@ethernity-cloud/sdk-js 1.6.2 → 1.7.0

package/nodenithy/run/docker-compose-final.yml.tmpl

@@ -1,25 +1,30 @@
+# The compose a node runs for this dApp; its SCONE_* values match
+# docker-compose.yml.tmpl, which measured the securelock at publish. Tagged
+# lines are kept, untagged, only where they apply (cas/config.js
+# renderCompose): __CAS_ONLY__ serves CAS attestation, and __SAFE_ONLY__ is the
+# LAS, which every network but an -unsafe one runs.
 version: '3.2'
 services:
-  las:
-    container_name: las
-    privileged: true
-    image: localhost:5000/etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1, so it
-    # crash-loops and every task on that node times out with no attestation.
-    # The enclaves reach it over IPv4 either way.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    restart: on-failure
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
+  las:  # __SAFE_ONLY__
+    container_name: las  # __SAFE_ONLY__
+    privileged: true  # __SAFE_ONLY__
+    image: localhost:5000/etny-las  # __SAFE_ONLY__
+    entrypoint: "/las_entrypoint.sh"  # __SAFE_ONLY__
+    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot  # __SAFE_ONLY__
+    # allocate the socket on a host booted with ipv6.disable=1, so it  # __SAFE_ONLY__
+    # crash-loops and every task on that node times out with no attestation.  # __SAFE_ONLY__
+    # The enclaves reach it over IPv4 either way.  # __SAFE_ONLY__
+    command: "/usr/local/bin/las -a 0.0.0.0"  # __SAFE_ONLY__
+    networks:  # __SAFE_ONLY__
+      - ethernity  # __SAFE_ONLY__
+    devices:  # __SAFE_ONLY__
+      - "/dev/sgx_enclave:/dev/sgx_enclave"  # __SAFE_ONLY__
+    restart: on-failure  # __SAFE_ONLY__
+    ports:  # __SAFE_ONLY__
+      - target: 18766  # __SAFE_ONLY__
+        published: 18766  # __SAFE_ONLY__
+        protocol: tcp  # __SAFE_ONLY__
+        mode: host  # __SAFE_ONLY__
 
   etny-securelock:
     container_name: etny-securelock
@@ -28,9 +33,9 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
       - SCONE_HEAP=1024M
       # Must match the --stack the securelock binary was signed with (build.mjs),
       # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
@@ -43,8 +48,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 
   etny-trustedzone:
     container_name: etny-trustedzone
@@ -53,10 +58,10 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application
-      - SCONE_HEAP=256M
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
+      - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
@@ -65,8 +70,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 networks:
   ethernity:
     external: true

package/nodenithy/run/docker-compose.yml.tmpl

@@ -5,24 +5,29 @@
 # no local SGX is present, cert extraction falls back to the remote
 # publickey.ethernity.cloud service. The on-node runtime uses
 # docker-compose-final.yml, which targets real SGX hardware.
+#
+# Tagged lines are kept, untagged, only where they apply (cas/config.js
+# renderCompose): __CAS_ONLY__ serves CAS attestation (mainnet, or a testnet
+# with a SessionRegistry), and __SAFE_ONLY__ is the LAS, which every network
+# but an -unsafe one runs.
 version: '3.2'
 services:
-  las:
-    container_name: las
-    privileged: true
-    image: localhost:5000/etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1, so it
-    # crash-loops and every task on that node times out with no attestation.
-    # The enclaves reach it over IPv4 either way.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    restart: on-failure
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
+  las:  # __SAFE_ONLY__
+    container_name: las  # __SAFE_ONLY__
+    privileged: true  # __SAFE_ONLY__
+    image: localhost:5000/etny-las  # __SAFE_ONLY__
+    entrypoint: "/las_entrypoint.sh"  # __SAFE_ONLY__
+    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot  # __SAFE_ONLY__
+    # allocate the socket on a host booted with ipv6.disable=1, so it  # __SAFE_ONLY__
+    # crash-loops and every task on that node times out with no attestation.  # __SAFE_ONLY__
+    # The enclaves reach it over IPv4 either way.  # __SAFE_ONLY__
+    command: "/usr/local/bin/las -a 0.0.0.0"  # __SAFE_ONLY__
+    restart: on-failure  # __SAFE_ONLY__
+    ports:  # __SAFE_ONLY__
+      - target: 18766  # __SAFE_ONLY__
+        published: 18766  # __SAFE_ONLY__
+        protocol: tcp  # __SAFE_ONLY__
+        mode: host  # __SAFE_ONLY__
 
