@ethernity-cloud/sdk-js 1.7.1 → 1.7.7

package/nodenithy/run/image_registry.js

@@ -1,25 +1,27 @@
 const Web3 = require('web3');
 const { ethers } = require('ethers');
-const { Account } = require('eth-lib/lib/account');
 const { config } = require('dotenv');
 const fs = require('fs');
 const path = require('path');
+const { isRevert, revertReason } = require('../../revert.js');
 
 config();
 
+// The publishing wallet's key comes from the environment only: a command line
+// is visible to other processes and is printed when the command fails.
 const PRIVATE_KEY = process.env.PRIVATE_KEY || "";
 let BLOCKCHAIN_NETWORK = process.env.BLOCKCHAIN_NETWORK || "Bloxberg_Testnet";
 let NETWORK_RPC = "https://bloxberg.ethernity.cloud";
-let IMAGE_REGISTRY_ADDRESS = "0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8"; // bloxberg testnet (ECImageRegistryV2)
+let IMAGE_REGISTRY_ADDRESS = "0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1"; // bloxberg testnet (ECImageRegistryV3)
 let CHAIN_ID = 8995;
 let GAS = 9000000;
 let GAS_PRICE = 1;
 
 function setVars(network = "") {
     if (BLOCKCHAIN_NETWORK.includes("Bloxberg")) {
-        // The bloxberg testnet reads ECImageRegistryV2; mainnet the original registry.
+        // The bloxberg testnet reads ECImageRegistryV3; mainnet the original registry.
         IMAGE_REGISTRY_ADDRESS = BLOCKCHAIN_NETWORK.includes("Testnet")
-            ? "0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8"
+            ? "0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1"
             : "0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31";
     } else if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
         if (BLOCKCHAIN_NETWORK.includes("Mainnet")) {
@@ -58,6 +60,26 @@ function isStringPrivateKey(privateKey) {
     }
 }
 
+// The address of a private key given with or without its 0x prefix.
+function walletAddress(privateKey) {
+    return new ethers.Wallet(privateKey.startsWith("0x") ? privateKey : `0x${privateKey}`).address;
+}
+
+// REWARD_ADDRESS from the environment: where the image's developer fee is
+// paid when not the publishing wallet, or "" when unset. ECImageRegistryV3
+// refuses the zero address, so it is refused here before any transaction.
+function rewardAddressFromEnv() {
+    const rewardAddress = (process.env.REWARD_ADDRESS || "").trim();
+    if (!rewardAddress) return "";
+    if (!ethers.utils.isAddress(rewardAddress)) {
+        throw new Error(`REWARD_ADDRESS ${rewardAddress} is not an address`);
+    }
+    if (rewardAddress.toLowerCase() === ethers.constants.AddressZero) {
+        throw new Error("REWARD_ADDRESS is the zero address; leave it empty to be paid at the publishing wallet");
+    }
+    return rewardAddress;
+}
+
 async function checkAccountBalance() {
     try {
         const web3 = new ethers.providers.JsonRpcProvider(NETWORK_RPC);
@@ -124,61 +146,12 @@ class ImageRegistry {
         const receipt = await this.provider.sendTransaction(signedTxn.rawTransaction);
     }
 
