@ethernity-cloud/sdk-js 1.6.2 → 1.7.1

package/nodenithy/src/ec_helloworld_example.js

@@ -1,58 +1,62 @@
-const AppCss = require('./App.css');
+import './App.css';
 import EthernityCloudRunner from "@ethernity-cloud/runner";
-import {ECEvent, ECRunner, ECStatus} from "@ethernity-cloud/runner/enums";
-import Web3 from 'web3';
+import { ECStatus } from "@ethernity-cloud/runner/enums";
 
+// Filled in from the project's .env by src/preStart.mjs on `npm start`: the
+// securelock this dApp is published as, the trustedzone it was built against,
+// the network's token address and chain id, the -unsafe network when the dApp
+// runs without a CAS (null otherwise), and the IPFS endpoint.
 const PROJECT_NAME = "";
+const TRUSTED_ZONE_IMAGE = "";
+const NETWORK_ADDRESS = "";
+const CHAIN_ID = null;
+const UNSAFE_NETWORK = null;
 const IPFS_ENDPOINT = "";
 
+// A call into src/serverless/backend.js; its return value is the task result.
 const code = `hello("World");`;
 
 function App() {
     const executeTask = async () => {
-        const runner = new EthernityCloudRunner();
-        // this is a server provided by Ethernity CLOUD, please bear in mind that you can use your own Decentralized Storage server
-        const ipfsAddress = IPFS_ENDPOINT;
-        runner.initializeStorage(ipfsAddress);
-        console.log(PROJECT_NAME)
-        const onTaskProgress = (e) => {
-            if (e.detail.status === ECStatus.ERROR) {
-                console.error(e.detail.message);
-            } else {
-                console.log(e.detail.message);
-            }
-        };
-
-        const onTaskCompleted = (e) => {
-            console.log(`Task Result: ${e.detail.message.result}`);
-            // display the result in page below the buttons
-            const result = document.createElement("p");
-            result.innerHTML = `Task Result: ${e.detail.message.result}`;
-            document.body.appendChild(result);
+        // The browser wallet (MetaMask) signs and pays for the order.
+        const runner = new EthernityCloudRunner(NETWORK_ADDRESS, {}, CHAIN_ID || undefined);
+        if (UNSAFE_NETWORK) {
+            await runner.setNetwork(...UNSAFE_NETWORK);
         }
+        runner.initializeStorage(IPFS_ENDPOINT);
 
-        runner.addEventListener(ECEvent.TASK_PROGRESS, onTaskProgress);
-        runner.addEventListener(ECEvent.TASK_COMPLETED, onTaskCompleted);
+        // Events are named by task status; detail is { message, status, progress }.
+        runner.addEventListener(ECStatus.DEFAULT, (e) => {
+            console.log(`[${e.detail.progress}] ${e.detail.message}`);
+        });
+        runner.addEventListener(ECStatus.ERROR, (e) => {
+            console.error(e.detail.message);
+        });
+        runner.addEventListener(ECStatus.SUCCESS, async () => {
+            const result = await runner.getResult();
+            console.log(`Task Result: ${result}`);
+            // display the result in page below the buttons
+            const line = document.createElement("p");
+            line.textContent = `Task Result: ${result}`;
+            document.body.appendChild(line);
+        });
 
-        await runner.run(PROJECT_NAME,
-                        code,
-                         '',
-                         { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 });
+        const resources = { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 };
+        await runner.run(resources, PROJECT_NAME, code, '', TRUSTED_ZONE_IMAGE);
     };
+
     const connectWallet = async () => {
-      if (window.ethereum) {
-          window.web3 = new Web3(window.ethereum);
-          try {
-              // Request account access
-              await window.ethereum.request({ method: 'eth_requestAccounts' });
-              console.log("Wallet connected");
-          } catch (error) {
-              console.error("User denied account access");
-          }
-      } else {
-          console.log('Please install MetaMask!');
-      }
-  };
+        if (!window.ethereum) {
+            console.log('Please install MetaMask!');
+            return;
+        }
+        try {
+            await window.ethereum.request({ method: 'eth_requestAccounts' });
+            console.log("Wallet connected");
+        } catch (error) {
+            console.error("User denied account access");
+        }
+    };
 
     return (
         <div className="container">
@@ -61,4 +65,4 @@ function App() {
         </div>
     );
 }
-export default App;
+export default App;