   etny-securelock:
     container_name: etny-securelock
@@ -31,9 +36,9 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
       - SCONE_HEAP=1024M
       # Must match the --stack the securelock binary was signed with (build.mjs),
       # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
@@ -42,8 +47,8 @@ services:
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure:5
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 
   etny-trustedzone:
     container_name: etny-trustedzone
@@ -52,31 +57,15 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application
-      - SCONE_HEAP=256M
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
+      # The heap the trustedzone was measured and registered with: 1024M for
+      # every testnet trustedzone (etny-nodenithy v3/run/docker-compose.yml).
+      - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure
-    depends_on:
-      - las
-
-  etny-validator:
-    container_name: etny-validator
-    privileged: true
-    image: localhost:5000/etny-validator
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-validator/validator.js" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=ecld-nodenithy/application
-      - SCONE_HEAP=256M
-      - SCONE_LOG=DEBUG
-      - SCONE_ALLOW_DLOPEN=1
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure:5
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__

package/nodenithy/run/image_registry.js

@@ -35,6 +35,10 @@ function setVars(network = "") {
             GAS = 20000000;
             GAS_PRICE = 1300000010;
         }
+    } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
+        NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
+        IMAGE_REGISTRY_ADDRESS = "0x55e0ad455Be85162b71a790f00Fc305680E3CE53";
+        CHAIN_ID = 4441;
     }
 }
 
@@ -71,7 +75,8 @@ class ImageRegistry {
         try {
             this.imageRegistryAbi = this.readContractAbi('image_registry.abi');
             this.imageRegistryAddress = IMAGE_REGISTRY_ADDRESS;
-            console.log("imageRegistryAddress: ", this.imageRegistryAddress);
+            // stderr: callers read an action's result from stdout.
+            console.error("imageRegistryAddress: ", this.imageRegistryAddress);
             this.provider = new ethers.providers.JsonRpcProvider(NETWORK_RPC);
 
             if (PRIVATE_KEY) {
@@ -298,11 +303,19 @@ class ImageRegistry {
             console.log(`${balance} gas`);
             process.exit(0);
         }
+        // The certificate of the trustedzone's own record. getLatestImageVersionPublicKey
+        // reads the securelock records instead: ECImageRegistryV2 reverts it for
+        // a trustedzone, and the bloxberg mainnet and LitVM registries return a
+        // different certificate for the same name.
         if (action === 'getTrustedZoneCert') {
             const imageRegistry = new ImageRegistry();
-            const public = (await imageRegistry._getLatestImageVersionPublicKey(projectName, version))[1]
-            console.log(public);
-            return public;
+            try {
+                const latest = await imageRegistry.imageRegistryContract.getLatestTrustedZoneImageCertPublicKey(projectName, version);
+                console.log(latest[1]);
+            } catch (e) {
+                console.error(`No trustedzone ${projectName} (${version}) in image registry ${IMAGE_REGISTRY_ADDRESS}: ${e.reason || e.message}`);
+            }
+            return;
         }
         // The CAS session name recorded for the trustedzone template's latest
         // image: what the compose's SCONE_CONFIG_ID for the trustedzone must name.

package/nodenithy/run.js

@@ -60,13 +60,19 @@ const writeEnv = (key, value) => {
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
-// A testnet template with a SessionRegistry is CAS-attested by the
-// ethernity-cas validator set: the session is registered on-chain, the
-// enclave is provisioned from a validator, and the certificate comes out of
-// the CAS session. Other testnets self-sign and register nothing.
-const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
+// Mainnet enclaves are provisioned by the Scontain CAS. A testnet template
+// with a SessionRegistry is CAS-attested by the ethernity-cas validator set:
+// the session is registered on-chain, the enclave is provisioned from a
+// validator, and the certificate comes out of the CAS session. Every other
+// testnet's enclaves self-sign from MR_ENCLAVE and register no session.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+const casTestnet = !isMainnet && cas;
 const casChain = casConfig.CHAIN[templateName] || {};
+// An -unsafe network is a self-signing testnet whose compose carries no LAS;
+// its securelock is registered as <project>-unsafe.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+const securelock = casConfig.nameOnNetwork(process.env.PROJECT_NAME, process.env.BLOCKCHAIN_NETWORK);
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -108,14 +114,19 @@ const extractSignedMrenclave = (service) => {
 