+    // Record the securelock with its certificate on a V1 registry, in one
+    // addImage call. A failure, including the registry's refusal, throws.
     async addSecureLockImageCert(certContent, ipfsHash, imageName, version, dockerComposeHash, enclaveNameSecureLock, fee) {
-        try {
-            console.log("Adding secure lock image cert to image registry");
-            // Fetch current nonce
-            if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
-                console.log("Polygon Mainnet");
-                let nonce = await this.provider.getTransactionCount(this.acct.address, 'pending');
-                // Fetch current gas price and increase it
-                let gasPrice = await this.provider.getGasPrice();
-                gasPrice = gasPrice.mul(ethers.BigNumber.from(110)).div(ethers.BigNumber.from(100));
-                const unicornTxn = await this.imageRegistryContract.addImage(
-                    ipfsHash, certContent, version, imageName, dockerComposeHash, enclaveNameSecureLock, fee,
-                    {
-                        nonce: nonce,
-                        gasPrice: gasPrice,
-                    });
-                // console.log("Transaction: ", unicornTxn);
-                const receipt = await this.imageRegistryContract.provider.waitForTransaction(unicornTxn.hash);
-
-                // console.log("transaction status: ", receipt.status);
-                console.log("transaction receipt: ", unicornTxn.hash);
-                if (receipt.status === 1) {
-                    console.log("Adding secure lock image cert transaction was successful!");
-                } else {
-                    // console.log("receipt.status", receipt.status)
-                    console.log("Image certificates already exist for this image!");
-                }
-            } else {
-                const unicornTxn = await this.imageRegistryContract.addImage(
-                    ipfsHash, certContent, version, imageName, dockerComposeHash, enclaveNameSecureLock, fee);
-                // console.log("Transaction: ", unicornTxn);
-                const receipt = await this.imageRegistryContract.provider.waitForTransaction(unicornTxn.hash);
-
-                // console.log("transaction status: ", receipt.status);
-                console.log("transaction receipt: ", unicornTxn.hash);
-                if (receipt.status === 1) {
-                    console.log("Adding secure lock image cert transaction was successful!");
-                } else {
-                    // console.log("receipt.status", receipt.status)
-                    console.log("Image certificates already exist for this image!");
-                }
-            }
-
-            // console.log("this.acct.address: ", this.acct.address);
-            // console.log("private key", PRIVATE_KEY);
-            // console.log('Getting nonce');
-            // const nonce = await this.imageRegistryContract.provider.getTransactionCount(this.acct.address);
-
-
-            // const signedTxn = await this.acct.signTransaction(unicornTxn);
-            // const receipt = await this.provider.sendTransaction(signedTxn.rawTransaction);
-        } catch (e) {
-            // console.error(e);
-            console.log("Image certificates already exist for this image!");
-        }
+        console.log("Adding secure lock image cert to image registry");
+        await this.write('addImage', ipfsHash, certContent, version, imageName, dockerComposeHash, enclaveNameSecureLock, fee);
+        console.log("Adding secure lock image cert transaction was successful!");
     }
 
     async getImagePublicKeyCert(ipfsHash) {
@@ -253,6 +226,18 @@ class ImageRegistry {
         const receipt = await this.provider.sendTransaction(signedTxn.rawTransaction);
     }
 