package/nodenithy/src/preStart.mjs

@@ -1,57 +1,47 @@
+// Runs before `react-scripts start` (the project's `npm start`): fills the
+// constants at the top of src/ec_helloworld_example.js from the project's
+// .env, the way ecld-run reads the same values. PROJECT_NAME and
+// TRUSTED_ZONE_IMAGE take their -unsafe form on an -unsafe network; the
+// network's token address, chain id and -unsafe (network, type) come from the
+// runner's own enums through the SDK's network table.
 import fs from 'fs';
+import { createRequire } from 'module';
 import dotenv from 'dotenv';
-dotenv.config();
+import * as enums from '@ethernity-cloud/runner/enums.js';
 
-export const ECRunner = {
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'ecld-nodenithy-testnet': ['0xfb450e40f590F1B5A119a4B82E6F3579D6742a00'],
-  'ecld-pynithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba'],
-  'ecld-nodenithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba']
+dotenv.config();
+const require = createRequire(import.meta.url);
+const casConfig = require('@ethernity-cloud/sdk-js/cas/config.js');
+const { networkFor } = require('@ethernity-cloud/sdk-js/network.js');
+
+const { PROJECT_NAME, TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK, IPFS_ENDPOINT } = process.env;
+if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK) {
+  console.error('preStart: PROJECT_NAME and BLOCKCHAIN_NETWORK are not set in .env; run `npm run ecld-init` first.');
+  process.exit(1);
+}
+const { network, known } = networkFor(enums, BLOCKCHAIN_NETWORK);
+if (!network) {
+  console.error(`preStart: unknown BLOCKCHAIN_NETWORK '${BLOCKCHAIN_NETWORK}' in .env. Known: ${known.join(', ')}`);
+  process.exit(1);
+}
+
+const constants = {
+  PROJECT_NAME: casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK),
+  TRUSTED_ZONE_IMAGE: casConfig.nameOnNetwork(TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK) || '',
+  NETWORK_ADDRESS: network.address,
+  CHAIN_ID: network.chainId || null,
+  UNSAFE_NETWORK: network.unsafe || null,
+  IPFS_ENDPOINT: IPFS_ENDPOINT || 'https://ipfs.ethernity.cloud',
 };
 
 const filePath = 'src/ec_helloworld_example.js';
-const fileContent = fs.readFileSync(filePath, 'utf8');
-
-const updatedContent = fileContent
-    .replace(/const PROJECT_NAME = ".*?";/, `const PROJECT_NAME = "${process.env.PROJECT_NAME}";`)
-    .replace(/const IPFS_ENDPOINT = ".*?";/, `const IPFS_ENDPOINT = "${process.env.IPFS_ENDPOINT}";`)
-    .replace(/new EthernityCloudRunner\(.*?\);/, `new EthernityCloudRunner('${ECRunner[process.env.ENCLAVE_NAME_TRUSTEDZONE]}');`);
-
-fs.writeFileSync(filePath, updatedContent, 'utf8');
-
-// const code = updatedContent.match(/const code = `hello\("(.*?)"\);/)[1];
-
-const imageRegistryPath = 'node_modules/@ethernity-cloud/runner/contract/operation/imageRegistryContract.js';
-const imageRegistryContent = fs.readFileSync(imageRegistryPath, 'utf8');
-
-// Log the original content for debugging
-// console.log('Original imageRegistryContent:', imageRegistryContent);
-
-// Replace the content in imageRegistryContract.js
-// const updatedImageRegistryContent = imageRegistryContent.replace(/getLatestTrustedZoneImageCertPublicKey\([^)]*\);/, "getLatestTrustedZoneImageCertPublicKey('" + process.env.ENCLAVE_NAME_TRUSTEDZONE + "', 'v3')").replace(/getLatestImageVersionPublicKey\([^)]*\)/, "getLatestImageVersionPublicKey(imageName, '" + process.env.VERSION + "')");
-const updatedImageRegistryContent = imageRegistryContent.replace(
-    /async getEnclaveDetailsV3\(.*?\{[\s\S]*?\}\s*\}/,
-    `async getEnclaveDetailsV3(imageName, version) {
-      try {
-        const trustedZonePublicKey = (await this.contract.getLatestTrustedZoneImageCertPublicKey('${process.env.ENCLAVE_NAME_TRUSTEDZONE}', 'v3'));
-        const imageDetails = await this.contract.getLatestImageVersionPublicKey(imageName, '${process.env.VERSION}');
-        return [imageDetails[0], trustedZonePublicKey[1], imageDetails[2]];
-      } catch (e) {
-        console.log(e);
-        return null;
-      }
-    }`
-  );
-
-
-fs.writeFileSync(imageRegistryPath, updatedImageRegistryContent, 'utf8');
-
-const runnerPath = 'node_modules/@ethernity-cloud/runner/runner.js';
-const runnerContent = fs.readFileSync(runnerPath, 'utf8');
-
-const updatedRunnerContent = runnerContent.replace(/this.#enclaveImageIPFSHash}:.*?:/, "this.#enclaveImageIPFSHash}:"+process.env.ENCLAVE_NAME_TRUSTEDZONE+":").replace(/new ImageRegistryContract\([^)]*\);/, "new ImageRegistryContract(this.#networkAddress, '"+process.env.ENCLAVE_NAME_TRUSTEDZONE+"');");
-
-fs.writeFileSync(runnerPath, updatedRunnerContent, 'utf8');
+let content = fs.readFileSync(filePath, 'utf8');
+for (const [name, value] of Object.entries(constants)) {
+  const line = new RegExp(`^const ${name} = .*;$`, 'm');
+  if (!line.test(content)) {
+    console.error(`preStart: ${filePath} has no 'const ${name} = ...;' line to fill.`);
+    process.exit(1);
+  }
+  content = content.replace(line, `const ${name} = ${JSON.stringify(value)};`);
+}
+fs.writeFileSync(filePath, content, 'utf8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.6.2",
+  "version": "1.7.1",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
@@ -30,10 +30,13 @@
     "postinstall.js",
     "test.js",
     "info.js",
-    "run.js"
+    "run.js",
+    "network.js",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.5.0",
+    "@ethernity-cloud/runner": "^0.6.1",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/publish.js

