@ethernity-cloud/sdk-js 1.6.2 → 1.7.1

package/nodenithy/build.mjs

@@ -50,7 +50,12 @@ export const ECRunner = {
   'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
   'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
+  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  // --- the -unsafe networks: the contracts of the network each is named after ---
+  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 // ethernity-cas ValidatorRegistry per template, baked into the enclave so it
@@ -63,6 +68,19 @@ const require = createRequire(import.meta.url);
 const casConfig = require('../cas/config.js');
 export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
+// An -unsafe network runs an -unsafe trustedzone and nothing else, and an
+// -unsafe trustedzone runs on no other network: the runner and the node refuse
+// either mismatch, so the build does too.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+if (unsafe !== String(process.env.TRUSTED_ZONE_IMAGE || '').endsWith('-unsafe')) {
+  console.error(`ERROR: TRUSTED_ZONE_IMAGE=${process.env.TRUSTED_ZONE_IMAGE} does not run on BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}.`);
+  console.error(unsafe
+    ? '       An -unsafe network runs only a trustedzone whose name ends in -unsafe.'
+    : '       A trustedzone whose name ends in -unsafe runs only on an -unsafe network.');
+  console.error('       Run ecld-init to choose the network again.');
+  process.exit(1);
+}
+
 const runCommand = (command, canPass = false) => {
   if (shell.exec(command).code !== 0 && !canPass) {
     console.error(`Error executing command: ${command}`);
@@ -70,25 +88,22 @@ const runCommand = (command, canPass = false) => {
   }
 };
 
+// Removes the containers this build and publish create, matched by exact name:
+// `--filter name=` matches a substring, so name=las would also match the LAS of
+// a CAS validator set on the same host.
+const removeContainer = (name) => {
+  const ids = shell.exec(`docker ps -a -q --filter "name=^/${name}$"`, { silent: true }).stdout.trim();
+  if (ids) {
+    runCommand(`docker rm -f ${ids.split('\n').join(' ')}`);
+  }
+};
+
 // Downloading dependencies
 shell.rm('-rf', './registry');
 const currentDir = process.cwd();
-// console.log(`current_dir: ${currentDir}`);
 const buildDir = path.join(currentDir, 'node_modules/@ethernity-cloud/sdk-js/nodenithy/build');
-// console.log(`build_dir: ${buildDir}`);
 
-const dockerPS = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerPS) {
-  runCommand(`docker stop ${dockerPS.split('\n').join(' ')}`);
-}
-const dockeri = shell.exec('docker ps --filter name=las -q', { silent: true }).stdout.trim();
-if (dockeri) {
-  runCommand(`docker stop ${dockeri.split('\n').join(' ')}`);
-}
-const dockerRm = shell.exec('docker ps --filter name=registry -q', { silent: true }).stdout.trim();
-if (dockerRm) {
-  runCommand(`docker rm ${dockerRm.split('\n').join(' ')} -f`);
-}
+['registry', 'las', 'etny-securelock', 'etny-trustedzone', 'etny-swift-stream'].forEach(removeContainer);
 const dockerImg = shell.exec('docker images --filter reference="*etny*" -q', { silent: true }).stdout.trim();
 if (dockerImg) {
   runCommand(`docker rmi ${dockerImg.split('\n').join(' ')} -f`);
@@ -97,7 +112,6 @@ const dockerImgReg = shell.exec('docker images --filter reference="*registry*" -
 if (dockerImgReg) {
   runCommand(`docker rmi ${dockerImgReg.split('\n').join(' ')} -f`);
 }
-runCommand(`docker rm registry -f`);
 
 
 
@@ -168,7 +182,7 @@ process.chdir(buildDir);
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
 
 const ENCLAVE_NAME_TRUSTEDZONE = templateName;
 
@@ -178,10 +192,37 @@ runCommand('docker run -d --restart=always -p 5000:5000 --name registry registry
 