+    // Where the image's developer fee is paid. The registry records the
+    // publishing wallet at registration; only the image's owner changes it.
+    async setRewardAddress(ipfsHash, rewardAddress) {
+        const current = await this.imageRegistryContract.getRewardAddress(ipfsHash);
+        if (current.toLowerCase() === rewardAddress.toLowerCase()) {
+            console.log(`Reward address is already ${rewardAddress}`);
+            return;
+        }
+        console.log(`Setting the reward address to ${rewardAddress}`);
+        await this.write('changeImageRewardAddress', ipfsHash, rewardAddress);
+    }
+
     async getTrustedZoneCert(ipfsHash) {
         const cert = await this.imageRegistryContract.getTrustedZoneCert(ipfsHash);
         return cert;
@@ -283,14 +268,142 @@ class ImageRegistry {
             return ['', '', ''];
         }
     }
+
+    // Whether the registry is an ECImageRegistryV2 or later, which records an
+    // image before its certificate exists (registerImage, then setImageCert).
+    // A V1 registry has no pendingImages() and reverts; a node that does not
+    // answer is an error, not a V1 registry.
+    async isV2() {
+        try {
+            await this.imageRegistryContract.pendingImages();
+            return true;
+        } catch (e) {
+            if (isRevert(e)) return false;
+            throw e;
+        }
+    }
+
+    // The wallet that owns the securelock name on an ECImageRegistryV3 or
+    // later (the zero address while nobody does), or null on a registry
+    // without name owners. Only the owner publishes under the name, and a
+    // name and its -unsafe twin have one owner.
+    async imageNameOwner(imageName) {
+        try {
+            return await this.imageRegistryContract.imageNameOwner(imageName);
+        } catch (e) {
+            if (isRevert(e)) return null;
+            throw e;
+        }
+    }
+
+    // Send `method(...args)` from the publishing wallet. It is simulated
+    // first, so a call the registry refuses stops here with the registry's
+    // reason, then sent with its gas estimate plus 30%: what a registry write
+    // costs depends on the pending list, which other publishers change
+    // between the estimate and the block.
+    async write(method, ...args) {
+        try {
+            await this.imageRegistryContract.callStatic[method](...args);
+        } catch (e) {
+            throw new Error(`the image registry refuses ${method}: ${revertReason(e, this.imageRegistryContract.interface)}`);
+        }
+        const gas = await this.imageRegistryContract.estimateGas[method](...args);
+        const overrides = { gasLimit: gas.mul(13).div(10) };
+        if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
+            overrides.nonce = await this.provider.getTransactionCount(this.acct.address, 'pending');
+            overrides.gasPrice = (await this.provider.getGasPrice()).mul(110).div(100);
+        }
+        const tx = await this.imageRegistryContract[method](...args, overrides);
+        const receipt = await this.imageRegistryContract.provider.waitForTransaction(tx.hash);
+        console.log("transaction receipt: ", tx.hash);
+        if (receipt.status !== 1) {
+            throw new Error(`${method} reverted (${tx.hash})`);
+        }
+    }
+
+    // Record the securelock on a V2 registry before its certificate exists:
+    // name, protocol version v3, compose, session, the publisher's fee and the
+    // IPFS node that holds the image (a multiaddr, or ""). A hash this wallet
+    // already registered with the same name, compose and session is left as
+    // it is; a hash another wallet registered is refused, and so is a name
+    // another wallet owns. The record cannot be changed, so a hash registered
+    // with another compose or session is refused too: the nodes would fetch
+    // the compose the record names.
+    async registerImage(ipfsHash, imageName, dockerComposeHash, session, fee, ipfsPeer) {
+        const details = await this.imageRegistryContract.imageDetails(ipfsHash);
+        if (details.owner !== ethers.constants.AddressZero) {
+            if (details.owner.toLowerCase() !== this.acct.address.toLowerCase()) {
+                throw new Error(`${ipfsHash} is registered by ${details.owner}, not by this wallet`);
+            }
+            const differing = [
+                ['name', details.name, imageName],
+                ['compose', details.dockerComposeHash, dockerComposeHash],
+                ['session', details.session, session],
+            ].filter(([, recorded, wanted]) => recorded !== wanted);
+            if (differing.length) {
+                const recorded = differing.map(([field, value]) => `${field} ${value}`).join(', ');
+                const wanted = differing.map(([field, , value]) => `${field} ${value}`).join(', ');
+                throw new Error(`${ipfsHash} is registered with ${recorded}, and this publish has ${wanted}; run ecld-build to publish a new version`);
+            }
+            console.log(`${ipfsHash} is already registered`);
+            return false;
+        }
+        const nameOwner = await this.imageNameOwner(imageName);
+        if (nameOwner && nameOwner !== ethers.constants.AddressZero
+            && nameOwner.toLowerCase() !== this.acct.address.toLowerCase()) {
+            throw new Error(`the image name ${imageName} belongs to ${nameOwner}; publish under another PROJECT_NAME`);
+        }
+        console.log(`Registering ${imageName} v3 as ${ipfsHash} (compose ${dockerComposeHash}, peer ${ipfsPeer || 'none'})`);
+        await this.write('registerImage',
+            ipfsHash, "v3", imageName, dockerComposeHash, session, Number(fee), ipfsPeer || "");
+        return true;
+    }
+
+    // Write the certificate of a registered image, once, from the wallet that
+    // registered it. A certificate already there is left as it is. The RPC
+    // endpoint balances requests over nodes that can lag the chain by several
+    // blocks, and a read can fail outright, so an image this publish
+    // registered minutes earlier can read as missing, or be refused as "Image
+    // not found" by the simulation: both are tried again every 15 seconds for
+    // `waitMs` before the image is called missing.
+    async setImageCert(ipfsHash, cert, waitMs = 600000) {
+        const deadline = Date.now() + waitMs;
+        for (;;) {
+            let details = null;
+            try {
+                details = await this.imageRegistryContract.imageDetails(ipfsHash);
+            } catch (e) {
+                if (Date.now() >= deadline) throw e;
+            }
+            if (details && details.owner !== ethers.constants.AddressZero) {
+                if (details.certPublicKey) {
+                    if (details.certPublicKey.trim() === cert.trim()) {
+                        console.log(`The certificate of ${ipfsHash} is already registered`);
+                        return false;
+                    }
+                    throw new Error(`${ipfsHash} already has a certificate, and it differs from the extracted one`);
+                }
+                try {
+                    console.log(`Registering the certificate of ${ipfsHash}`);
+                    await this.write('setImageCert', ipfsHash, cert);
+                    return true;
+                } catch (e) {
+                    if (!(e.message || '').includes('Image not found') || Date.now() >= deadline) throw e;
+                }
+            } else if (details && Date.now() >= deadline) {
+                throw new Error(`${ipfsHash} is not registered`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 15000));
+        }
+    }
 }
 
