@ethernity-cloud/sdk-js 1.7.1 → 1.7.8

package/nodenithy/run.js

@@ -8,6 +8,7 @@ const https = require('https');
 const casConfig = require('../cas/config.js');
 const casResolver = require('../cas/resolver.js');
 const sessionRegistry = require('../cas/session_registry.js');
+const { LocalKubo, ownEndpoint } = require('../localKubo.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -82,7 +83,7 @@ process.env.REGISTRY_PATH = `${currentDir}/registry`;
 const registryPath = process.env.REGISTRY_PATH;
 
 const runDockerCommand = (service) => {
-    const command = `docker-compose run -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
+    const command = `docker-compose run --rm -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
     const output = execSync(command).toString().trim();
     console.log(`Output of ${command}: ${output}`);
     return output.split('\n').filter(line => !/Creating|Pulling|latest|Digest/.test(line)).join('');
@@ -103,7 +104,7 @@ const extractSconeHash = (service) => {
 // extract_signed_mrenclave. Returns '' if the file is absent (testnet builds).
 const extractSignedMrenclave = (service) => {
     try {
-        const command = `docker-compose -f docker-compose.yml run --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
+        const command = `docker-compose -f docker-compose.yml run --rm --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
         const output = execSync(command, { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
         const m = output.match(/\b[a-fA-F0-9]{64}\b/);
         return m ? m[0] : '';
@@ -118,6 +119,79 @@ const main = async () => {
     // (etny-nodenithy v3/run/docker-compose.yml). The mainnet session named
     // below comes from the features/v3 branches, which ran it with 256M.
     const trustedZoneHeap = isMainnet ? '256M' : '1024M';
+
+    // Where the image goes. An IPFS API of the application's own
+    // (IPFS_ENDPOINT, when it is not the public one) takes precedence.
+    // Otherwise the publish runs its own Kubo: the public write API of
+    // ipfs.ethernity.cloud is closing, and the image is held by this Kubo,
+    // peered with the bootnode, until its certificate is on chain.
+    let localKubo = null;
+    let ipfsApi = process.env.IPFS_ENDPOINT || '';
+    if (!ownEndpoint(ipfsApi)) {
+        localKubo = new LocalKubo(process.env.PROJECT_NAME);
+        try {
+            await localKubo.start();
+        } catch (e) {
+            console.error(`Error: ${e.message}`);
+            process.exit(1);
+        }
+        ipfsApi = localKubo.apiUrl;
+        console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
+        process.on('exit', () => localKubo.release());
+    }
+
+    // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
+    // IPFS node stores and announces nothing. Set by hashForIpfs, after which
+    // uploadToIpfs refuses an upload that gives other CIDs.
+    let expectedCids = null;
+    const hashForIpfs = () => {
+        const hashOf = (target) => {
+            try {
+                const out = execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action hash ${target}`, { stdio: ['ignore', 'pipe', 'inherit'] });
+                return out.toString().trim().split('\n').pop().trim();
+            } catch (e) {
+                console.error(`Error: could not hash ${target} for IPFS: ${e.message}`);
+                process.exit(1);
+            }
+        };
+        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf('--filePath docker-compose-final.yml');
+        process.env.IPFS_HASH = hashOf(`--folderPath ${registryPath}`);
+        console.log("IPFS_DOCKER_COMPOSE_HASH (before upload): ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log("IPFS_HASH (before upload): ", process.env.IPFS_HASH);
+        expectedCids = { image: process.env.IPFS_HASH, compose: process.env.IPFS_DOCKER_COMPOSE_HASH };
+    };
+
+    // The compose and the image tree, added through ipfsApi; their CIDs land
+    // in IPFS_DOCKER_COMPOSE_HASH / IPFS_HASH (files and environment).
+    const uploadToIpfs = () => {
+        for (const file of ['IPFS_HASH.ipfs', 'IPFS_DOCKER_COMPOSE_HASH.ipfs']) {
+            if (fs.existsSync(file)) fs.unlinkSync(file);
+        }
+        console.log('Upload docker-compose-final.yml to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
+            console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_HASH.ipfs')) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (expectedCids && (process.env.IPFS_HASH !== expectedCids.image
+            || process.env.IPFS_DOCKER_COMPOSE_HASH !== expectedCids.compose)) {
+            console.error(`Error: the upload gave ${process.env.IPFS_HASH} (compose ${process.env.IPFS_DOCKER_COMPOSE_HASH}), not the registered ${expectedCids.image} (compose ${expectedCids.compose}).`);
+            process.exit(1);
+        }
+    };
+
     ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
         const template = `${file}.tmpl`;
         if (!fs.existsSync(template)) {
@@ -239,17 +313,19 @@ const main = async () => {
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
-    // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. On mainnet it
-    // is registered with the Scontain CAS. A self-signing testnet has none: a
-    // CAS-issued certificate would not match the key the enclave derives.
-    if (!cas) {
-        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
-    } else if (casTestnet) {
+    // POST. That happens once the image is registered, below: the
+    // SessionRegistry takes a securelock session only from the wallet that
+    // owns the image name. The publish then waits until the validators serve
+    // it, because the public-key harvest provisions the enclave from them. On
+    // mainnet it is registered with the Scontain CAS. A self-signing testnet
+    // has none: a CAS-issued certificate would not match the key the enclave
+    // derives.
+    const registerSessionOnChain = async () => {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
-            process.env.IPFS_ENDPOINT, '');
+            ipfsApi, '');
+        if (localKubo) await localKubo.provide(registered.cid);
         if (registered.registered) {
             console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
             await sessionRegistry.waitVisible(
@@ -257,7 +333,10 @@ const main = async () => {
         } else {
             console.log(`\t✔  Session ${registered.name} already registered on-chain with this body (${registered.hash})`);
         }
-    } else {
+    };
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (!casTestnet) {
     // don't generate new keys if PREDECESSOR_HASH_SECURELOCK is not empty and the key.pem and cert.pem files exist
     if (PREDECESSOR_HASH_SECURELOCK !== 'EMPTY' && fs.existsSync('key.pem') && fs.existsSync('cert.pem')) {
         console.log("Skipping keypair generation and certificate creation.");
@@ -407,15 +486,20 @@ const main = async () => {
     console.log("# Update docker-compose files");
 