 // const CI_COMMIT_BRANCH = process.env.PROJECT_NAME;
 // aleXPRoj-securelock-v3-testnet-0.1.0...
-const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${process.env.BLOCKCHAIN_NETWORK.split('_')[1].toLowerCase()}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
+const ENCLAVE_NAME_SECURELOCK = `${process.env.PROJECT_NAME}-SECURELOCK-V3-${casConfig.sessionTag(process.env.BLOCKCHAIN_NETWORK)}-${VERSION}`.replace(/\//g, '_').replace(/-/g, '_');
 console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
 writeEnv('ENCLAVE_NAME_SECURELOCK', ENCLAVE_NAME_SECURELOCK);
 
+// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
+// registers it on-chain, and publishes that exact image to the ethernity registry
+// under <image_name>/trustedzone:<network>, with image_name and network the keys
+// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
+// anything else would pair the securelock with a trustedzone whose key does not
+// match the on-chain cert, so a failed pull fails the build.
+const trustedZoneNetByBlockchain = {
+  Bloxberg_Mainnet: 'bloxberg',
+  Bloxberg_Testnet: 'bloxberg_testnet',
+  Polygon_Mainnet: 'polygon',
+  Polygon_Amoy_Testnet: 'amoy',
+  IoTeX_Testnet: 'iotex_testnet',
+  Ethereum_Sepolia: 'ethereum_sepolia',
+  LitVM_LiteForge: 'litvm_liteforge',
+  Bloxberg_Testnet_Unsafe: 'bloxberg_testnet_unsafe',
+  LitVM_LiteForge_Unsafe: 'litvm_liteforge_unsafe',
+};
+const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
+if (!trustedZoneNet) {
+  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
+  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
+  process.exit(1);
+}
+const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
+console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
+runCommand(`docker pull ${trustedZoneImage}`);
+
 console.log('Building etny-securelock');
 process.chdir('securelock');
 
@@ -217,7 +258,7 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__TRUSTED_ZONE_IMAGE__/g, templateName).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
 // Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
 // run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
@@ -247,74 +288,45 @@ const signedMrenclaveStep =
   '      | sed -E \'s/.*MRENCLAVE:[[:space:]]*//I\' | tr -d \'[:space:]\' > /signed_mrenclave.txt && \\\n' +
   '    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"';
 
-let imagesTag = process.env.BLOCKCHAIN_NETWORK.toLowerCase();
-
 // A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry)
 // is signed --production: the CAS session admits production enclaves only,
-// and a debug-signed one is refused at attestation.
-if (casConfig.casProvisioned(templateName, isMainnet)) {
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags} --production /usr/local/bin/node`)
-    .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
-  if (isMainnet) imagesTag = process.env.BLOCKCHAIN_NETWORK.split("_")[0].toLowerCase();
-} else {
-  // Testnet: non-CAS self-sign path -- no --production sign and no signed
-  // MRENCLAVE baking (the enclave self-signs from MR_ENCLAVE at runtime).
-  dockerfileSecureContent = dockerfileSecureContent
-    .replace('__SCONE_SIGN__', '# testnet: non-CAS self-sign (no --production sign at build time)')
-    .replace('__SIGNED_MRENCLAVE__', '# testnet: no signed MRENCLAVE (self-signed from MR_ENCLAVE at runtime)');
-}
+// and a debug-signed one is refused at attestation. A self-signing testnet
+// securelock is signed debug with the same explicit params.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+dockerfileSecureContent = dockerfileSecureContent
+  .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags}${cas ? ' --production' : ''} /usr/local/bin/node`)
+  .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
 
 fs.writeFileSync('Dockerfile', dockerfileSecureContent);
 
 
 
