@ethernity-cloud/sdk-js 1.6.2 → 1.7.0

package/pynithy/run.js

@@ -60,13 +60,19 @@ const writeEnv = (key, value) => {
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-pynithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
-// A testnet template with a SessionRegistry is CAS-attested by the
-// ethernity-cas validator set: the session is registered on-chain, the
-// enclave is provisioned from a validator, and the certificate comes out of
-// the CAS session. Other testnets self-sign and register nothing.
-const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
+// Mainnet enclaves are provisioned by the Scontain CAS. A testnet template
+// with a SessionRegistry is CAS-attested by the ethernity-cas validator set:
+// the session is registered on-chain, the enclave is provisioned from a
+// validator, and the certificate comes out of the CAS session. Every other
+// testnet's enclaves self-sign from MR_ENCLAVE and register no session.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+const casTestnet = !isMainnet && cas;
 const casChain = casConfig.CHAIN[templateName] || {};
+// An -unsafe network is a self-signing testnet whose compose carries no LAS;
+// its securelock is registered as <project>-unsafe.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+const securelock = casConfig.nameOnNetwork(process.env.PROJECT_NAME, process.env.BLOCKCHAIN_NETWORK);
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -107,14 +113,21 @@ const extractSignedMrenclave = (service) => {
 
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
-    const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
-    backupFiles.forEach(file => {
-        if (!fs.existsSync(file)) {
-            console.error(`Error: ${file} not found!`);
+    // The securelock heap ecld-build signed it with (part of MRENCLAVE).
+    const memory = (process.env.MEMORY_TO_ALLOCATE || '').trim();
+    if (!memory) {
+        console.error("Error: MEMORY_TO_ALLOCATE is not set in .env; run ecld-build first.");
+        process.exit(1);
+    }
+    ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
+        const template = `${file}.tmpl`;
+        if (!fs.existsSync(template)) {
+            console.error(`Error: ${template} not found!`);
             return;
         }
-        const backupContent = fs.readFileSync(file, 'utf8');
-        fs.writeFileSync(file.replace('.tmpl', ''), backupContent, 'utf8');
+        const content = casConfig.renderCompose(fs.readFileSync(template, 'utf8'), cas, unsafe)
+            .replace(/__MEMORY_TO_ALLOCATE__/g, memory);
+        fs.writeFileSync(file, content, 'utf8');
     });
 
 
@@ -130,7 +143,7 @@ const main = async () => {
     // MRENCLAVE signed --production at build time (/signed_mrenclave.txt). A
     // mismatch means SCONE recomputed the measurement at load (params drift) and
     // re-signed as DEBUG, which CAS rejects on mainnet. Refuse to publish.
-    if (isMainnet || casTestnet) {
+    if (cas) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -218,15 +231,20 @@ const main = async () => {
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
     };
-    processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    if (cas) {
+        processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    }
 
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
     // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. Every other
-    // network keeps the Scontain CAS registration that follows.
-    if (casTestnet) {
+    // public-key harvest below provisions the enclave from them. On mainnet it
+    // is registered with the Scontain CAS. A self-signing testnet has none: a
+    // CAS-issued certificate would not match the key the enclave derives.
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (casTestnet) {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
@@ -429,13 +447,9 @@ const main = async () => {
             console.log(`No __ENCLAVE_NAME_TRUSTEDZONE__ found in ${file}`);
         }
 
-        let ENCLAVE_NAME_TRUSTEDZONE = 'etny-pynithy-trustedzone-v3-testnet-0.1.12'
-        if (isMainnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = 'ecld-pynithy-trustedzone-v3-3.0.0'
-        }
-        if (casTestnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
-        }
+        // Named only in a CAS-provisioned compose; a self-signing one has no
+        // __CAS_ONLY__ lines left.
+        const ENCLAVE_NAME_TRUSTEDZONE = casTestnet ? trustedZoneSession : 'ecld-pynithy-trustedzone-v3-3.0.0';
         let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
@@ -544,7 +558,7 @@ const main = async () => {
             console.log()
 