 (async () => {
     try {
-        const [networkName, projectName, version, privateKey, action] = process.argv.slice(2);
+        const [networkName, projectName, version, action] = process.argv.slice(2);
         if (action === "validateAddress") {
-            if (privateKey) {
-                console.log(isStringPrivateKey(privateKey));
+            if (PRIVATE_KEY) {
+                console.log(isStringPrivateKey(PRIVATE_KEY));
             }
             process.exit(0);
         }
@@ -304,8 +417,8 @@ class ImageRegistry {
             process.exit(0);
         }
         // The certificate of the trustedzone's own record. getLatestImageVersionPublicKey
-        // reads the securelock records instead: ECImageRegistryV2 reverts it for
-        // a trustedzone, and the bloxberg mainnet and LitVM registries return a
+        // reads the securelock records instead: ECImageRegistryV2 and V3 revert it
+        // for a trustedzone, and the bloxberg mainnet and LitVM registries return a
         // different certificate for the same name.
         if (action === 'getTrustedZoneCert') {
             const imageRegistry = new ImageRegistry();
@@ -328,6 +441,47 @@ class ImageRegistry {
         }
 
         const imageRegistry = new ImageRegistry();
+        // Whether the registry records images before their certificate.
+        if (action === 'isV2') {
+            try {
+                console.log((await imageRegistry.isV2()) ? 'true' : 'false');
+            } catch (e) {
+                console.error(`Could not read the image registry ${IMAGE_REGISTRY_ADDRESS}: ${e.reason || e.message}`);
+                process.exit(1);
+            }
+            process.exit(0);
+        }
+        // Record the image before its certificate (V2): IPFS_HASH,
+        // IPFS_DOCKER_COMPOSE_HASH, PROJECT_NAME (the name registered),
+        // ENCLAVE_NAME_SECURELOCK (the session), DEVELOPER_FEE and IPFS_PEER
+        // (the publish's node) come from the environment.
+        if (action === 'registerImage') {
+            try {
+                const rewardAddress = rewardAddressFromEnv();
+                await imageRegistry.registerImage(
+                    process.env.IPFS_HASH || "", process.env.PROJECT_NAME || "",
+                    process.env.IPFS_DOCKER_COMPOSE_HASH || "", process.env.ENCLAVE_NAME_SECURELOCK || "",
+                    process.env.DEVELOPER_FEE || "0", process.env.IPFS_PEER || "");
+                if (rewardAddress) {
+                    await imageRegistry.setRewardAddress(process.env.IPFS_HASH || "", rewardAddress);
+                }
+            } catch (e) {
+                console.error(`Could not register the image: ${e.reason || e.message}`);
+                process.exit(1);
+            }
+            process.exit(0);
+        }
+        // Write the extracted certificate of a registered image (V2).
+        if (action === 'setImageCert') {
+            try {
+                const cert = fs.readFileSync("./registry/certificate.securelock.crt", 'utf8');
+                await imageRegistry.setImageCert(process.env.IPFS_HASH || "", cert);
+            } catch (e) {
+                console.error(`Could not register the certificate: ${e.reason || e.message}`);
+                process.exit(1);
+            }
+            process.exit(0);
+        }
         if (action === 'registerSecureLockImage') {
             const secureLock = fs.readFileSync("./registry/certificate.securelock.crt", 'utf8');
             // console.log("SECURELOCK:", secureLock);
@@ -357,7 +511,28 @@ class ImageRegistry {
             if (enclaveVersion && enclaveVersion !== "v3") versionKeys.push(enclaveVersion);
             for (const versionKey of versionKeys) {
                 console.log(`Registering securelock under version '${versionKey}'`);
-                await imageRegistry.addSecureLockImageCert(secureLock, ipfsHash, imageName, versionKey, ipfsDockerComposeHash, enclaveNameSecureLock, fee);
+                try {
+                    await imageRegistry.addSecureLockImageCert(secureLock, ipfsHash, imageName, versionKey, ipfsDockerComposeHash, enclaveNameSecureLock, fee);
+                } catch (e) {
+                    // The registry refuses a hash the (name, version) channel already holds.
+                    if ((e.message || '').includes('Image hash is already in registry')) {
+                        console.log(`The securelock is already registered under version '${versionKey}'`);
+                        continue;
+                    }
+                    console.error(`Could not register the securelock under version '${versionKey}': ${e.reason || e.message}`);
+                    process.exit(1);
+                }
+            }
+            // REWARD_ADDRESS: where the image's developer fee is paid, when not
+            // the publishing wallet.
+            try {
+                const rewardAddress = rewardAddressFromEnv();
+                if (rewardAddress) {
+                    await imageRegistry.setRewardAddress(ipfsHash, rewardAddress);
+                }
+            } catch (e) {
+                console.error(`Could not set the reward address: ${e.reason || e.message}`);
+                process.exit(1);
             }
             process.exit(0);
         }
@@ -367,6 +542,22 @@ class ImageRegistry {
             process.exit(0);
         }
         console.log(`Checking image: '${projectName}' on the ${networkName} blockchain...`);
+        // On a registry with name owners the name's owner answers, whether or
+        // not an image is certified under the name yet.
+        const nameOwner = await imageRegistry.imageNameOwner(projectName);
+        if (nameOwner !== null) {
+            if (nameOwner === ethers.constants.AddressZero) {
+                console.log(`Image: '${projectName}' is available on the ${networkName} blockchain.`);
+                process.exit(0);
+            }
+            if (PRIVATE_KEY && isStringPrivateKey(PRIVATE_KEY) === "OK"
+                && walletAddress(PRIVATE_KEY).toLowerCase() !== nameOwner.toLowerCase()) {
+                console.log(`!!! Image: '${projectName}' is owned by '${nameOwner}'.\nYou are not the account holder of the image.\nPlease change the project name and try again.\n`);
+                process.exit(1);
+            }
+            console.log(`Image: '${projectName}' is owned by '${nameOwner}'.\nIf you are not the account holder, you will not be able to publish your project with the current name. Please change the project name and try again.\n`);
+            process.exit(0);
+        }
         const imageHash = (await imageRegistry._getLatestImageVersionPublicKey(projectName, version))[0];
         console.log(`Image hash: ${imageHash}`);
         if (!imageHash) {
@@ -375,10 +566,9 @@ class ImageRegistry {
         }
         const imageOwner = (await imageRegistry.getImageDetails(imageHash))[0];
 
