@ethernity-cloud/sdk-js 1.6.2 → 1.7.0

package/README.md

@@ -47,13 +47,48 @@ The sdk has been tested on the following operating systems:
       for the compose and the certificate harvest, takes the trustedzone
       session name from the ImageRegistry (ECImageRegistryV2,
       `0x99A84C62...`), and links the session to the published image. `ecld-build` signs the securelock `--production`.
-      Harvesting the certificate needs SGX. The other testnets have no CAS
-      deployment and self-sign from MR_ENCLAVE as before.
+      Harvesting the certificate needs SGX.
+    - Testnet Unsafe - the unsafe network beside the testnet (see below).
     - Mainnet - to be provided during the following updates
+- LitVM:
+    - LiteForge - CAS-attested the same way, by LitVM's own ethernity-cas
+      validator set (SessionRegistry `0x8ad24b3F...`, ValidatorRegistry
+      `0x2E27677f...`).
+    - LiteForge Unsafe - the unsafe network beside LiteForge (see below).
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates
     - Mainnet - to be provided during the following updates
 
+The remaining testnets (Amoy, IoTeX, Sepolia) have no ethernity-cas
+deployment: their enclaves are debug-signed and sign their own certificates
+from their measurement, and `ecld-publish` registers no CAS session for them.
+
+### The testnets and their unsafe networks
+`Bloxberg Testnet` and `LitVM LiteForge` run your securelock in an enclave
+attested through that chain's ethernity-cas validator set, on nodes whose
+platform the CAS can attest (DCAP). Each has an unsafe network beside it,
+`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`) and `LitVM LiteForge
+Unsafe` (`LitVM_LiteForge_Unsafe`): the same chain and contracts, for hardware
+SGX platforms the CAS cannot attest (EPID-only, SGX1). No CAS and no LAS: the
+enclaves are debug-signed and sign their own certificates from their
+measurement, so a result proves which image ran but not that an enclave ran
+it. You choose an unsafe network by name in `ecld-init`, and the runner runs an
+`-unsafe` trustedzone on nothing else, so a dApp that runs without a CAS
+always says so in the network it names. A dApp publishes one securelock per
+network from two project directories with the same project name: the unsafe
+one is registered as `<project>-unsafe` and runs on the
+`etny-<nodenithy|pynithy>-testnet-unsafe`
+(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`) trustedzone. Both dApp types
+build for both networks. Mainnet has no unsafe network.
+
+### Pynithy dApps
+The Pynithy securelock is built exactly as `ethernity-cloud-sdk-py` builds it
+(`pynithy/build/securelock` is its copy): a SCONE 6.0.7 Python 3.14 enclave
+your backend is frozen into. `src/serverless/requirements.txt` lists the
+Python packages your backend imports, and `src/serverless/Dockerfile.serverless`
+adds system packages to the securelock base image. `ECLD_MEMORY_TO_ALLOCATE`
+sets the enclave heap (default `1024M`).
+
 ### Scripts
 
 - **Initialize**: To initialize the project, run:
@@ -97,6 +132,7 @@ The sdk has been tested on the following operating systems:
   npx ecld-run --file payload.js
   npx ecld-run --input data.json 'processData(___etny_data_set___)'
   npx ecld-run --json 'esrIncrement()'
+  npx ecld-run --unsafe 'hello("World")'
   ```
   This is the network-side sibling of `ecld-test`: instead of executing locally
   it drives the runner end to end — encrypt → IPFS → on-chain request → wait for
@@ -106,7 +142,9 @@ The sdk has been tested on the following operating systems:
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
-  Exit code 0 on a `SUCCESS` task result, 1 otherwise.
+  Exit code 0 on a `SUCCESS` task result, 1 otherwise. `--unsafe` runs the
+  network's unsafe variant; on an unsafe network the securelock and
+  trustedzone default to their `-unsafe` names.