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${process.env.PROJECT_NAME}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -611,10 +625,12 @@ const main = async () => {
     console.log("IPFS_HASH: ", process.env.IPFS_HASH);
     writeEnv('IPFS_HASH', process.env.IPFS_HASH);
     process.chdir(currentDir);
-    console.log("Adding certificates for SECURELOCK into IMAGE REGISTRY smart contract...");
+    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+    // image_registry.js registers the image under PROJECT_NAME.
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
     let existing = false;
     try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${process.env.PROJECT_NAME}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit" });
+        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
         if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
             console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
         }
@@ -626,7 +642,7 @@ const main = async () => {
     }
 
     if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
+        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/pynithy/src/serverless/Dockerfile.serverless

@@ -0,0 +1,8 @@
+FROM etny-securelock-base
+
+# System packages your backend needs, added to the securelock base image by
+# ecld-build.
+#
+# Example:
+# RUN apk update
+# RUN apk add gcc g++ git openblas-dev

package/pynithy/src/serverless/requirements.txt

@@ -0,0 +1,6 @@
+# Python packages your backend imports, one per line; ecld-build installs them
+# into the securelock enclave.
+# Example:
+#
+# scipy
+# numpy

package/run.js

@@ -15,8 +15,10 @@
  * ecld-publish), matching how ethernity_task drives a run:
  *
  *   BLOCKCHAIN_NETWORK   e.g. "Bloxberg_Testnet" -> the network token address
- *   PROJECT_NAME         the securelock enclave to run
- *   TRUSTED_ZONE_IMAGE   the trustedzone enclave
+ *   PROJECT_NAME         the securelock enclave to run (<PROJECT_NAME>-unsafe
+ *                        on an -unsafe network)
+ *   TRUSTED_ZONE_IMAGE   the trustedzone enclave (its -unsafe variant on an
+ *                        -unsafe network)
  *   PRIVATE_KEY          a funded 0x key — it pays for the order
  *
  * Usage, from the project root:
@@ -25,6 +27,7 @@
  *   npx ecld-run --file payload.js
  *   npx ecld-run --input data.json 'processData(___etny_data_set___)'
  *   npx ecld-run --network BLOXBERG_TESTNET --task-price 3 'esrIncrement()'
+ *   npx ecld-run --unsafe 'hello("World")'    # the network's -unsafe variant
  *   npx ecld-run --json 'hello("World")'      # machine-readable result
  *
  * The runner is ESM; this CJS entry loads it with dynamic import().
@@ -36,27 +39,47 @@
 
 const fs = require('fs');
 try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
+const casConfig = require('./cas/config.js');
 
 const DEFAULT_IPFS = 'https://ipfs.ethernity.cloud/api/v0';
 
