npm - @ethernity-cloud/sdk-js - Versions diffs - 1.7.10 → 1.7.13 - Mend

@ethernity-cloud/sdk-js 1.7.10 → 1.7.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/README.md +22 -8
package/cas/config.js +32 -2
package/info.js +8 -0
package/init.js +2 -0
package/network.js +6 -4
package/nodenithy/build.mjs +6 -4
package/nodenithy/run/image_registry.js +11 -0
package/nodenithy/run/public_key_service.js +75 -28
package/nodenithy/run.js +11 -13
package/package.json +2 -2
package/pynithy/build/securelock/Dockerfile.tpl +131 -131
package/pynithy/build/securelock/src/securelock.py.tmpl +9 -0
package/pynithy/build.mjs +6 -4
package/pynithy/run/image_registry.js +11 -0
package/pynithy/run/public_key_service.js +86 -28
package/pynithy/run.js +11 -14
package/run.js +2 -2

package/README.md CHANGED Viewed

@@ -59,20 +59,26 @@ The sdk has been tested on the following operating systems:
       validator set (SessionRegistry `0xfA70B5Df...`, ValidatorRegistry
       `0xbE3759f3...`).
     - LiteForge Unsafe - the unsafe network beside LiteForge (see below).
+- Ethereum:
+    - Sepolia - CAS-attested the same way, by Sepolia's own ethernity-cas
+      validator set (SessionRegistry `0xDbB249E1...`, ValidatorRegistry
+      `0x8ad24b3F...`), on the PoX family of 2026-10-14.
+    - Sepolia Unsafe - the unsafe network beside Sepolia (see below).
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates
     - Mainnet - to be provided during the following updates
-The remaining testnets (Amoy, IoTeX, Sepolia) have no ethernity-cas
+The remaining testnets (Amoy, IoTeX) have no ethernity-cas
 deployment: their enclaves are debug-signed and sign their own certificates
 from their measurement, and `ecld-publish` registers no CAS session for them.
 ### The testnets and their unsafe networks
-`Bloxberg Testnet` and `LitVM LiteForge` run your securelock in an enclave
+`Bloxberg Testnet`, `LitVM LiteForge` and `Ethereum Sepolia` run your securelock in an enclave
 attested through that chain's ethernity-cas validator set, on nodes whose
 platform the CAS can attest (DCAP). Each has an unsafe network beside it,
-`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`) and `LitVM LiteForge
-Unsafe` (`LitVM_LiteForge_Unsafe`): the same chain and contracts, for hardware
+`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`), `LitVM LiteForge
+Unsafe` (`LitVM_LiteForge_Unsafe`) and `Ethereum Sepolia Unsafe`
+(`Ethereum_Sepolia_Unsafe`): the same chain and contracts, for hardware
 SGX platforms the CAS cannot attest (EPID-only, SGX1). No CAS and no LAS: the
 enclaves are debug-signed and sign their own certificates from their
 measurement, so a result proves which image ran but not that an enclave ran
@@ -82,7 +88,8 @@ always says so in the network it names. A dApp publishes one securelock per
 network from two project directories with the same project name: the unsafe
 one is registered as `<project>-unsafe` and runs on the
 `etny-<nodenithy|pynithy>-testnet-unsafe`
-(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`) trustedzone. Both dApp types
+(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`,
+`ecld-<nodenithy|pynithy>-ethereum-sepolia-unsafe`) trustedzone. Both dApp types
 build for both networks. Mainnet has no unsafe network.
 ### Pynithy dApps
@@ -135,7 +142,11 @@ sets the enclave heap (default `1024M`).
   bootnode and reports its progress) and writes it from the same wallet
   (`setImageCert`). Keep the publish running until it prints the registration:
   your node is the image's first source. `ECLD_KUBO_SWARM_PORT` (default
-  4001) is the port your node listens on when it is free.
+  4001) is the port your node listens on when it is free. `ECLD_ASSUME_YES=1`
+  accepts the extraction-service prompt without asking, for a publish run
+  from a script. On a two-step registry the publish waits up to three
+  minutes for the service to queue the image from the chain event before
+  posting the hash itself.
 - **Test (local, no chain)**: To run your backend locally with the enclave's own
   executor — no SGX, no gas, instant — run:
@@ -175,9 +186,12 @@ sets the enclave heap (default `1024M`).
   intake once the request is on chain; `--ipfs <url>` writes and reads through
   that IPFS RPC API instead, with `ECLD_IPFS_TOKEN` (or `IPFS_TOKEN`) as its
   Authorization header, and a URL naming the public API is refused without one.
+  The chain calls of a run go through the network's own RPC (publicnode's Sepolia
+  endpoint, LitVM's Caldera endpoint, IoTeX's babel API); the runner's defaults
+  cover the other networks.
   The intake serves the networks the bootnode's agent runs, today the bloxberg
-  testnet and LitVM LiteForge, each with its unsafe twin: a dApp on any other
-  network (Bloxberg mainnet, Polygon, IoTeX, Sepolia) needs an IPFS API of its
+  testnet, LitVM LiteForge and Ethereum Sepolia, each with its unsafe twin: a dApp on any other
+  network (Bloxberg mainnet, Polygon, IoTeX) needs an IPFS API of its
   own (`IPFS_ENDPOINT` for the Hello World template, `--ipfs <url>` for `ecld-run`).
   Exit code 0 on a `SUCCESS` task result, 1 otherwise. `--unsafe` runs the
   network's unsafe variant; on an unsafe network the securelock and