 
-runCommand(`docker build --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
+// The trustedzone image is also the securelock's SCONE node (Dockerfile.tmpl,
+// SCONE_NODE).
+runCommand(`docker build --build-arg SCONE_NODE=${trustedZoneImage} --build-arg ENCLAVE_NAME_SECURELOCK=${ENCLAVE_NAME_SECURELOCK} -t etny-securelock:latest .`);
 runCommand('docker tag etny-securelock localhost:5000/etny-securelock');
 runCommand('docker push localhost:5000/etny-securelock');
-// runCommand('docker save etny-securelock:latest -o etny-securelock.tar');
 process.chdir('..');
 
 console.log(`ENCLAVE_NAME_TRUSTEDZONE: ${ENCLAVE_NAME_TRUSTEDZONE}`);
 writeEnv('ENCLAVE_NAME_TRUSTEDZONE', ENCLAVE_NAME_TRUSTEDZONE);
 
-// The trustedzone is not built here: the etny-nodenithy CI builds, measures and
-// registers it on-chain, and publishes that exact image to the ethernity registry
-// under <image_name>/trustedzone:<network>, with image_name and network the keys
-// of etny-nodenithy/v3/networks.yaml (image_name is TRUSTED_ZONE_IMAGE). Bundling
-// anything else would pair the securelock with a trustedzone whose key does not
-// match the on-chain cert, so a failed pull fails the build.
-const trustedZoneNetByBlockchain = {
-  Bloxberg_Mainnet: 'bloxberg',
-  Bloxberg_Testnet: 'bloxberg_testnet',
-  Polygon_Mainnet: 'polygon',
-  Polygon_Amoy_Testnet: 'amoy',
-  IoTeX_Testnet: 'iotex_testnet',
-  Ethereum_Sepolia: 'ethereum_sepolia',
-  LitVM_LiteForge: 'litvm_liteforge',
-};
-const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
-if (!trustedZoneNet) {
-  console.error(`ERROR: no published trustedzone for BLOCKCHAIN_NETWORK=${process.env.BLOCKCHAIN_NETWORK}`);
-  console.error(`       known networks: ${Object.keys(trustedZoneNetByBlockchain).join(', ')}`);
-  process.exit(1);
-}
-const trustedZoneImage = `registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/${templateName}/trustedzone:${trustedZoneNet}`;
-console.log(`Pulling the published trustedzone: ${trustedZoneImage}`);
-runCommand(`docker pull ${trustedZoneImage}`);
 runCommand(`docker tag ${trustedZoneImage} localhost:5000/etny-trustedzone`);
 runCommand('docker push localhost:5000/etny-trustedzone');
 
 
-console.log('Building etny-las');
-process.chdir('las');
-// runCommand('docker build -t etny-las .');
-// runCommand('docker tag etny-las localhost:5000/etny-las');
-// runCommand('docker push localhost:5000/etny-las');
-runCommand(`docker pull registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag}`);
-runCommand(`docker tag registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/etny-las:${imagesTag} localhost:5000/etny-las`);
-runCommand('docker push localhost:5000/etny-las');
+// Every network but an -unsafe one runs a LAS beside the enclaves: the SCONE
+// 6.0.7 LAS the trustedzones are built and attested with (etny-nodenithy
+// v3/build/las). An -unsafe network's compose carries none, and its bundle
+// none either.
+if (!unsafe) {
+  const lasImage = 'registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/las:scone6.0.7';
+  console.log('Pulling etny-las');
+  runCommand(`docker pull ${lasImage}`);
+  runCommand(`docker tag ${lasImage} localhost:5000/etny-las`);
+  runCommand('docker push localhost:5000/etny-las');
+}
 
 
 process.chdir(currentDir);