 /* Map a BLOCKCHAIN_NETWORK token (as ecld-init writes it, spaces -> underscores)
- * to the runner's network token ADDRESS. Built from the runner's own ECAddress
- * so it can't drift. Accepts a few spellings per network. */
-function networkAddress(ECAddress, raw) {
+ * to the runner's network: its token ADDRESS, the chain id of a testnet whose
+ * token address other testnets share, and for an -unsafe network the
+ * (network, type) the runner is set to, which runs only -unsafe trustedzones.
+ * Built from the runner's own enums so it can't drift. Accepts a few spellings
+ * per network. */
+function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
   const key = String(raw || '').trim().toUpperCase().replace(/\s+/g, '_');
+  const bloxbergTestnet = { address: ECAddress.BLOXBERG.TESTNET_ADDRESS };
+  const amoy = { address: ECAddress.POLYGON.TESTNET_ADDRESS };
+  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET };
+  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET };
   const table = {
-    BLOXBERG_TESTNET: ECAddress.BLOXBERG.TESTNET_ADDRESS,
-    BLOXBERG_MAINNET: ECAddress.BLOXBERG.MAINNET_ADDRESS,
-    POLYGON_MAINNET: ECAddress.POLYGON.MAINNET_ADDRESS,
-    POLYGON_AMOY: ECAddress.POLYGON.TESTNET_ADDRESS,
-    POLYGON_AMOY_TESTNET: ECAddress.POLYGON.TESTNET_ADDRESS,
-    IOTEX_TESTNET: ECAddress.IOTEX && ECAddress.IOTEX.TESTNET_ADDRESS,
-    ETHEREUM_SEPOLIA: ECAddress.SEPOLIA && ECAddress.SEPOLIA.TESTNET_ADDRESS,
-    SEPOLIA: ECAddress.SEPOLIA && ECAddress.SEPOLIA.TESTNET_ADDRESS,
-    LITVM_LITEFORGE: ECAddress.LITVM && ECAddress.LITVM.TESTNET_ADDRESS,
-    LITVM: ECAddress.LITVM && ECAddress.LITVM.TESTNET_ADDRESS,
+    BLOXBERG_TESTNET: bloxbergTestnet,
+    BLOXBERG_TESTNET_UNSAFE: { ...bloxbergTestnet, unsafe: ['BLOXBERG', 'TESTNET_UNSAFE'] },
+    BLOXBERG_MAINNET: { address: ECAddress.BLOXBERG.MAINNET_ADDRESS },
+    POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
+    POLYGON_AMOY: amoy,
+    POLYGON_AMOY_TESTNET: amoy,
+    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET },
+    ETHEREUM_SEPOLIA: sepolia,
+    SEPOLIA: sepolia,
+    LITVM_LITEFORGE: litvm,
+    LITVM: litvm,
+    LITVM_LITEFORGE_UNSAFE: { ...litvm, unsafe: ['LITVM', 'TESTNET_UNSAFE'] },
   };
-  return { key, address: table[key] || null, known: Object.keys(table) };
+  return { key, network: table[key] || null, known: Object.keys(table) };
+}
+
+/* The -unsafe network a network token names, or whose sibling it names; null
+ * when the network has no -unsafe variant. */
+function unsafeVariant(raw) {
+  const key = String(raw || '').trim().replace(/\s+/g, '_');
+  if (casConfig.isUnsafeNetwork(key)) return key;
+  const variant = Object.keys(casConfig.UNSAFE_NETWORKS)
+    .find((name) => casConfig.UNSAFE_NETWORKS[name].toUpperCase() === key.toUpperCase());
+  return variant || null;
 }
 
 function parseArgs(argv) {
@@ -68,6 +91,7 @@ function parseArgs(argv) {
     else if (a === '--input' || a === '-i') opts.inputFile = argv[++i];
     else if (a === '--input-text') opts.inputText = argv[++i];
     else if (a === '--network') opts.network = argv[++i];
+    else if (a === '--unsafe') opts.unsafe = true;
     else if (a === '--securelock') opts.securelock = argv[++i];
     else if (a === '--trustedzone') opts.trustedzone = argv[++i];
     else if (a === '--node') opts.node = argv[++i];
@@ -94,7 +118,10 @@ usage: ecld-run 'hello("World")' | ecld-run --file payload.js | ecld-run --input
 
 payload:   a code string, or --file <path>; input via --input <file> / --input-text <str>
 network:   --network BLOXBERG_TESTNET (default: BLOCKCHAIN_NETWORK from .env)
-enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (default TRUSTED_ZONE_IMAGE)
+           --unsafe: the network's -unsafe variant, which runs without a CAS
+           (BLOXBERG_TESTNET_UNSAFE, LITVM_LITEFORGE_UNSAFE)
+enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (default TRUSTED_ZONE_IMAGE);
+           on an -unsafe network the default is each one's -unsafe variant
 key:       PRIVATE_KEY (a funded 0x key) from .env / env, or ECLD_PRIVATE_KEY
 resources: --task-price 3 --cpu 1 --memory 1 --storage 10 --bandwidth 1 --duration 1 --validators 1
 other:     --node <addr>  --ipfs <url>  --timeout <sec>  --json`;
@@ -121,27 +148,37 @@ async function main() {
   // ecld-run mirrors ecld-test: input is delivered via the payload call itself.
 