 
 - **Inspect (read-only)**: To read enclave and on-chain diagnostics — network,
   trustedzone/securelock registration, and ESR state — without spending gas, run:

package/cas/config.js

@@ -16,21 +16,79 @@
 const VALIDATOR_REGISTRY = {
   'etny-pynithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
   'etny-nodenithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
+  'ecld-pynithy-litvm-testnet': '0x2E27677fb67531eb09134fE331C27899f87ADe10',
+  'ecld-nodenithy-litvm-testnet': '0x2E27677fb67531eb09134fE331C27899f87ADe10',
 };
 
 const SESSION_REGISTRY = {
   'etny-pynithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
   'etny-nodenithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
+  'ecld-pynithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-nodenithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
 };
 
 // The chain the registries above live on.
 const CHAIN = {
   'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
+  'ecld-pynithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
+  'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
 // (Scontain CAS), or a testnet template with a SessionRegistry (ethernity-cas).
 const casProvisioned = (templateName, isMainnet) => isMainnet || Boolean(SESSION_REGISTRY[templateName]);
 
-module.exports = { VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned };
+// The mainnets, by BLOCKCHAIN_NETWORK. A template name does not tell: the Amoy
+// templates (ecld-*-amoy) do not contain "testnet".
+const MAINNETS = ['Bloxberg_Mainnet', 'Polygon_Mainnet'];
+const isMainnetNetwork = (network) =>
+  MAINNETS.some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The -unsafe networks, by BLOCKCHAIN_NETWORK, each with the network it is the
+// unsafe variant of: the same chain and contracts, for SGX platforms the CAS
+// cannot attest (EPID-only, SGX1). No CAS and no LAS: the securelock is
+// debug-signed and self-signs from MR_ENCLAVE, is registered as
+// <project>-unsafe, and runs only against an -unsafe trustedzone. Mainnet has
+// none. Kept in sync with the *_unsafe entries of
+// etny-{pynithy,nodenithy}/v3/networks.yaml.
+const UNSAFE_NETWORKS = {
+  Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
+  LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
+};
+
+// Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network
+// flag may say BLOXBERG_TESTNET_UNSAFE.
+const isUnsafeNetwork = (network) =>
+  Object.keys(UNSAFE_NETWORKS).some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The name an image is registered and run under on `network`: <name>-unsafe
+// on an -unsafe network. A dApp's securelock is <project>-unsafe there, so its
+// two variants never share an image name, and an -unsafe network's
+// trustedzone is the -unsafe variant of its sibling's.
+const nameOnNetwork = (name, network) =>
+  !name || !isUnsafeNetwork(network) || name.endsWith('-unsafe') ? name : `${name}-unsafe`;
+
+// The network part of ENCLAVE_NAME_SECURELOCK: the second word of
+// BLOCKCHAIN_NETWORK, with _unsafe on an -unsafe network so the two variants
+// never share a session name.
+const sessionTag = (network) =>
+  `${network.split('_')[1].toLowerCase()}${isUnsafeNetwork(network) ? '_unsafe' : ''}`;
+
+// A compose template rendered for its network. A line tagged `# __CAS_ONLY__`
+// serves CAS attestation and is kept where a CAS provisions the enclaves, one
+// tagged `# __NO_CAS_ONLY__` where they self-sign, and one tagged
+// `# __SAFE_ONLY__` (the LAS) on every network but an -unsafe one. Kept lines
+// lose their tag.
+const renderCompose = (content, cas, unsafe) => content
+  .split('\n')
+  .filter((line) => !(/# __CAS_ONLY__$/.test(line) && !cas))
+  .filter((line) => !(/# __NO_CAS_ONLY__$/.test(line) && cas))
+  .filter((line) => !(/# __SAFE_ONLY__$/.test(line) && unsafe))
+  .map((line) => line.replace(/\s*# __(?:CAS|NO_CAS|SAFE)_ONLY__$/, ''))
+  .join('\n');
+
+module.exports = {
+  VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
+  UNSAFE_NETWORKS, isUnsafeNetwork, nameOnNetwork, sessionTag, renderCompose,
+};

package/info.js

@@ -33,26 +33,34 @@ const fs = require('fs');
 const path = require('path');
 const { ethers } = require('ethers');
 try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
+const casConfig = require('./cas/config.js');
 
 // Authoritative per-network values (mirror of the Python SDK's network table).