package/cas/config.js CHANGED Viewed

@@ -18,6 +18,8 @@ const VALIDATOR_REGISTRY = {
   'etny-nodenithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
   'ecld-pynithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
+  'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-nodenithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
 };
 const SESSION_REGISTRY = {
@@ -25,14 +27,20 @@ const SESSION_REGISTRY = {
   'etny-nodenithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
   'ecld-pynithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
   'ecld-nodenithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
+  // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
+  'ecld-pynithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
+  'ecld-nodenithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
 };
-// The chain the registries above live on.
+// The chain the registries above live on. Sepolia's RPC is Tenderly's gateway:
+// publicnode caps eth_getLogs at 50,000 blocks and prunes older ranges.
 const CHAIN = {
   'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'ecld-pynithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
   'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
+  'ecld-pynithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
+  'ecld-nodenithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
 };
 // Whether the securelock takes its certificate from a CAS session: mainnet
@@ -55,6 +63,7 @@ const isMainnetNetwork = (network) =>
 const UNSAFE_NETWORKS = {
   Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
   LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
+  Ethereum_Sepolia_Unsafe: 'Ethereum_Sepolia',
 };
 // Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network
@@ -62,6 +71,26 @@ const UNSAFE_NETWORKS = {
 const isUnsafeNetwork = (network) =>
   Object.keys(UNSAFE_NETWORKS).some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+// The testnets, by BLOCKCHAIN_NETWORK: every network ecld-init offers but the
+// two mainnets, the -unsafe ones included. A session relaxes attestation on
+// these alone (sessionAttestation).
+const TESTNETS = [
+  'Bloxberg_Testnet', 'Polygon_Amoy_Testnet', 'IoTeX_Testnet', 'Ethereum_Sepolia', 'LitVM_LiteForge',
+  ...Object.keys(UNSAFE_NETWORKS),
+];
+const isTestnetNetwork = (network) =>
+  TESTNETS.some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+// The attestation rules a securelock session declares on `network`, as the
+// YAML flow sequences its template takes for __TOLERATE__ and
+// __IGNORE_ADVISORIES__. A testnet tolerates a debug-signed enclave and ignores
+// every Intel advisory. Any other network, a mainnet or a name not in TESTNETS,
+// gets the production rules: no debug-mode, and INTEL-SA-00615 the one
+// advisory ignored.
+const sessionAttestation = (network) => (isTestnetNetwork(network)
+  ? { tolerate: '[hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]', ignoreAdvisories: '["*"]' }
+  : { tolerate: '[hyperthreading, outdated-tcb, software-hardening-needed]', ignoreAdvisories: '["INTEL-SA-00615"]' });
 // The name an image is registered and run under on `network`: <name>-unsafe
 // on an -unsafe network. A dApp's securelock is <project>-unsafe there, so its
 // two variants never share an image name, and an -unsafe network's
@@ -90,5 +119,6 @@ const renderCompose = (content, cas, unsafe) => content
 module.exports = {
   VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
-  UNSAFE_NETWORKS, isUnsafeNetwork, nameOnNetwork, sessionTag, renderCompose,
+  UNSAFE_NETWORKS, isUnsafeNetwork, TESTNETS, isTestnetNetwork, sessionAttestation,
+  nameOnNetwork, sessionTag, renderCompose,
 };