   // ---- runner (ESM) ----
-  let EthernityCloudRunner, ECStatus, ECEvent, ECAddress, ECOrderTaskStatus;
+  let EthernityCloudRunner, ECStatus, ECEvent, ECOrderTaskStatus, enums;
   try {
     const runnerMod = await import('@ethernity-cloud/runner');
     EthernityCloudRunner = runnerMod.default || runnerMod.EthernityCloudRunner;
-    const enums = await import('@ethernity-cloud/runner/enums.js');
-    ({ ECStatus, ECEvent, ECAddress, ECOrderTaskStatus } = enums);
+    enums = await import('@ethernity-cloud/runner/enums.js');
+    ({ ECStatus, ECEvent, ECOrderTaskStatus } = enums);
   } catch (e) {
     console.error('ecld-run: the runner package is not installed or is too old '
-      + '(need @ethernity-cloud/runner >= 0.4.4): ' + e.message);
+      + '(need @ethernity-cloud/runner >= 0.6.0): ' + e.message);
     process.exit(1);
   }
 
   // ---- network / enclaves / key ----
-  const rawNetwork = opts.network || process.env.BLOCKCHAIN_NETWORK || 'BLOXBERG_TESTNET';
-  const { key: netKey, address, known } = networkAddress(ECAddress, rawNetwork);
-  if (!address) {
+  let rawNetwork = opts.network || process.env.BLOCKCHAIN_NETWORK || 'BLOXBERG_TESTNET';
+  if (opts.unsafe) {
+    const variant = unsafeVariant(rawNetwork);
+    if (!variant) {
+      console.error(`ecld-run: ${rawNetwork} has no -unsafe variant. -unsafe networks: `
+        + Object.keys(casConfig.UNSAFE_NETWORKS).join(', '));
+      process.exit(1);
+    }
+    rawNetwork = variant;
+  }
+  const { key: netKey, network, known } = networkFor(enums, rawNetwork);
+  if (!network) {
     console.error(`ecld-run: unknown network '${rawNetwork}'. Known: ${known.join(', ')}`);
     process.exit(1);
   }
-  const securelock = opts.securelock || process.env.PROJECT_NAME;
-  const trustedzone = opts.trustedzone || process.env.TRUSTED_ZONE_IMAGE;  // may be undefined -> run() default
+  const securelock = opts.securelock || casConfig.nameOnNetwork(process.env.PROJECT_NAME, rawNetwork);
+  // May be undefined -> run() default.
+  const trustedzone = opts.trustedzone || casConfig.nameOnNetwork(process.env.TRUSTED_ZONE_IMAGE, rawNetwork);
   if (!securelock) {
     console.error('ecld-run: no securelock enclave: set PROJECT_NAME in .env '
       + '(run ecld-init/ecld-publish) or pass --securelock.');
@@ -156,7 +193,10 @@ async function main() {
   }
   if (!privateKey.startsWith('0x')) privateKey = '0x' + privateKey;
 