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
-    const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
-    backupFiles.forEach(file => {
-        if (!fs.existsSync(file)) {
-            console.error(`Error: ${file} not found!`);
+    // Every testnet trustedzone was measured and registered with a 1024M heap
+    // (etny-nodenithy v3/run/docker-compose.yml). The mainnet session named
+    // below comes from the features/v3 branches, which ran it with 256M.
+    const trustedZoneHeap = isMainnet ? '256M' : '1024M';
+    ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
+        const template = `${file}.tmpl`;
+        if (!fs.existsSync(template)) {
+            console.error(`Error: ${template} not found!`);
             return;
         }
-        const backupContent = fs.readFileSync(file, 'utf8');
-        fs.writeFileSync(file.replace('.tmpl', ''), backupContent, 'utf8');
+        const content = casConfig.renderCompose(fs.readFileSync(template, 'utf8'), cas, unsafe)
+            .replace(/__TRUSTEDZONE_HEAP__/g, trustedZoneHeap);
+        fs.writeFileSync(file, content, 'utf8');
     });
 
 
@@ -134,7 +145,7 @@ const main = async () => {
     // from the signed binary -- and a runtime recompute yields a DEBUG enclave
     // that CAS rejects ("Debug mode is enabled"). Refuse to publish rather than
     // register an untrusted identity on-chain or fail opaquely later.
-    if (isMainnet || casTestnet) {
+    if (cas) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -221,15 +232,20 @@ const main = async () => {
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
     };
-    processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    if (cas) {
+        processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    }
 
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
     // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. Every other
-    // network keeps the Scontain CAS registration that follows.
-    if (casTestnet) {
+    // public-key harvest below provisions the enclave from them. On mainnet it
+    // is registered with the Scontain CAS. A self-signing testnet has none: a
+    // CAS-issued certificate would not match the key the enclave derives.
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (casTestnet) {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
@@ -432,13 +448,9 @@ const main = async () => {
             console.log(`No __ENCLAVE_NAME_TRUSTEDZONE__ found in ${file}`);
         }
 
-        let ENCLAVE_NAME_TRUSTEDZONE = 'etny-nodenithy-trustedzone-v3-testnet-0.0.8'
-        if (isMainnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = 'ecld-nodenithy-trustedzone-v3-3.0.0'
-        }
-        if (casTestnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
-        }
+        // Named only in a CAS-provisioned compose; a self-signing one has no
+        // __CAS_ONLY__ lines left.
+        const ENCLAVE_NAME_TRUSTEDZONE = casTestnet ? trustedZoneSession : 'ecld-nodenithy-trustedzone-v3-3.0.0';
         let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
@@ -547,7 +559,7 @@ const main = async () => {
             console.log()
 
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${process.env.PROJECT_NAME}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -636,10 +648,12 @@ const main = async () => {
     console.log("IPFS_HASH: ", process.env.IPFS_HASH);
     writeEnv('IPFS_HASH', process.env.IPFS_HASH);
     process.chdir(currentDir);
-    console.log("Adding certificates for SECURELOCK into IMAGE REGISTRY smart contract...");
+    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+    // image_registry.js registers the image under PROJECT_NAME.
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
     let existing = false;
     try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${process.env.PROJECT_NAME}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit" });
+        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
         if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
             console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
         }
@@ -651,7 +665,7 @@ const main = async () => {
     }
 
     if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
+        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
@@ -30,10 +30,12 @@
     "postinstall.js",
     "test.js",
     "info.js",
-    "run.js"
+    "run.js",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.5.0",
+    "@ethernity-cloud/runner": "^0.6.0",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/publish.js

@@ -3,6 +3,7 @@ const readline = require('readline');
 const { execSync, spawn } = require('child_process');
 const path = require('path');
 require('dotenv').config();
+const casConfig = require('./cas/config.js');
 