@@ -3,6 +3,7 @@ const readline = require('readline');
 const { execSync, spawn } = require('child_process');
 const path = require('path');
 require('dotenv').config();
+const casConfig = require('./cas/config.js');
 
 // Function to write to .env file
 const writeEnv = (key, value) => {
@@ -73,8 +74,9 @@ async function prompt(question) {
 
         console.log(`Available funds: ${result}`);
         console.log()
-        console.log(`Checking if project name is available on ${BLOCKCHAIN_NETWORK} network and ownership...`);
-        result = execSync(`node ${scriptPath} ${BLOCKCHAIN_NETWORK} ${process.env.PROJECT_NAME} ${process.env.VERSION} ${process.env.PRIVATE_KEY}`,).toString().trim();
+        const imageName = casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK);
+        console.log(`Checking if project name ${imageName} is available on ${BLOCKCHAIN_NETWORK} network and ownership...`);
+        result = execSync(`node ${scriptPath} ${BLOCKCHAIN_NETWORK} ${imageName} ${process.env.VERSION} ${process.env.PRIVATE_KEY}`,).toString().trim();
         console.log(result);
         console.log()
 

package/pynithy/build/securelock/Dockerfile.base.tpl

@@ -0,0 +1,13 @@
+FROM __DOCKER_REPO_URL__:__BASE_IMAGE_TAG__ AS release
+
+# The python-3.14.6-alpine3.24-scone6.0.7 base is a LEAN static CPython 3.14
+# (built off-SCONE with scone-gcc) plus pip/setuptools/wheel only - no
+# application dependencies are baked in. Users add their own Python modules via
+# src/serverless/requirements.txt, which are pip-installed on a normal python
+# during the PyInstaller freeze stage (see Dockerfile.tpl); nothing is compiled
+# under the SCONE-shielded interpreter.
+#
+# Only the system tools the build/runtime scripts call are added here (openssl
+# CLI is needed for the enclave key generation in the final securelock stage).
+RUN apk update
+RUN apk add bash openrc bind-tools sudo binutils curl openssl