-  console.log(`network    : ${netKey} (${address})`);
+  console.log(`network    : ${netKey} (${network.address})`);
+  if (network.unsafe) {
+    console.log('             UNSAFE: no CAS; the enclaves are debug-signed and sign their own certificates');
+  }
   console.log(`securelock : ${securelock}`);
   console.log(`trustedzone: ${trustedzone || '(runner default)'}`);
   console.log(`payload    : ${JSON.stringify(code)}`);
@@ -165,7 +205,8 @@ async function main() {
   // ---- drive the runner ----
   let runner;
   try {
-    runner = new EthernityCloudRunner(address, { privateKey });
+    runner = new EthernityCloudRunner(network.address, { privateKey }, network.chainId);
+    if (network.unsafe) await runner.setNetwork(...network.unsafe);
   } catch (e) {
     console.error('ecld-run: could not initialise the runner: ' + e.message);
     process.exit(1);

package/nodenithy/build/las/Dockerfile

@@ -1,5 +0,0 @@
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/services:las as initial
-
-FROM scratch
-
-COPY --from=initial / /

package/pynithy/build/docker-compose.yml

@@ -1,70 +0,0 @@
-version: '3.2'
-services:
-  las:
-    container_name: las
-    privileged: true
-    image: etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    restart: on-failure
-    networks:
-      - ethernity
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
-
-  etny-securelock:
-    container_name: etny-securelock
-    privileged: true
-    image: etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/python", "/etny-securelock/securelock.py" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=etny-pynity-test-0.0.18/application
-      - SCONE_HEAP=128M
-      - SCONE_LOG=DEBUG
-      - SCONE_MODE=SIM
-      - SCONE_ALLOW_DLOPEN=2
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
-
-  etny-trustedzone:
-    container_name: etny-trustedzone
-    privileged: true
-    image: etny-trustedzone
-    entrypoint: ""
-    command: [ "/usr/local/bin/python", "/etny-trustedzone/trustedzone.py" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=etny-pynity-trustedzone-0.0.18/application
-      - SCONE_HEAP=128M
-      - SCONE_LOG=DEBUG
-      - SCONE_MODE=SIM
-      - SCONE_ALLOW_DLOPEN=2
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
-
-networks:
-  ethernity:
-    external: true

package/pynithy/build/las/Dockerfile

@@ -1,11 +0,0 @@
-FROM registry.scontain.com:5050/sconecuratedimages/services:las as initial
-
-FROM scratch
-
-COPY --from=initial / /
-
-RUN apt-get update
-RUN apt-get install psmisc
-
-COPY src/* /
-

package/pynithy/build/las/src/etny_entrypoint.sh

@@ -1,6 +0,0 @@
-
-#!/bin/bash
-
-( tail -f -n0 /var/log/las.log & ) | grep -q "Sign request failed with Enclave lost after power transition or used in child process created by"
-
-killall -9 las

package/pynithy/build/las/src/las_entrypoint.sh

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-set -e
-
-SOCKET="/var/run/aesmd/aesm.socket"
-
-# Try to connect to the socket
-# Previously we merely checked that the socket file exists. However, the
-# file is not removed when the container stops and, thus, when we restart
-# the file still exists and we assume that we are supposed to use an
-# outside AESM.
-if socat -u OPEN:/dev/null UNIX-CONNECT:${SOCKET}; then
-    # An AESM socket was already mounted into the container, don't start a local AESM service, start LAS directly
-    echo "${SOCKET} exists - Will use mounted AESM socket; the local in-container AESM service will not be started!"
-    exec "$@"
-else
-    # No AESM socket present, delegate execution to the local AESM service
-    echo "${SOCKET} not found or unable to connect - Starting local in-container AESM service"
-    if [ -e ${SOCKET} ]; then
-        # Ensure the socket file does not exist - AESM won't start if it does...
-        rm ${SOCKET}
-    fi
-    exec /entrypoint.sh "$@"
-fi
-
-/etny_entrypoint.sh &