     // On a CAS-attested testnet the compose names the CAS both enclaves are
-    // provisioned from (a validator resolved from the registry, or
-    // ECLD_CAS_ADDR; the node re-resolves it before each task) and the
-    // trustedzone session the ImageRegistry records for this template.
+    // provisioned from and the trustedzone session the ImageRegistry records
+    // for this template. docker-compose.yml, which harvests the certificate
+    // here, names a validator that answered (or ECLD_CAS_ADDR); the published
+    // docker-compose-final.yml names the first validator in registry order,
+    // so that a rerun of this publish renders the same compose. The node and
+    // the extraction service resolve a CAS again before they run it.
     let casAddr = null;
+    let publishedCasAddr = null;
     let trustedZoneSession = null;
     if (casTestnet) {
         casAddr = await casResolver.casAddressFor(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
-        console.log(`\t✔  CAS for this network: ${casAddr}`);
-        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneSession"`).toString().trim();
+        publishedCasAddr = await casResolver.publishedCasAddress(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
+        console.log(`\t✔  CAS for this network: ${casAddr} (the published compose names ${publishedCasAddr})`);
+        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneSession"`).toString().trim();
         if (!trustedZoneSession) {
             console.error(`ERROR! The ImageRegistry records no trustedzone session for ${templateName}.`);
             process.exit(1);
@@ -455,7 +539,8 @@ const main = async () => {
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
         if (casTestnet) {
-            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${casAddr}`);
+            const fileCasAddr = file === 'docker-compose-final.yml' ? publishedCasAddr : casAddr;
+            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${fileCasAddr}`);
         }
 
         fs.writeFileSync(file, updatedContent, 'utf8');
@@ -479,7 +564,33 @@ const main = async () => {
     // let PUBLIC_KEY_SECURELOCK_RES = execSync(`docker-compose run etny-securelock 2>/dev/null | grep -v Creating | grep -v Pulling | grep -v latest | grep -v Digest | sed 's/.*PUBLIC_KEY:\\s*//' | tr -d '\\r'`).toString().trim();
 