 const NETWORKS = {
   BLOXBERG_MAINNET: {
-    type: 'mainnet', chainId: 8995, rpc: 'https://core.bloxberg.org',
+    type: 'mainnet', chainId: 8995, rpc: 'https://bloxberg.ethernity.cloud',
     protocol: '0x549A6E06BB2084100148D50F51CF77a3436C3Ae7',
     imageRegistry: '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31',
     esr: '0x4Bf5cDE3BFD73dd10B707f8B123Ba631D2EBEAD2',
   },
   BLOXBERG_TESTNET: {
-    type: 'testnet', chainId: 8995, rpc: 'https://core.bloxberg.org',
+    type: 'testnet', chainId: 8995, rpc: 'https://bloxberg.ethernity.cloud',
     protocol: '0x02882F03097fE8cD31afbdFbB5D72a498B41112c',
     imageRegistry: '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8',
     esr: '0x0Ea1728EAE108FD3B9340ae91451348E2Cc6b4E4',
   },
   LITVM_LITEFORGE: {
-    type: 'testnet', chainId: 0, rpc: 'https://liteforge.rpc.caldera.xyz/infra-partner-http',
-    protocol: '', imageRegistry: '', esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
+    type: 'testnet', chainId: 4441, rpc: 'https://liteforge.rpc.caldera.xyz/infra-partner-http',
+    protocol: '0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2',
+    imageRegistry: '0x55e0ad455Be85162b71a790f00Fc305680E3CE53',
+    esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
 };
+// The -unsafe networks: the chain and contracts of the network each is the
+// unsafe variant of, without a CAS.
+for (const [unsafe, sibling] of Object.entries(casConfig.UNSAFE_NETWORKS)) {
+  NETWORKS[unsafe.toUpperCase()] = { ...NETWORKS[sibling.toUpperCase()], type: 'unsafe testnet, no CAS' };
+}
 
 const IMAGE_REGISTRY_ABI = [
   'function imageDetails(string) view returns (address owner, string ipfsHash, string version, string session, uint256 fee, address rewardAddress, bool validated, bool published, string certPublicKey, string dockerComposeHash, string name)',
@@ -296,7 +304,8 @@ async function main() {
   const prov = provider(net.rpc);
 
   const ipfs = args.ipfs || process.env.IPFS_HASH || null;
-  const projName = args.name || process.env.PROJECT_NAME || null;
+  // <PROJECT_NAME>-unsafe on an -unsafe network, which is how publish registers it.
+  const projName = args.name || casConfig.nameOnNetwork(process.env.PROJECT_NAME, netName) || null;
 
   if (section === 'esr') {
     args.esrCmd = args._[1];

package/init.js

@@ -2,6 +2,7 @@ const fs = require("fs");
 const readline = require("readline");
 const { spawn, execSync } = require("child_process");
 const path = require("path");
+const casConfig = require("./cas/config.js");
 
 const rl = readline.createInterface({
   input: process.stdin,
@@ -179,6 +180,8 @@ const main = async () => {
     "IoTeX Testnet",
     "Ethereum Sepolia",
     "LitVM LiteForge",
+    "Bloxberg Testnet Unsafe",
+    "LitVM LiteForge Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -186,9 +189,20 @@ const main = async () => {
     "Bloxberg Testnet",
   );
   console.log();
+  const network = blockchainNetwork.replace(/ /g, "_");
+  if (casConfig.isUnsafeNetwork(network)) {
+    const sibling = casConfig.UNSAFE_NETWORKS[network].replace(/_/g, " ");
+    console.log(`${blockchainNetwork} runs your dApp WITHOUT a CAS, on the chain and contracts of ${sibling},`);
+    console.log("for SGX platforms the CAS cannot attest (EPID-only, SGX1). Its enclaves are debug-signed and");
+    console.log("sign their own certificates from their measurement: a result proves which image ran, not that");
+    console.log(`an enclave ran it. The securelock is registered as <project>-unsafe; choose ${sibling} for`);
+    console.log("a CAS-attested run.");
+    console.log();
+  }
+  const imageName = casConfig.nameOnNetwork(projectName.replace(/ /g, "-"), network);
 
   console.log(