package/nodenithy/run/docker-compose-final.yml.tmpl

@@ -1,25 +1,30 @@
+# The compose a node runs for this dApp; its SCONE_* values match
+# docker-compose.yml.tmpl, which measured the securelock at publish. Tagged
+# lines are kept, untagged, only where they apply (cas/config.js
+# renderCompose): __CAS_ONLY__ serves CAS attestation, and __SAFE_ONLY__ is the
+# LAS, which every network but an -unsafe one runs.
 version: '3.2'
 services:
-  las:
-    container_name: las
-    privileged: true
-    image: localhost:5000/etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1, so it
-    # crash-loops and every task on that node times out with no attestation.
-    # The enclaves reach it over IPv4 either way.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    restart: on-failure
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
+  las:  # __SAFE_ONLY__
+    container_name: las  # __SAFE_ONLY__
+    privileged: true  # __SAFE_ONLY__
+    image: localhost:5000/etny-las  # __SAFE_ONLY__
+    entrypoint: "/las_entrypoint.sh"  # __SAFE_ONLY__
+    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot  # __SAFE_ONLY__
+    # allocate the socket on a host booted with ipv6.disable=1, so it  # __SAFE_ONLY__
+    # crash-loops and every task on that node times out with no attestation.  # __SAFE_ONLY__
+    # The enclaves reach it over IPv4 either way.  # __SAFE_ONLY__
+    command: "/usr/local/bin/las -a 0.0.0.0"  # __SAFE_ONLY__
+    networks:  # __SAFE_ONLY__
+      - ethernity  # __SAFE_ONLY__
+    devices:  # __SAFE_ONLY__
+      - "/dev/sgx_enclave:/dev/sgx_enclave"  # __SAFE_ONLY__
+    restart: on-failure  # __SAFE_ONLY__
+    ports:  # __SAFE_ONLY__
+      - target: 18766  # __SAFE_ONLY__
+        published: 18766  # __SAFE_ONLY__
+        protocol: tcp  # __SAFE_ONLY__
+        mode: host  # __SAFE_ONLY__
 
   etny-securelock:
     container_name: etny-securelock
@@ -28,9 +33,9 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
       - SCONE_HEAP=1024M
       # Must match the --stack the securelock binary was signed with (build.mjs),
       # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
@@ -43,8 +48,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 
   etny-trustedzone:
     container_name: etny-trustedzone
@@ -53,10 +58,10 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application
-      - SCONE_HEAP=256M
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
+      - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
@@ -65,8 +70,8 @@ services:
       - ethernity
     devices:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 networks:
   ethernity:
     external: true

package/nodenithy/run/docker-compose.yml.tmpl

@@ -5,24 +5,29 @@
 # no local SGX is present, cert extraction falls back to the remote
 # publickey.ethernity.cloud service. The on-node runtime uses
 # docker-compose-final.yml, which targets real SGX hardware.
+#
+# Tagged lines are kept, untagged, only where they apply (cas/config.js
+# renderCompose): __CAS_ONLY__ serves CAS attestation (mainnet, or a testnet
+# with a SessionRegistry), and __SAFE_ONLY__ is the LAS, which every network
+# but an -unsafe one runs.
 version: '3.2'
 services:
-  las:
-    container_name: las
-    privileged: true
-    image: localhost:5000/etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1, so it
-    # crash-loops and every task on that node times out with no attestation.
-    # The enclaves reach it over IPv4 either way.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    restart: on-failure
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
+  las:  # __SAFE_ONLY__
+    container_name: las  # __SAFE_ONLY__
+    privileged: true  # __SAFE_ONLY__
+    image: localhost:5000/etny-las  # __SAFE_ONLY__
+    entrypoint: "/las_entrypoint.sh"  # __SAFE_ONLY__
+    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot  # __SAFE_ONLY__
+    # allocate the socket on a host booted with ipv6.disable=1, so it  # __SAFE_ONLY__
+    # crash-loops and every task on that node times out with no attestation.  # __SAFE_ONLY__
+    # The enclaves reach it over IPv4 either way.  # __SAFE_ONLY__
+    command: "/usr/local/bin/las -a 0.0.0.0"  # __SAFE_ONLY__
+    restart: on-failure  # __SAFE_ONLY__
+    ports:  # __SAFE_ONLY__
+      - target: 18766  # __SAFE_ONLY__
+        published: 18766  # __SAFE_ONLY__
+        protocol: tcp  # __SAFE_ONLY__
+        mode: host  # __SAFE_ONLY__
 