 
-    // TODO: calculate hash of the files localy, and query the public key service, if the hash is already there it means we dont have to do the below.
+    // The image and its compose go out before the certificate is extracted,
+    // whichever way it is: the extraction service fetches them by these CIDs.
+    // On a two-step registry (ECImageRegistryV2 and later) the wallet records
+    // the image first (registerImage, with the publish's node), under the
+    // CIDs the upload gives, hashed before anything is stored. On
+    // ECImageRegistryV3 that binds the image name to this wallet before the
+    // upload, the session registration or anything else discloses it. The
+    // bootnode's mirror then pins the image and the extraction service queues
+    // it from the chain; the certificate is written below by the same wallet
+    // (setImageCert). A V1 registry takes both in one addImage call.
+    const registryV2 = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "isV2"`, { env: { ...process.env, PROJECT_NAME: securelock } }).toString().trim() === 'true';
+    let ipfsPeer = '';
+    if (registryV2) {
+        hashForIpfs();
+        if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+        // From here the registered image's source is this Kubo, until its
+        // certificate is on chain.
+        if (localKubo) localKubo.serving = true;
+    }
+    uploadToIpfs();
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
+    if (registryV2 && localKubo) {
+        await localKubo.provide(process.env.IPFS_HASH);
+        await localKubo.provide(process.env.IPFS_DOCKER_COMPOSE_HASH);
+    }
+    if (casTestnet) await registerSessionOnChain();
 
     if (fs.existsSync('certificate.securelock.crt')) {
         // delete it
@@ -488,7 +599,7 @@ const main = async () => {
 
     let PUBLIC_KEY_SECURELOCK_RES = '';
     try {
-        const output = execSync(`docker-compose run etny-securelock`, { cwd: runDir }).toString();
+        const output = execSync(`docker-compose run --rm etny-securelock`, { cwd: runDir }).toString();
         console.log("Output of docker-compose run etny-securelock:");
         // Extract the WHOLE multi-line PEM certificate block from the enclave
         // output. A previous version grabbed only the single line containing
@@ -521,43 +632,6 @@ const main = async () => {
             process.exit(0);
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
-            console.log("**** Started ipfs initial pining ****");
-            if (fs.existsSync('IPFS_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_HASH.ipfs');
-            }
-            if (fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_DOCKER_COMPOSE_HASH.ipfs');
-            }
-
-
-            console.log('Upload docker-compose-final.yml to IPFS');
-            const dockerHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
-            if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
-            console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
-            writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
-            console.log()
-            await new Promise(resolve => setTimeout(resolve, 3000));
-
-            console.log('Upload docker registry to IPFS');
-            const repositoryHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-            if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-                console.error("Error: Could not upload registry to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-            console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-            writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-
-            console.log()
-
-            console.log("**** Finished ipfs initial pining ****");
-            console.log()
-            console.log()
-
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
             execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
@@ -614,7 +688,7 @@ const main = async () => {
     }
 
     // const scriptPath = path.resolve(__dirname, '/image_registry.js');
-    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneCert"`).toString().trim();
+    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneCert"`).toString().trim();
 
     console.log("trustedZoneCert: ", trustedZoneCert);
 
@@ -631,41 +705,43 @@ const main = async () => {
     console.log("Listing certificate PUBLIC_KEY_TRUSTEDZONE:");
     console.log(fs.readFileSync('certificate.trustedzone.crt', 'utf8'));
 
+    // image_registry.js reads the securelock certificate from registry/.
     fs.copyFileSync('certificate.securelock.crt', `${registryPath}/certificate.securelock.crt`);
     fs.copyFileSync('certificate.trustedzone.crt', `${registryPath}/certificate.trustedzone.crt`);
 
-    if (fs.existsSync('IPFS_HASH.ipfs')) {
-        fs.unlinkSync('IPFS_HASH.ipfs');
-    }
-
-    console.log('Upload docker registry to IPFS');
-    execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-    if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-        console.error("Error: Could not upload registry to IPFS, please try again!");
-        process.exit(1);
-    }
-    process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-    console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-    writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-    process.chdir(currentDir);
-    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
-    // image_registry.js registers the image under PROJECT_NAME.
-    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
-    let existing = false;
-    try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
-        if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
-            console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
+    if (registryV2) {
+        // The registered hash is the tree uploaded before the extraction.
+        process.chdir(currentDir);
+        console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+        if (localKubo) localKubo.serving = false;
+    } else {
+        // A V1 registry gets the tree that carries the certificate files,
+        // uploaded again, with the certificate, in one addImage call.
+        if (fs.existsSync('IPFS_HASH.ipfs')) {
+            fs.unlinkSync('IPFS_HASH.ipfs');
+        }
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (localKubo) await localKubo.provide(process.env.IPFS_HASH);
+        process.chdir(currentDir);
+        console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+        // image_registry.js registers the image under PROJECT_NAME and prints
+        // why when it cannot.
+        registryEnv.IPFS_HASH = process.env.IPFS_HASH;
+        try {
+            execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
+        } catch (error) {
+            console.error("Error: Could not add the certificates of the SECURELOCK to the IMAGE REGISTRY smart contract");
+            process.exit(1);
         }
-        existing = true;
-    } catch (error) {
-        // console.error("Error: Could not add certificates for SECURELOCK into IMAGE REGISTRY smart contract");
-        // console.error(error);
-        // process.exit(1);
-    }
-
-    if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.1",
+  "version": "1.7.8",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
+    "test": "node --test \"test/**/*.test.js\"",
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
     "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
     "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
@@ -32,11 +33,13 @@
     "info.js",
     "run.js",
     "network.js",
+    "localKubo.js",
+    "revert.js",
     "!**/__pycache__/**",
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.1",
+    "@ethernity-cloud/runner": "^0.6.3",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/publish.js