-    `Checking if the project name (image name) is available on the ${blockchainNetwork.replace(/ /g, "_")} network and ownership...`,
+    `Checking if the project name (image name ${imageName}) is available on the ${network} network and ownership...`,
   );
   // const { execSync } = require('child_process');
   // execSync(`python $(pwd)/node_modules/@ethernity-cloud/sdk-js/nodenithy/run/image_registry.py "${blockchainNetwork.replace(/ /g, "_")}" "${projectName.replace(/ /g, "-")}" v3`);
@@ -198,8 +212,8 @@ const main = async () => {
     new Promise((resolve, reject) => {
       const child = spawn("node", [
         scriptPath,
-        blockchainNetwork.replace(/ /g, "_"),
-        projectName.replace(/ /g, "-"),
+        network,
+        imageName,
         "v3",
       ]);
       // Handle stdout data
@@ -342,12 +356,14 @@ const main = async () => {
     "IoTeX Testnet": `ecld-${svc}-iotex-testnet`,
     "Ethereum Sepolia": `ecld-${svc}-ethereum-sepolia`,
     "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
+    "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
+    "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);
 
 
-  writeEnv("BLOCKCHAIN_NETWORK", blockchainNetwork.replace(/ /g, "_"));
+  writeEnv("BLOCKCHAIN_NETWORK", network);
   writeEnv("IPFS_ENDPOINT", customUrl);
   console.log();
   await configureEsr();

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -1,20 +1,35 @@
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production as release
+# SCONE_NODE (build.mjs passes it) is the nodenithy trustedzone image this
+# securelock is bundled with: node:22-alpine with the SCONE 6.0.7 runtime and
+# CLI (sconecuratedimages/node:node-22-alpine, the base the etny-nodenithy CI
+# builds the trustedzones on), the release the trustedzones, the LAS and the
+# CAS run. Its own enclave is replaced below: /lib/libbinary-fs.so is
+# overwritten and /usr/local/bin/node re-signed.
+ARG SCONE_NODE
+
+# The dependencies are plain JavaScript, installed with a stock node of the
+# same major version; no SCONE binary runs at build time.
+FROM node:22-alpine AS deps
 
-RUN apk update
-
-RUN cd /
+COPY ./src /etny-securelock/
+WORKDIR /etny-securelock
+RUN npm install
 
-RUN apk add bash
+FROM ${SCONE_NODE} AS release
 
-ENV SCONE_HEAP=256M
+# As in the runtime release stage: the scone CLI below runs on a build host
+# without SGX.
+ENV SCONE_MODE=SIM
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
+# "mainnet" or "testnet": the securelock self-signs from MR_ENCLAVE on a
+# testnet without a ValidatorRegistry, and takes its certificate from the CAS
+# otherwise.
+ENV NETWORK_TYPE=__NETWORK_TYPE__
 ENV BUCKET_NAME=__BUCKET_NAME__
 ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
 ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
 ENV RPC_URL=__RPC_URL__
 ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
 ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # ESR (RFC §5.4): rendered by build.mjs to `ENV ESR_CONTRACT_ADDRESS=0x...` only
 # when ESR is enabled, and to nothing otherwise -- so non-ESR images keep exactly
@@ -22,36 +37,25 @@ ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # gates all ESR behaviour on this variable being non-empty.
 __ESR_ENV__
 
-RUN mkdir binary-fs-dir
+RUN mkdir /binary-fs-dir
 
-COPY ./src /etny-securelock/
+COPY --from=deps /etny-securelock /etny-securelock/
 COPY scripts/* /etny-securelock/
 
-WORKDIR /etny-securelock
-RUN pwd
-RUN npm install
-RUN ls
-
 WORKDIR /
 
 RUN ["chmod", "+x", "etny-securelock/binary-fs-build.sh"]
 RUN etny-securelock/binary-fs-build.sh
 
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers as build
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 as build
 
 COPY --from=release /binary-fs-dir /.