 // Function to write to .env file
 const writeEnv = (key, value) => {
@@ -73,8 +74,9 @@ async function prompt(question) {
 
         console.log(`Available funds: ${result}`);
         console.log()
-        console.log(`Checking if project name is available on ${BLOCKCHAIN_NETWORK} network and ownership...`);
-        result = execSync(`node ${scriptPath} ${BLOCKCHAIN_NETWORK} ${process.env.PROJECT_NAME} ${process.env.VERSION} ${process.env.PRIVATE_KEY}`,).toString().trim();
+        const imageName = casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK);
+        console.log(`Checking if project name ${imageName} is available on ${BLOCKCHAIN_NETWORK} network and ownership...`);
+        result = execSync(`node ${scriptPath} ${BLOCKCHAIN_NETWORK} ${imageName} ${process.env.VERSION} ${process.env.PRIVATE_KEY}`,).toString().trim();
         console.log(result);
         console.log()
 

package/pynithy/build/securelock/Dockerfile.base.tpl

@@ -0,0 +1,13 @@
+FROM __DOCKER_REPO_URL__:__BASE_IMAGE_TAG__ AS release
+
+# The python-3.14.6-alpine3.24-scone6.0.7 base is a LEAN static CPython 3.14
+# (built off-SCONE with scone-gcc) plus pip/setuptools/wheel only - no
+# application dependencies are baked in. Users add their own Python modules via
+# src/serverless/requirements.txt, which are pip-installed on a normal python
+# during the PyInstaller freeze stage (see Dockerfile.tpl); nothing is compiled
+# under the SCONE-shielded interpreter.
+#
+# Only the system tools the build/runtime scripts call are added here (openssl
+# CLI is needed for the enclave key generation in the final securelock stage).
+RUN apk update
+RUN apk add bash openrc bind-tools sudo binutils curl openssl

package/pynithy/build/securelock/Dockerfile.tpl

@@ -0,0 +1,131 @@
+# syntax=docker/dockerfile:1
+#
+# Securelock enclave build. The whole build is SGX-free: heavy Python work
+# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
+# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
+# build tools, which run in simulation/build mode without an SGX device.
+
+########################################################################
+# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
+# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
+# (get_sgx_report.so) -- never the .c source. The source of truth for
+# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
+# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
+# stripped) and committed here. No source is compiled during the developer's
+# build, so a developer inspecting the wheel or build tree never sees the
+# derivation algorithm.
+#
+# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
+# enclave image is public, so this hides the SOURCE, not the algorithm; on
+# testnet the key remains reproducible because there is no attestation.
+COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+########################################################################
+# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
+# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
+# and runs pyinstaller to produce the frozen COLLECT dir. Same python
+# version + musl as the SCONE runtime python, so the output is compatible.
+########################################################################
+FROM python:3.14-alpine AS pyfreeze
+RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
+ENV SODIUM_INSTALL=system
+WORKDIR /etny-securelock
+
+# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
+# and native builds work normally).
+RUN pip install --no-cache-dir \
+      pyinstaller \
+      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
+
+# User-supplied additional modules (the customization hook).
+COPY ./src/serverless/requirements.txt /requirements.txt
+RUN pip install --no-cache-dir -r /requirements.txt || true
+
+COPY ./src /etny-securelock/
+COPY ./scripts/* /etny-securelock/
+COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+# Render securelock.py from the template, then run PyInstaller (off-SCONE).
+ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
+ENV BUCKET_NAME=__BUCKET_NAME__
+ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
+ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
+ENV RPC_URL=__RPC_URL__
+ENV CHAIN_ID=__CHAIN_ID__
+ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
+ENV NETWORK_TYPE=__NETWORK_TYPE__
+ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
+RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
+
+########################################################################
+# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
+# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
+# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
+# them into the measured binary-fs.
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
+RUN mkdir -p /binary-fs-dir /etny-securelock
+# SCONE-built static python + its stdlib, from the runtime base image
+COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
+COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
+# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
+# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
+# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
+# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
+# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
+COPY --from=pyfreeze /etny-securelock /etny-securelock
+COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
+COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
+RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
+RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
+
+########################################################################
+# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
+########################################################################
+FROM etny-securelock-serverless
+
+COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
+COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
+
+RUN openssl genrsa -3 -out /enclave-key.pem 3072
+
+# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
+# abort with "$HOME is not defined" and kill the enclave before it emits its
+# public key. Set a writable HOME so startup (and cert emission) succeeds.
+ENV HOME=/tmp
+ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
+ENV SCONE_LOG=FATAL
+ENV SCONE_DEBUG=0
+ENV SCONE_STACK=4M
+__SCONE_ALLOW_DLOPEN__
+ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+# securelock.py does relative imports of its sibling modules (etny_crypto,
+# models, ...) and reads abi/ by relative path; run from its own directory so
+# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
+# in as the enclave PWD).
+ENV SCONE_PWD=/etny-securelock
+__ESR_ENV__
+WORKDIR /etny-securelock
+
+# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
+# explicit enclave-creation params; mainnet adds --production, testnet omits it
+# (non-CAS self-sign mode).
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
+# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
+# under buildkit's `ash -eo pipefail`.
+RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
+    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
+      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
+    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
+
+RUN rm -rf /enclave-key.pem
+
+ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]