@@ -46,6 +46,10 @@ async function prompt(question) {
     const { PROJECT_NAME, BLOCKCHAIN_NETWORK, PRIVATE_KEY, DEVELOPER_FEE, SERVICE_TYPE } = process.env;
     const scriptPath = path.resolve(__dirname, 'nodenithy/run/image_registry.js');
     process.env.NODE_NO_WARNINGS = 1
+    // image_registry.js reads the wallet's key from PRIVATE_KEY in its
+    // environment, never from its command line.
+    const registry = (args, privateKey) => execSync(`node ${scriptPath} ${args}`,
+        { env: { ...process.env, PRIVATE_KEY: privateKey } }).toString().trim();
     let result = '';
     if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK || !PRIVATE_KEY || !DEVELOPER_FEE) {
         const hasWallet = await prompt('Do you have an existing wallet? (yes/no) (default value: no) ') || 'no';
@@ -57,12 +61,12 @@ async function prompt(question) {
         }
 
         let privateKey = await prompt('Enter your private key: ');
-        result = execSync(`node ${scriptPath} "" "" "" "${privateKey}" "validateAddress"`).toString().trim();
+        result = registry('"" "" "" "validateAddress"', privateKey);
 
         while (result !== 'OK') {
             console.log(result);
             privateKey = await prompt('Invalid private key. Please enter a valid private key: ');
-            result = execSync(`node ${scriptPath} "" "" "" "${privateKey}" "validateAddress"`).toString().trim();
+            result = registry('"" "" "" "validateAddress"', privateKey);
         }
 
         console.log('Inputted Private key is valid.');
@@ -70,32 +74,40 @@ async function prompt(question) {
         console.log()
         console.log('Checking blockchain for required funds...');
 
-        result = execSync(`node ${scriptPath} "" "" "" "" "checkBalance"`).toString().trim();
+        result = registry('"" "" "" "checkBalance"', privateKey);
 
         console.log(`Available funds: ${result}`);
         console.log()
         const imageName = casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK);
         console.log(`Checking if project name ${imageName} is available on ${BLOCKCHAIN_NETWORK} network and ownership...`);
-        result = execSync(`node ${scriptPath} ${BLOCKCHAIN_NETWORK} ${imageName} ${process.env.VERSION} ${process.env.PRIVATE_KEY}`,).toString().trim();
+        // Exits 1, with the owner, when another wallet owns the name.
+        try {
+            result = registry(`${BLOCKCHAIN_NETWORK} ${imageName} ${process.env.VERSION}`, privateKey);
+        } catch (e) {
+            console.log((e.stdout || '').toString().trim());
+            process.exit(1);
+        }
         console.log(result);
         console.log()
 
-        const taskPercentage = await prompt('Please specify the % of a task which will be transferred to your wallet upon successful execution (default 10%): ') || '10';
+        // The publisher's fee, in percent of each task's base price: PoX adds it
+        // to what the dApp user pays and pays it to the image's reward address.
+        const taskPercentage = await prompt('Your fee as the publisher of this image, in % of each task\'s base price, 0 to 15 (default 0): ') || '0';
         writeEnv('DEVELOPER_FEE', taskPercentage);
     } else {
         console.log('Using PROJECT_NAME, BLOCKCHAIN_NETWORK, PRIVATE_KEY, DEVELOPER_FEE from .env');
         console.log('Checking blockchain for required funds...');
-        result = result = execSync(`node ${scriptPath} "" "" "" "" "checkBalance"`).toString().trim();
+        result = registry('"" "" "" "checkBalance"', PRIVATE_KEY);
 
         console.log(`Available funds: ${result}`);
         console.log()
         let privateKey = PRIVATE_KEY;
-        result = execSync(`node ${scriptPath} "" "" "" "${privateKey}" "validateAddress"`).toString().trim();
+        result = registry('"" "" "" "validateAddress"', privateKey);
 
         while (result !== 'OK') {
             console.log(result);
             privateKey = await prompt('Invalid private key. Please enter a valid private key: ');
-            result = execSync(`node ${scriptPath} "" "" "" "${privateKey}" "validateAddress"`).toString().trim();
+            result = registry('"" "" "" "validateAddress"', privateKey);
         }
         writeEnv('PRIVATE_KEY', privateKey);
     }

package/pynithy/build/securelock/src/securelock.py.tmpl

@@ -149,6 +149,16 @@ class EtnySecureLock:
         logging.info("Generated key and cert in memory based on MR_ENCLAVE")
         return private_key_pem, cert_pem
 