 
 RUN scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
 
-#
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production
+FROM ${SCONE_NODE}
 
 COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
-#
-
-RUN apk update
-
-RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
@@ -64,24 +68,22 @@ ENV SCONE_HEAP=1024M
 ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+ENV SCONE_LOG=DEBUG
 
 # Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
 # ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
-# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
-# self-sign). On testnet builds this line is a no-op comment.
+# A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry) is
+# signed --production; a self-signing testnet one is signed debug.
 __SCONE_SIGN__
 
-# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
-# measurement matches what was signed BEFORE registering the CAS session /
-# publishing. A mismatch means SCONE recomputed the enclave at load (params
-# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
-# for --production (mainnet) signs; on testnet the file is absent and the check
-# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert, for a
+# CAS-provisioned securelock, that the runtime enclave measurement matches what
+# was signed BEFORE registering the CAS session. A mismatch means SCONE
+# recomputed the enclave at load (params drift) => debug re-sign => the CAS
+# rejects it. Capture to a file first: piping scone-signer into `head` kills it
 # with SIGPIPE (exit 141) under buildkit's pipefail shell.
 __SIGNED_MRENCLAVE__
 
 RUN rm -rf /enclave-key.pem
 
-#RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer
-RUN ls /usr/local/bin
 ENTRYPOINT ["/usr/local/bin/node", "/etny-securelock/securelock.js"]

package/nodenithy/build/securelock/scripts/binary-fs-build.sh

@@ -7,12 +7,13 @@ cat .env
 echo "####################"
 
 cat securelock.js.tmpl | sed  s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > securelock.js.tmp
-sed -i "s/__BUCKET_NAME__/${BUCKET_NAME}/g" securelock.js.tmp
-sed -i "s/__SMART_CONTRACT_ADDRESS__/${SMART_CONTRACT_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.js.tmp
-sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.js.tmp
-sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.js.tmp
+# "|" delimits: the RPC URL contains "/".
+sed -i "s|__ETNY_NETWORK_TYPE__|${NETWORK_TYPE}|g" securelock.js.tmp
+sed -i "s|__ETNY_BUCKET__|${BUCKET_NAME}|g" securelock.js.tmp
+sed -i "s|__ETNY_SMART_CONTRACT_ADDRESS__|${SMART_CONTRACT_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_IMAGE_REGISTRY_ADDRESS__|${IMAGE_REGISTRY_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_WEB3_PROVIDER__|${RPC_URL}|g" securelock.js.tmp
+sed -i "s|__ETNY_CHAIN_ID__|${CHAIN_ID}|g" securelock.js.tmp
 # ethernity-cas ValidatorRegistry for CAS self-attestation. Deliberately NOT
 # overridable from the runtime environment (unlike the addresses above): the
 # session env comes from the CAS itself, and a rogue CAS must not get to

package/nodenithy/build.mjs

@@ -50,7 +50,12 @@ export const ECRunner = {
   'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
   'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
+  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  // --- the -unsafe networks: the contracts of the network each is named after ---
+  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 // ethernity-cas ValidatorRegistry per template, baked into the enclave so it
@@ -63,6 +68,19 @@ const require = createRequire(import.meta.url);
 const casConfig = require('../cas/config.js');
 export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
+// An -unsafe network runs an -unsafe trustedzone and nothing else, and an
+// -unsafe trustedzone runs on no other network: the runner and the node refuse
+// either mismatch, so the build does too.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+if (unsafe !== String(process.env.TRUSTED_ZONE_IMAGE || '').endsWith('-unsafe')) {
+  console.error(`ERROR: TRUSTED_ZONE_IMAGE=${process.env.TRUSTED_ZONE_IMAGE} does not run on BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}.`);
+  console.error(unsafe
+    ? '       An -unsafe network runs only a trustedzone whose name ends in -unsafe.'