package/pynithy/build/securelock/scripts/binary-fs-build.sh

@@ -1,42 +1,33 @@
-#!/bin/bash -v
-
-
-pip3 install pyinstaller
-apk add binutils
-
+#!/bin/bash
+# Runs in the SCONE crosscompiler stage (SCONE build tools, NO SGX needed).
+# The PyInstaller freeze already happened OFF-SCONE in the pyfreeze stage; this
+# stage has received (copied in):
+#   /usr/local/bin/python3            - the static SCONE-built python 3.14
+#   /usr/local/lib/python3.14/*       - its stdlib + the installed site-packages
+#   /etny-securelock/securelock.py    - the rendered app (run at enclave runtime)
+#   /etny-securelock/COLLECT-00.toc   - PyInstaller's collected .so list
+#   /etny-securelock/get_sgx_report.so
+#
+# We bake the stdlib + site-packages + app + every collected .so into the
+# measured binary-fs; the SCONE python then loads them via SCONE_EXTENSIONS_PATH
+# at runtime (no dlopen from the untrusted host).
+set -e
 cd /etny-securelock
 
-echo "ENCLAVE_NAME_SECURE_LOCK = ${ENCLAVE_NAME_SECURELOCK}"
-
-cat securelock.py.tmpl | sed  s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > securelock.py.tmp
-sed -i "s/__BUCKET_NAME__/${BUCKET_NAME}/g" securelock.py.tmp
-sed -i "s/__SMART_CONTRACT_ADDRESS__/${SMART_CONTRACT_ADDRESS}/g" securelock.py.tmp
-sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.py.tmp
-sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.py.tmp
-sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.py.tmp
-sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.py.tmp
-sed -i "s/__VALIDATOR_REGISTRY_ADDRESS__/${VALIDATOR_REGISTRY_ADDRESS}/g" securelock.py.tmp
-mv securelock.py.tmp securelock.py
-
-pyinstaller securelock.py
-
-EXEC=(scone binaryfs / /binary-fs-dir -v \
-  --include '/usr/local/lib/python3.10/*' \
+EXEC=(scone binary-fs / /binary-fs-dir -v \
+  --include '/usr/local/bin/python3' \
+  --include '/usr/local/lib/python3.14/*' \
   --include '/etny-securelock/*' \
   --host-path=/etc/resolv.conf \
   --host-path=/etc/hosts)
 
-
-for FILE in `cat ./build/securelock/COLLECT-00.toc | grep '.so' | grep BINARY | awk -F "'" '{print $4}'`
-do
-  EXEC+=(--include "${FILE}"'*')
-done
-
-rm -rf build dist securelock.spec
+# Add every shared object PyInstaller collected (crypto/web3/etc. native libs).
+if [ -f ./COLLECT-00.toc ]; then
+  for FILE in $(grep '.so' ./COLLECT-00.toc | grep BINARY | awk -F "'" '{print $4}'); do
+    EXEC+=(--include "${FILE}"'*')
+  done
+fi
 
 echo "${EXEC[@]}"
-
-SCONE_MODE=auto
-exec "${EXEC[@]}"
-
-exit
+mkdir -p /binary-fs-dir
+SCONE_MODE=auto exec "${EXEC[@]}"