package/pynithy/build/securelock/Dockerfile.tpl

@@ -0,0 +1,131 @@
+# syntax=docker/dockerfile:1
+#
+# Securelock enclave build. The whole build is SGX-free: heavy Python work
+# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
+# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
+# build tools, which run in simulation/build mode without an SGX device.
+
+########################################################################
+# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
+# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
+# (get_sgx_report.so) -- never the .c source. The source of truth for
+# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
+# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
+# stripped) and committed here. No source is compiled during the developer's
+# build, so a developer inspecting the wheel or build tree never sees the
+# derivation algorithm.
+#
+# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
+# enclave image is public, so this hides the SOURCE, not the algorithm; on
+# testnet the key remains reproducible because there is no attestation.
+COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+########################################################################
+# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
+# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
+# and runs pyinstaller to produce the frozen COLLECT dir. Same python
+# version + musl as the SCONE runtime python, so the output is compatible.
+########################################################################
+FROM python:3.14-alpine AS pyfreeze
+RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
+ENV SODIUM_INSTALL=system
+WORKDIR /etny-securelock
+
+# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
+# and native builds work normally).
+RUN pip install --no-cache-dir \
+      pyinstaller \
+      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
+
+# User-supplied additional modules (the customization hook).
+COPY ./src/serverless/requirements.txt /requirements.txt
+RUN pip install --no-cache-dir -r /requirements.txt || true
+
+COPY ./src /etny-securelock/
+COPY ./scripts/* /etny-securelock/
+COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+# Render securelock.py from the template, then run PyInstaller (off-SCONE).
+ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
+ENV BUCKET_NAME=__BUCKET_NAME__
+ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
+ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
+ENV RPC_URL=__RPC_URL__
+ENV CHAIN_ID=__CHAIN_ID__
+ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
+ENV NETWORK_TYPE=__NETWORK_TYPE__
+ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
+RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
+
+########################################################################
+# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
+# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
+# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
+# them into the measured binary-fs.
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
+RUN mkdir -p /binary-fs-dir /etny-securelock
+# SCONE-built static python + its stdlib, from the runtime base image
+COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
+COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
+# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
+# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
+# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
+# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
+# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
+COPY --from=pyfreeze /etny-securelock /etny-securelock
+COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
+COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
+RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
+RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
+
+########################################################################
+# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
+########################################################################
+FROM etny-securelock-serverless
+
+COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
+COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
+
+RUN openssl genrsa -3 -out /enclave-key.pem 3072
+
+# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
+# abort with "$HOME is not defined" and kill the enclave before it emits its
+# public key. Set a writable HOME so startup (and cert emission) succeeds.
+ENV HOME=/tmp
+ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
+ENV SCONE_LOG=FATAL
+ENV SCONE_DEBUG=0
+ENV SCONE_STACK=4M
+__SCONE_ALLOW_DLOPEN__
+ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+# securelock.py does relative imports of its sibling modules (etny_crypto,
+# models, ...) and reads abi/ by relative path; run from its own directory so
+# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
+# in as the enclave PWD).
+ENV SCONE_PWD=/etny-securelock
+__ESR_ENV__
+WORKDIR /etny-securelock
+
+# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
+# explicit enclave-creation params; mainnet adds --production, testnet omits it
+# (non-CAS self-sign mode).
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
+# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
+# under buildkit's `ash -eo pipefail`.
+RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
+    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
+      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
+    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
+
+RUN rm -rf /enclave-key.pem
+
+ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]

package/pynithy/build/securelock/scripts/binary-fs-build.sh

@@ -1,42 +1,33 @@
-#!/bin/bash -v
-
-
-pip3 install pyinstaller
-apk add binutils
-
+#!/bin/bash
+# Runs in the SCONE crosscompiler stage (SCONE build tools, NO SGX needed).
+# The PyInstaller freeze already happened OFF-SCONE in the pyfreeze stage; this
+# stage has received (copied in):
+#   /usr/local/bin/python3            - the static SCONE-built python 3.14
+#   /usr/local/lib/python3.14/*       - its stdlib + the installed site-packages
+#   /etny-securelock/securelock.py    - the rendered app (run at enclave runtime)
+#   /etny-securelock/COLLECT-00.toc   - PyInstaller's collected .so list
+#   /etny-securelock/get_sgx_report.so
+#
+# We bake the stdlib + site-packages + app + every collected .so into the
+# measured binary-fs; the SCONE python then loads them via SCONE_EXTENSIONS_PATH
+# at runtime (no dlopen from the untrusted host).
+set -e
 cd /etny-securelock
 