package/info.js CHANGED Viewed

@@ -55,6 +55,14 @@ const NETWORKS = {
     imageRegistry: '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D',
     esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
+  // The family of 2026-10-14, owned by 0xA247...; the previous PoX 0x29D3eC87...
+  // and V1 registry 0x55e0ad45... are abandoned.
+  ETHEREUM_SEPOLIA: {
+    type: 'testnet', chainId: 11155111, rpc: 'https://sepolia.gateway.tenderly.co',
+    protocol: '0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c',
+    imageRegistry: '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F',
+    esr: '0x9927809B61122B2af3f3b3A3303875e0687b8eE3',
+  },
 };
 // The -unsafe networks: the chain and contracts of the network each is the
 // unsafe variant of, without a CAS.

package/init.js CHANGED Viewed

@@ -214,6 +214,7 @@ const main = async () => {
     "LitVM LiteForge",
     "Bloxberg Testnet Unsafe",
     "LitVM LiteForge Unsafe",
+    "Ethereum Sepolia Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -390,6 +391,7 @@ const main = async () => {
     "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
     "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
     "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
+    "Ethereum Sepolia Unsafe": `ecld-${svc}-ethereum-sepolia-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);

package/network.js CHANGED Viewed

@@ -14,13 +14,14 @@
 const casConfig = require('./cas/config.js');
 /* Accepts a few spellings per network. Returns the normalised key, the
- * network ({ address, chainId?, unsafe? }) or null, and the known keys. */
+ * network ({ address, chainId?, unsafe? }) or null, and the known keys; rpcUrl names
+ * the RPC of a network whose token the runner cannot key an RPC by. */
 function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
   const key = String(raw || '').trim().toUpperCase().replace(/\s+/g, '_');
   const bloxbergTestnet = { address: ECAddress.BLOXBERG.TESTNET_ADDRESS };
   const amoy = { address: ECAddress.POLYGON.TESTNET_ADDRESS };
-  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET };
-  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET };
+  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET, rpcUrl: 'https://ethereum-sepolia-rpc.publicnode.com' };
+  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET, rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http' };
   const table = {
     BLOXBERG_TESTNET: bloxbergTestnet,
     BLOXBERG_TESTNET_UNSAFE: { ...bloxbergTestnet, unsafe: ['BLOXBERG', 'TESTNET_UNSAFE'] },
@@ -28,9 +29,10 @@ function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
     POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
     POLYGON_AMOY: amoy,
     POLYGON_AMOY_TESTNET: amoy,
-    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET },
+    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET, rpcUrl: 'https://babel-api.testnet.iotex.io' },
     ETHEREUM_SEPOLIA: sepolia,
     SEPOLIA: sepolia,
+    ETHEREUM_SEPOLIA_UNSAFE: { ...sepolia, unsafe: ['SEPOLIA', 'TESTNET_UNSAFE'] },
     LITVM_LITEFORGE: litvm,
     LITVM: litvm,
     LITVM_LITEFORGE_UNSAFE: { ...litvm, unsafe: ['LITVM', 'TESTNET_UNSAFE'] },

package/nodenithy/build.mjs CHANGED Viewed

@@ -45,9 +45,11 @@ export const ECRunner = {
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
-  // --- ethereum sepolia ---
-  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- ethereum sepolia: the family of 2026-10-14 (PoX EthernityImplementationV2 1.1, ECImageRegistryV3) ---
+  'ecld-pynithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-pynithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
   'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
@@ -259,7 +261,7 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\r?\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 // Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
 // run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.

package/nodenithy/run/image_registry.js CHANGED Viewed

@@ -41,6 +41,17 @@ function setVars(network = "") {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
         IMAGE_REGISTRY_ADDRESS = "0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D";
         CHAIN_ID = 4441;
+    } else if (BLOCKCHAIN_NETWORK.includes("Sepolia")) {
+        // Sepolia's ECImageRegistryV3 of 2026-10-14; Tenderly's gateway serves
+        // the log ranges publicnode prunes.
+        NETWORK_RPC = "https://sepolia.gateway.tenderly.co";
+        IMAGE_REGISTRY_ADDRESS = "0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F";
+        CHAIN_ID = 11155111;
+        // Sepolia's EVM charges storage-heavy calls several times the local
+        // EVM's gas (a contract creation about seven times); the base fee is
+        // under 0.0001 gwei, so 0.1 gwei is paid in full as the tip.
+        GAS = 20000000;
+        GAS_PRICE = 100000000;
     }
 }