   etny-securelock:
     container_name: etny-securelock
@@ -31,9 +36,9 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
       - SCONE_HEAP=1024M
       # Must match the --stack the securelock binary was signed with (build.mjs),
       # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
@@ -42,8 +47,8 @@ services:
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure:5
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__
 
   etny-trustedzone:
     container_name: etny-trustedzone
@@ -52,31 +57,15 @@ services:
     entrypoint: ""
     command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
     environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application
-      - SCONE_HEAP=256M
+      - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
+      - SCONE_LAS_ADDR=las  # __CAS_ONLY__
+      - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
+      # The heap the trustedzone was measured and registered with: 1024M for
+      # every testnet trustedzone (etny-nodenithy v3/run/docker-compose.yml).
+      - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
       - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
     restart: on-failure
-    depends_on:
-      - las
-
-  etny-validator:
-    container_name: etny-validator
-    privileged: true
-    image: localhost:5000/etny-validator
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-validator/validator.js" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=ecld-nodenithy/application
-      - SCONE_HEAP=256M
-      - SCONE_LOG=DEBUG
-      - SCONE_ALLOW_DLOPEN=1
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure:5
-    depends_on:
-      - las
+    depends_on:  # __SAFE_ONLY__
+      - las  # __SAFE_ONLY__

package/nodenithy/run/image_registry.js

@@ -35,6 +35,10 @@ function setVars(network = "") {
             GAS = 20000000;
             GAS_PRICE = 1300000010;
         }
+    } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
+        NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
+        IMAGE_REGISTRY_ADDRESS = "0x55e0ad455Be85162b71a790f00Fc305680E3CE53";
+        CHAIN_ID = 4441;
     }
 }
 
@@ -71,7 +75,8 @@ class ImageRegistry {
         try {
             this.imageRegistryAbi = this.readContractAbi('image_registry.abi');
             this.imageRegistryAddress = IMAGE_REGISTRY_ADDRESS;
-            console.log("imageRegistryAddress: ", this.imageRegistryAddress);
+            // stderr: callers read an action's result from stdout.
+            console.error("imageRegistryAddress: ", this.imageRegistryAddress);
             this.provider = new ethers.providers.JsonRpcProvider(NETWORK_RPC);
 
             if (PRIVATE_KEY) {
@@ -298,11 +303,19 @@ class ImageRegistry {
             console.log(`${balance} gas`);
             process.exit(0);
         }
+        // The certificate of the trustedzone's own record. getLatestImageVersionPublicKey
+        // reads the securelock records instead: ECImageRegistryV2 reverts it for
+        // a trustedzone, and the bloxberg mainnet and LitVM registries return a
+        // different certificate for the same name.
         if (action === 'getTrustedZoneCert') {
             const imageRegistry = new ImageRegistry();
-            const public = (await imageRegistry._getLatestImageVersionPublicKey(projectName, version))[1]
-            console.log(public);
-            return public;
+            try {
+                const latest = await imageRegistry.imageRegistryContract.getLatestTrustedZoneImageCertPublicKey(projectName, version);
+                console.log(latest[1]);
+            } catch (e) {
+                console.error(`No trustedzone ${projectName} (${version}) in image registry ${IMAGE_REGISTRY_ADDRESS}: ${e.reason || e.message}`);
+            }
+            return;
         }
         // The CAS session name recorded for the trustedzone template's latest
         // image: what the compose's SCONE_CONFIG_ID for the trustedzone must name.

