node times out with no attestation.  # __SAFE_ONLY__
+    # The enclaves reach it over IPv4 either way.  # __SAFE_ONLY__
+    command: "/usr/local/bin/las -a 0.0.0.0"  # __SAFE_ONLY__
+    networks:  # __SAFE_ONLY__
+      - ethernity  # __SAFE_ONLY__
+    devices:  # __SAFE_ONLY__
+      - "/dev/sgx_enclave:/dev/sgx_enclave"  # __SAFE_ONLY__
+    restart: on-failure  # __SAFE_ONLY__
+    ports:  # __SAFE_ONLY__
+      - target: 18766  # __SAFE_ONLY__
+        published: 18766  # __SAFE_ONLY__
+        protocol: tcp  # __SAFE_ONLY__
+        mode: host  # __SAFE_ONLY__
 
   etny-securelock:
     container_name: etny-securelock
@@ -28,9 +33,9 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
       - SCONE_HEAP=1024M
       # Must match the --stack the securelock binary was signed with (build.mjs),
       # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
@@ -43,8 +48,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 
   etny-trustedzone:
     container_name: etny-trustedzone
@@ -53,10 +58,10 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application
-      - SCONE_HEAP=256M
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
+      - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
@@ -65,8 +70,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 networks:
   ethernity:
     external: true