-        if (privateKey) {
-            if (isStringPrivateKey(privateKey) === "OK") {
-                const account = Account.fromPrivate(privateKey);
-                if (imageOwner !== account.address) {
+        if (PRIVATE_KEY) {
+            if (isStringPrivateKey(PRIVATE_KEY) === "OK") {
+                if (imageOwner.toLowerCase() !== walletAddress(PRIVATE_KEY).toLowerCase()) {
                     console.log(`!!! Image: '${projectName}' is owned by '${imageOwner}'.\nYou are not the account holder of the image.\nPlease change the project name and try again.\n`);
                     process.exit(1);
                 }

package/nodenithy/run/public_key_service.js

@@ -65,14 +65,21 @@ console.log("Docker Composer Hash:", dockerComposerHash);
     const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
     console.log("Submit IPFS Hash Response:", submitResponse);
 
-    // Check IPFS Hash Status
+    // The service answers publicKey 0 while the image is queued or running
+    // (with status, percent and queuePosition), -1 when the extraction failed
+    // (with reason) and the certificate when done.
     while (true) {
         const checkResponse = await checkIpfsHashStatus(hhash);
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
-                console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition || 'Unknown'}`);
+                if (checkResponse.status === "running") {
+                    console.log(`Public key extraction running, ${checkResponse.percent || 0}% done`);
+                } else {
+                    console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition ?? 'Unknown'}`);
+                }
             } else if (checkResponse.publicKey === -1) {
-                console.log("Hash is not derived from Eternity Cloud SDK.");
+                console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
+                console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
                 process.exit(1);
             } else {
                 console.log("Public Key:", checkResponse.publicKey);

package/nodenithy/run/public_key_service.py

@@ -83,16 +83,22 @@ if __name__ == "__main__":
     )
     print("Submit IPFS Hash Response:", submit_response)
 
-    # Check IPFS Hash Status
+    # The service answers publicKey 0 while the image is queued or running
+    # (with status, percent and queuePosition), -1 when the extraction failed
+    # (with reason) and the certificate when done.
     while True:
         check_response = check_ipfs_hash_status(hhash)
         if "publicKey" in check_response:
             if check_response["publicKey"] == 0:
-                print(
-                    f"Public key not available yet. Queue position: {check_response.get('queuePosition', 'Unknown')}"
-                )
-            elif check_response["publicKey"] == -1:
-                print("Hash is not derived from Eternity Cloud SDK.")
+                if check_response.get("status") == "running":
+                    print(f"Public key extraction running, {check_response.get('percent', 0)}% done")
+                else:
+                    print(
+                        f"Public key not available yet. Queue position: {check_response.get('queuePosition', 'Unknown')}"
+                    )
+            elif check_response["publicKey"] in (-1, "-1"):
+                print(f"Public key extraction failed: {check_response.get('reason', 'reason not reported by the service')}")
+                print("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.")
                 exit(1)
             else:
                 print("Public Key:", check_response["publicKey"])