package/pynithy/build/scripts/binary-fs-build.sh

@@ -1,28 +0,0 @@
-#!/bin/bash -v
-
-pip3 install pyinstaller
-apk add binutils
-
-cd /etny-securelock
-pyinstaller etny_result.py
-
-EXEC=(scone binaryfs / /binary-fs-dir -v \
-  --include '/usr/local/lib/python3.10/*' \
-  --include '/etny-securelock/*' \
-  --host-path=/etc/resolv.conf \
-  --host-path=/etc/hosts)
-
-
-for FILE in `cat ./build/etny_result/COLLECT-00.toc | grep '.so' | grep BINARY | awk -F "'" '{print $4}'`
-do
-  EXEC+=(--include "${FILE}"'*')
-done
-
-rm -rf build dist etny_result.spec
-
-echo "${EXEC[@]}"
-
-SCONE_MODE=auto
-exec "${EXEC[@]}"
-
-exit

package/pynithy/build/securelock/Dockerfile.tmpl

@@ -1,95 +0,0 @@
-# FROM registry.scontain.com:5050/sconecuratedimages/apps:python3.10.5-alpine3.15-scone5.8-pre-release as release
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/apps:python3.10.5-alpine3.15-scone5.8-pre-release as release
-
-
-
-RUN apk update
-
-RUN cd /
-RUN apk add bash openrc bind-tools sudo npm binutils curl
-RUN pip3 install --upgrade pip
-RUN pip3 install --upgrade setuptools
-RUN pip3 install python-dotenv
-RUN pip3 install web3==5.31.0
-RUN pip3 install cryptography==42.0.7
-RUN pip3 install ecdsa
-RUN pip3 install pyasn1
-RUN pip3 install tinyec
-RUN pip3 install pyinstaller
-RUN pip3 install minio
-RUN pip3 install pynacl
-RUN pip3 install pytest
-RUN pip3 install numpy
-RUN pip3 install scipy
-RUN pip3 install hypothesis
-RUN pip3 install pooch
-RUN pip3 install ipywidgets
-
-#RUN pip3 install requests
-#RUN pip3 install beautifulsoup4
-#RUN pip3 install tokenizers
-#RUN pip3 install transformers
-#RUN pip3 install tensorflow
-
-
-ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
-ENV BUCKET_NAME=__BUCKET_NAME__
-ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
-ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
-ENV RPC_URL=__RPC_URL__
-ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
-ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
-
-
-RUN mkdir binary-fs-dir
-
-COPY ./src /etny-securelock/
-COPY ./scripts/* /etny-securelock/
-
-RUN etny-securelock/binary-fs-build.sh
-
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers as build
-
-COPY --from=release /binary-fs-dir /.
-
-RUN scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
-
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/apps:python3.10.5-alpine3.15-scone5.8-pre-release
-
-COPY --from=build /usr/local/bin/scone /usr/local/bin/scone
-
-#RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer
-
-COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
-
-RUN openssl genrsa -3 -out /enclave-key.pem 3072
-
-# SCONE runtime env. Must match the enclave-creation params passed to
-# scone-signer below (any drift makes SCONE recompute + debug re-sign at load,
-# which CAS rejects on mainnet). Values mirror the run/docker-compose securelock
-# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
-ENV SCONE_LOG=INFO
-ENV SCONE_HEAP=1024M
-ENV SCONE_STACK=4M
-ENV SCONE_ALLOW_DLOPEN=1
-ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-
-# Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/python -- the
-# ENTRYPOINT and the run/publish compose command both run /usr/local/bin/python;
-# python3 is a SEPARATE symlink, signing it leaves the executed binary
-# debug-signed). Mainnet adds --production (CAS/DCAP); testnet omits it (non-CAS
-# self-sign). On testnet builds this line is a no-op comment.
-__SCONE_SIGN__
-
-# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
-# measurement matches what was signed before registering the CAS session. Only
-# produced for --production (mainnet); on testnet the file is absent and the
-# check is skipped. Capture to a file first (piping scone-signer into head/grep
-# kills it with SIGPIPE / exit 141 under buildkit's pipefail shell).
-__SIGNED_MRENCLAVE__
-
-RUN rm -rf /enclave-key.pem
-
-
-ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]