-echo "ENCLAVE_NAME_SECURE_LOCK = ${ENCLAVE_NAME_SECURELOCK}"
-
-cat securelock.py.tmpl | sed  s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > securelock.py.tmp
-sed -i "s/__BUCKET_NAME__/${BUCKET_NAME}/g" securelock.py.tmp
-sed -i "s/__SMART_CONTRACT_ADDRESS__/${SMART_CONTRACT_ADDRESS}/g" securelock.py.tmp
-sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.py.tmp
-sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.py.tmp
-sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.py.tmp
-sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.py.tmp
-sed -i "s/__VALIDATOR_REGISTRY_ADDRESS__/${VALIDATOR_REGISTRY_ADDRESS}/g" securelock.py.tmp
-mv securelock.py.tmp securelock.py
-
-pyinstaller securelock.py
-
-EXEC=(scone binaryfs / /binary-fs-dir -v \
-  --include '/usr/local/lib/python3.10/*' \
+EXEC=(scone binary-fs / /binary-fs-dir -v \
+  --include '/usr/local/bin/python3' \
+  --include '/usr/local/lib/python3.14/*' \
   --include '/etny-securelock/*' \
   --host-path=/etc/resolv.conf \
   --host-path=/etc/hosts)
 
-
-for FILE in `cat ./build/securelock/COLLECT-00.toc | grep '.so' | grep BINARY | awk -F "'" '{print $4}'`
-do
-  EXEC+=(--include "${FILE}"'*')
-done
-
-rm -rf build dist securelock.spec
+# Add every shared object PyInstaller collected (crypto/web3/etc. native libs).
+if [ -f ./COLLECT-00.toc ]; then
+  for FILE in $(grep '.so' ./COLLECT-00.toc | grep BINARY | awk -F "'" '{print $4}'); do
+    EXEC+=(--include "${FILE}"'*')
+  done
+fi
 
 echo "${EXEC[@]}"
-
-SCONE_MODE=auto
-exec "${EXEC[@]}"
-
-exit
+mkdir -p /binary-fs-dir
+SCONE_MODE=auto exec "${EXEC[@]}"

package/pynithy/build/securelock/scripts/pyfreeze.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Runs on a STOCK python:3.14-alpine (NO SCONE, NO SGX). Renders securelock.py
+# from its template and runs PyInstaller purely as a dependency-analysis pass:
+# PyInstaller resolves every module/shared-object securelock needs and records
+# them in build/securelock/COLLECT-00.toc. The frozen executable itself is not
+# used at runtime (the enclave runs the plain securelock.py with the SCONE
+# python); we only need the collected .so list + the installed site-packages,
+# which the later SCONE stage bakes into the measured binary-fs.
+set -e
+cd /etny-securelock
+
+echo "SECURELOCK_SESSION = ${SECURELOCK_SESSION}"
+
+# Use '|' as the sed delimiter so values containing '/' (e.g. the RPC URL
+# https://...) don't break the substitution ("sed: bad option in substitution").
+cp securelock.py.tmpl securelock.py.tmp
+sed -i "s|__SECURELOCK_SESSION__|${SECURELOCK_SESSION}|g" securelock.py.tmp
+sed -i "s|__BUCKET_NAME__|${BUCKET_NAME}|g" securelock.py.tmp
+sed -i "s|__SMART_CONTRACT_ADDRESS__|${SMART_CONTRACT_ADDRESS}|g" securelock.py.tmp
+sed -i "s|__IMAGE_REGISTRY_ADDRESS__|${IMAGE_REGISTRY_ADDRESS}|g" securelock.py.tmp
+sed -i "s|__RPC_URL__|${RPC_URL}|g" securelock.py.tmp
+sed -i "s|__CHAIN_ID__|${CHAIN_ID}|g" securelock.py.tmp
+sed -i "s|__TRUSTED_ZONE_IMAGE__|${TRUSTED_ZONE_IMAGE}|g" securelock.py.tmp
+sed -i "s|__NETWORK_TYPE__|${NETWORK_TYPE}|g" securelock.py.tmp
+sed -i "s|__VALIDATOR_REGISTRY_ADDRESS__|${VALIDATOR_REGISTRY_ADDRESS}|g" securelock.py.tmp
+mv securelock.py.tmp securelock.py
+
+# Dependency-analysis freeze (off-SCONE). --collect-all pulls in data/binaries
+# for the crypto/web3 stack so the COLLECT toc is complete.
+pyinstaller --onedir --noconfirm securelock.py
+
+echo "pyfreeze complete: COLLECT-00.toc + site-packages ready for binary-fs"