+    : '       A trustedzone whose name ends in -unsafe runs only on an -unsafe network.');
+  console.error('       Run ecld-init to choose the network again.');
+  process.exit(1);
+}
+
 const runCommand = (command, canPass = false) => {
   if (shell.exec(command).code !== 0 && !canPass) {
     console.error(`Error executing command: ${command}`);
@@ -70,25 +88,22 @@ const runCommand = (command, canPass = false) => {
   }
 };
 
+// Removes the containers this build and publish create, matched by exact name:
+// `--filter name=` matches a substring, so name=las would also match the LAS of
+// a CAS validator set on the same host.
+const removeContainer = (name) => {
+  const ids = shell.exec(`docker ps -a -q --filter "name=^/${name}$"`, { silent: true }).stdout.trim();
+  if (ids) {
+    runCommand(`docker rm -f ${ids.split('\n').join(' ')}`);
+  }
+};
+
 // Downloading dependencies
 shell.rm('-rf', './registry');
 const currentDir = process.cwd();
-// console.log(`current_dir: ${currentDir}`);
 const buildDir = path.join(currentDir, 'node_modules/@ethernity-cloud/sdk-js/nodenithy/build');
-// console.log(`build_dir: ${buildDir}`);
 
-const dockerPS = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerPS) {
-  runCommand(`docker stop ${dockerPS.split('\n').join(' ')}`);
-}
-const dockeri = shell.exec('docker ps --filter name=las -q', { silent: true }).stdout.trim();
-if (dockeri) {
-  runCommand(`docker stop ${dockeri.split('\n').join(' ')}`);
-}
-const dockerRm = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerRm) {
-  runCommand(`docker rm ${dockerRm.split('\n').join(' ')} -f`);
-}
+['registry', 'las', 'etny-securelock', 'etny-trustedzone', 'etny-swift-stream'].forEach(removeContainer);
 const dockerImg = shell.exec('docker images --filter reference="*etny*" -q', { silent: true }).stdout.trim();
 if (dockerImg) {
   runCommand(`docker rmi ${dockerImg.split('\n').join(' ')} -f`);
@@ -97,7 +112,6 @@ const dockerImgReg = shell.exec('docker images --filter reference="*registry*" -
 if (dockerImgReg) {
   runCommand(`docker rmi ${dockerImgReg.split('\n').join(' ')} -f`);
 }
-runCommand(`docker rm registry -f`);
 
 
 
@@ -168,7 +182,7 @@ process.chdir(buildDir);
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
 
 const ENCLAVE_NAME_TRUSTEDZONE = templateName;
 
@@ -178,10 +192,37 @@ runCommand('docker run -d --restart=always -p 5000:5000 --name registry registry
 
 // const CI_COMMIT_BRANCH = process.env.PROJECT_NAME;
 // aleXPRoj-securelock-v3-testnet-0.1.0...
-const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${process.env.BLOCKCHAIN_NETWORK.split('_')[1].toLowerCase()}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
+const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${casConfig.sessionTag(process.env.BLOCKCHAIN_NETWORK)}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
 console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
 writeEnv('ENCLAVE_NAME_SECURELOCK', ENCLAVE_NAME_SECURELOCK);
 
+// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
+// registers it on-chain, and publishes that exact image to the ethernity registry
+// under <image_name>/trustedzone:<network>, with image_name and network the keys
+// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
+// anything else would pair the securelock with a trustedzone whose key does not
+// match the on-chain cert, so a failed pull fails the build.
+const trustedZoneNetByBlockchain = {
+  Bloxberg_Mainnet: 'bloxberg',
+  Bloxberg_Testnet: 'bloxberg_testnet',
+  Polygon_Mainnet: 'polygon',
+  Polygon_Amoy_Testnet: 'amoy',
+  IoTeX_Testnet: 'iotex_testnet',
+  Ethereum_Sepolia: 'ethereum_sepolia',
+  LitVM_LiteForge: 'litvm_liteforge',
+  Bloxberg_Testnet_Unsafe: 'bloxberg_testnet_unsafe',
+  LitVM_LiteForge_Unsafe: 'litvm_liteforge_unsafe',
+};
+const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
+if (!trustedZoneNet) {
+  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
+  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
+  process.exit(1);
+}
+const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
+console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
+runCommand(`docker pull ${trustedZoneImage}`);
+
 console.log('Building etny-securelock');
 process.chdir('securelock');
 
@@ -217,7 +258,7 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
 // Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
 // run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
@@ -247,74 +288,45 @@ const signedMrenclaveStep =
   '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
   '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
-let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
-
 // A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry)
 // is signed --production: the CAS session admits production enclaves only,
-// and a debug-signed one is refused at attestation.