+    # The node-supplied bucket .env may only contribute the per-task order id.
+    # Everything else the securelock trusts is a per-network build constant
+    # (chain id, PoX contract, Image Registry, Web3 provider, ValidatorRegistry,
+    # bucket) set in __set_initializers, or a variable the CAS injects into the
+    # enclave process environment (ECAS_*, SCONE_*). Any key outside this set,
+    # and any key already present in the environment, is ignored.
+    NODE_ENV_ALLOWLIST = frozenset({
+        'ETNY_ORDER_ID',
+    })
+
     @staticmethod
     def read_env_str(env_str: str):
         with io.StringIO(env_str) as f:
@@ -156,7 +166,13 @@ class EtnySecureLock:
                 if '=' not in line:
                     continue
                 key, value = line.split('=', 1)
-                os.environ[key.strip()] = re.sub(r'\n', '', value.strip())
+                key = key.strip()
+                if key not in EtnySecureLock.NODE_ENV_ALLOWLIST:
+                    logging.info(f"Ignoring non-allowlisted .env key from the node bucket: {key}")
+                    continue
+                if key in os.environ:
+                    continue
+                os.environ[key] = re.sub(r'\n', '', value.strip())
     def validate_client_payload(self):
         payload_data = self.__get_file_content_and_decrypt(self.payload)
         input_data = self.__get_file_content_and_decrypt(self.input)
@@ -588,14 +604,10 @@ class EtnySecureLock:
         with open(path, 'r') as f:
             return f.read()
     def __load_env(self):
-        if os.getenv('ETNY_CHAIN_ID'):
-            self.chain_id = int(os.getenv('ETNY_CHAIN_ID'))
-        if os.getenv('ETNY_SMART_CONTRACT_ADDRESS'):
-            self.smart_contract_address = os.getenv('ETNY_SMART_CONTRACT_ADDRESS').rstrip()
-        if os.getenv('ETNY_WEB3_PROVIDER'):
-            self.web3_provider = os.getenv('ETNY_WEB3_PROVIDER').rstrip()
-        if os.getenv('IMAGE_REGISTRY_ADDRESS'):
-            self.image_registry_address = os.getenv('IMAGE_REGISTRY_ADDRESS').rstrip()
+        # The chain id, PoX contract, Image Registry and Web3 provider are the
+        # build constants of __set_initializers and are never read from the
+        # environment: the node supplies the environment, and an override would
+        # let it choose the registry the trustedzone's certificate comes from.
         self.order_id = int(os.getenv('ETNY_ORDER_ID'))
 
     def save_result(self):

package/pynithy/build.mjs

@@ -31,9 +31,9 @@ const writeEnv = (key, value) => {
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml (the authoritative
 // on-chain constants). Covers all supported networks for both dApp types.
 export const ECRunner = {
-  // --- bloxberg (the testnet reads ECImageRegistryV2, mainnet the original) ---
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  // --- bloxberg (the testnet reads ECImageRegistryV3, mainnet the original) ---
+  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   // --- polygon mainnet ---
@@ -52,8 +52,8 @@ export const ECRunner = {
   'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   // --- the -unsafe networks: the contracts of the network each is named after ---
-  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
-  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
@@ -99,11 +99,12 @@ const runCommand = (command, canPass = false) => {
 
 // Removes the containers this build and publish create, matched by exact name:
 // `--filter name=` matches a substring, so name=las would also match the LAS of
-// a CAS validator set on the same host.
+// a CAS validator set on the same host. `-v` removes their anonymous volumes
+// too: registry:2 keeps its pushed images in one, about 1.3 GB per build.
 const removeContainer = (name) => {
   const ids = shell.exec(`docker ps -a -q --filter "name=^/${name}$"`, { silent: true }).stdout.trim();
   if (ids) {
-    runCommand(`docker rm -f ${ids.split('\n').join(' ')}`);
+    runCommand(`docker rm -f -v ${ids.split('\n').join(' ')}`);
   }
 };