package/nodenithy/run.js

@@ -60,13 +60,19 @@ const writeEnv = (key, value) => {
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-nodenithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
-// A testnet template with a SessionRegistry is CAS-attested by the
-// ethernity-cas validator set: the session is registered on-chain, the
-// enclave is provisioned from a validator, and the certificate comes out of
-// the CAS session. Other testnets self-sign and register nothing.
-const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
+// Mainnet enclaves are provisioned by the Scontain CAS. A testnet template
+// with a SessionRegistry is CAS-attested by the ethernity-cas validator set:
+// the session is registered on-chain, the enclave is provisioned from a
+// validator, and the certificate comes out of the CAS session. Every other
+// testnet's enclaves self-sign from MR_ENCLAVE and register no session.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+const casTestnet = !isMainnet && cas;
 const casChain = casConfig.CHAIN[templateName] || {};
+// An -unsafe network is a self-signing testnet whose compose carries no LAS;
+// its securelock is registered as <project>-unsafe.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+const securelock = casConfig.nameOnNetwork(process.env.PROJECT_NAME, process.env.BLOCKCHAIN_NETWORK);
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -108,14 +114,19 @@ const extractSignedMrenclave = (service) => {
 
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
-    const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
-    backupFiles.forEach(file => {
-        if (!fs.existsSync(file)) {
-            console.error(`Error: ${file} not found!`);
+    // Every testnet trustedzone was measured and registered with a 1024M heap
+    // (etny-nodenithy v3/run/docker-compose.yml). The mainnet session named
+    // below comes from the features/v3 branches, which ran it with 256M.
+    const trustedZoneHeap = isMainnet ? '256M' : '1024M';
+    ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
+        const template = `${file}.tmpl`;
+        if (!fs.existsSync(template)) {
+            console.error(`Error: ${template} not found!`);
             return;
         }
-        const backupContent = fs.readFileSync(file, 'utf8');
-        fs.writeFileSync(file.replace('.tmpl', ''), backupContent, 'utf8');
+        const content = casConfig.renderCompose(fs.readFileSync(template, 'utf8'), cas, unsafe)
+            .replace(/__TRUSTEDZONE_HEAP__/g, trustedZoneHeap);
+        fs.writeFileSync(file, content, 'utf8');
     });
 
 
@@ -134,7 +145,7 @@ const main = async () => {
     // from the signed binary -- and a runtime recompute yields a DEBUG enclave
     // that CAS rejects ("Debug mode is enabled"). Refuse to publish rather than
     // register an untrusted identity on-chain or fail opaquely later.
-    if (isMainnet || casTestnet) {
+    if (cas) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -221,15 +232,20 @@ const main = async () => {
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
     };
-    processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    if (cas) {
+        processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    }
 
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
     // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. Every other
-    // network keeps the Scontain CAS registration that follows.
-    if (casTestnet) {
+    // public-key harvest below provisions the enclave from them. On mainnet it
+    // is registered with the Scontain CAS. A self-signing testnet has none: a
+    // CAS-issued certificate would not match the key the enclave derives.
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (casTestnet) {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
@@ -432,13 +448,9 @@ const main = async () => {
             console.log(`No __ENCLAVE_NAME_TRUSTEDZONE__ found in ${file}`);
         }
 
-        let ENCLAVE_NAME_TRUSTEDZONE = 'etny-nodenithy-trustedzone-v3-testnet-0.0.8'
-        if (isMainnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = 'ecld-nodenithy-trustedzone-v3-3.0.0'
-        }
-        if (casTestnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
-        }
+        // Named only in a CAS-provisioned compose; a self-signing one has no
+        // __CAS_ONLY__ lines left.
+        const ENCLAVE_NAME_TRUSTEDZONE = casTestnet ? trustedZoneSession : 'ecld-nodenithy-trustedzone-v3-3.0.0';
         let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
@@ -547,7 +559,7 @@ const main = async () => {
             console.log()
 
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${process.env.PROJECT_NAME}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -636,10 +648,12 @@ const main = async () => {
     console.log("IPFS_HASH: ", process.env.IPFS_HASH);
     writeEnv('IPFS_HASH', process.env.IPFS_HASH);
     process.chdir(currentDir);
-    console.log("Adding certificates for SECURELOCK into IMAGE REGISTRY smart contract...");
+    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+    // image_registry.js registers the image under PROJECT_NAME.
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
     let existing = false;
     try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${process.env.PROJECT_NAME}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit" });
+        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
         if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
             console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
         }
@@ -651,7 +665,7 @@ const main = async () => {
     }
 
     if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
+        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.