-if (casConfig.casProvisioned(templateName, isMainnet)) {
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
-    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
-  if (isMainnet) imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
-} else {
-  // Testnet: non-CAS self-sign path -- no --production sign and no signed
-  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
-    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
-}
+// and a debug-signed one is refused at attestation. A self-signing testnet
+// securelock is signed debug with the same explicit params.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+dockerfileSecureContent = dockerfileSecureContent
+  .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags}${cas ? ' --production' : ''} /usr/local/bin/node`)
+  .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
 
 fs.writeFileSync('Dockerfile', dockerfileSecureContent);
 
 
 
 
-runCommand(`docker build --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
+// The trustedzone image is also the securelock's SCONE node (Dockerfile.tmpl,
+// SCONE_NODE).
+runCommand(`docker build --build-arg SCONE_NODE=${trustedZoneImage} --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
 runCommand('docker tag etny-securelock localhost:5000/etny-securelock');
 runCommand('docker push localhost:5000/etny-securelock');
-// runCommand('docker save etny-securelock:latest -o etny-securelock.tar');
 process.chdir('..');
 
 console.log(`ENCLAVE_NAME_TRUSTEDZONE: ${ENCLAVE_NAME_TRUSTEDZONE}`);
 writeEnv('ENCLAVE_NAME_TRUSTEDZONE', ENCLAVE_NAME_TRUSTEDZONE);
 
-// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
-// registers it on-chain, and publishes that exact image to the ethernity registry
-// under <image_name>/trustedzone:<network>, with image_name and network the keys
-// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
-// anything else would pair the securelock with a trustedzone whose key does not
-// match the on-chain cert, so a failed pull fails the build.
-const trustedZoneNetByBlockchain = {
-  Bloxberg_Mainnet: 'bloxberg',
-  Bloxberg_Testnet: 'bloxberg_testnet',
-  Polygon_Mainnet: 'polygon',
-  Polygon_Amoy_Testnet: 'amoy',
-  IoTeX_Testnet: 'iotex_testnet',
-  Ethereum_Sepolia: 'ethereum_sepolia',
-  LitVM_LiteForge: 'litvm_liteforge',
-};
-const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
-if (!trustedZoneNet) {
-  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
-  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
-  process.exit(1);
-}
-const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
-console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
-runCommand(`docker pull ${trustedZoneImage}`);
 runCommand(`docker tag ${trustedZoneImage} localhost:5000/etny-trustedzone`);
 runCommand('docker push localhost:5000/etny-trustedzone');
 
 
-console.log('Building etny-las');
-process.chdir('las');
-// runCommand('docker build -t etny-las .');
-// runCommand('docker tag etny-las localhost:5000/etny-las');
-// runCommand('docker push localhost:5000/etny-las');
-runCommand(`docker pull registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag}`);
-runCommand(`docker tag registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag} localhost:5000/etny-las`);
-runCommand('docker push localhost:5000/etny-las');
+// Every network but an -unsafe one runs a LAS beside the enclaves: the SCONE
+// 6.0.7 LAS the trustedzones are built and attested with (etny-nodenithy
+// v3/build/las). An -unsafe network's compose carries none, and its bundle
+// none either.
+if (!unsafe) {
+  const lasImage = 'registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/las:scone6.0.7';
+  console.log('Pulling etny-las');
+  runCommand(`docker pull ${lasImage}`);
+  runCommand(`docker tag ${lasImage} localhost:5000/etny-las`);
+  runCommand('docker push localhost:5000/etny-las');
+}
 
 
 process.chdir(currentDir);