package/nodenithy/run/public_key_service.js CHANGED Viewed

@@ -1,9 +1,19 @@
+// The publish's client of publickey.ethernity.cloud, the certificate
+// extraction service: queues the image and polls for its certificate.
+//
+// An image registered on chain first (--chain-registered, the two-step
+// registries) is queued by the service's registry watcher from the
+// ImageRegistered event, with this publish's IPFS peer; the hash is posted to
+// /api/addHash only when that row has not appeared within
+// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
-const program = new Command();
 const BASE_URL = "https://publickey.ethernity.cloud";
+// The watcher polls the registries every 30 s.
+const CHAIN_ROW_GRACE_SECONDS = 180;
+const POLL_SECONDS = 10;
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -17,7 +27,6 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     };
     try {
         const response = await axios.post(url, payload);
-        // console.log(`response: ${response}`);
         return response.data;
     } catch (error) {
         console.error("Error:", error.response ? error.response.data : error.message);
@@ -25,51 +34,84 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     }
 }
+// The service's answer for the hash, or null while the service does not
+// know the hash yet (404).
 async function checkIpfsHashStatus(hash) {
     const url = `${BASE_URL}/api/checkHash/${hash}`;
     try {
         const response = await axios.get(url);
         return response.data;
     } catch (error) {
+        if (error.response && error.response.status === 404) return null;
         console.error("Error:", error.response ? error.response.data : error.message);
         process.exit(1);
     }
 }
-program
-    .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
-    .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
-    .requiredOption('--network <network>', 'Network')
-    .requiredOption('--template_version <templateVersion>', 'Template version');
+// Queues the image as described above and returns the service's first
+// answer for it. `submit`, `check`, `sleep` and `now` are the functions
+// above and the clock, replaceable for tests.
+async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
+    sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
+    log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
+    if (chainRegistered) {
+        const deadline = now() + graceSeconds;
+        while (true) {
+            const answer = await check(hash);
+            if (answer !== null) return answer;
+            if (now() >= deadline) {
+                log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
+                break;
+            }
+            log("Waiting for the certificate service to pick the registration up from the chain...");
+            await sleep(pollSeconds);
+        }
+    }
+    const submitResponse = await submit(hash, ...submitArgs);
+    log("Submit IPFS Hash Response:", submitResponse);
+    return null;
+}
-program.parse(process.argv);
+async function main() {
+    const program = new Command();
+    program
+        .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
+        .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
+        .requiredOption('--network <network>', 'Network')
+        .requiredOption('--template_version <templateVersion>', 'Template version')
+        .option('--chain-registered', 'the image is registered on chain; wait for the service to queue it from the event before posting the hash');
+    program.parse(process.argv);
-const options = program.opts();
-const enclaveName = options.enclave_name;
-const protocolVersion = options.protocol_version;
-const network = options.network.toLowerCase().split("_")[1];
-const templateVersion = options.template_version;
+    const options = program.opts();
+    const enclaveName = options.enclave_name;
+    const protocolVersion = options.protocol_version;
+    const network = options.network.toLowerCase().split("_")[1];
+    const templateVersion = options.template_version;
-const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
-const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+    const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+    const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
-console.log("IPFS Hash:", hhash);
-console.log("Enclave Name:", enclaveName);
-console.log("Protocol Version:", protocolVersion);
-console.log("Network:", network);
-console.log("Template Version:", templateVersion);
-console.log("Docker Composer Hash:", dockerComposerHash);
+    console.log("IPFS Hash:", hhash);
+    console.log("Enclave Name:", enclaveName);
+    console.log("Protocol Version:", protocolVersion);
+    console.log("Network:", network);
+    console.log("Template Version:", templateVersion);
+    console.log("Docker Composer Hash:", dockerComposerHash);
-(async () => {
-    // Submit IPFS Hash
-    const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
-    console.log("Submit IPFS Hash Response:", submitResponse);
+    let checkResponse = await queueImage({
+        hash: hhash, chainRegistered: Boolean(options.chainRegistered),
+        submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
+    });
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
     // (with reason) and the certificate when done.
     while (true) {
-        const checkResponse = await checkIpfsHashStatus(hhash);
+        if (checkResponse === null) {
+            await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+            checkResponse = await checkIpfsHashStatus(hhash);
+            continue;
+        }
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
                 if (checkResponse.status === "running") {
@@ -103,6 +145,11 @@ console.log("Docker Composer Hash:", dockerComposerHash);
             process.exit(1);
         }
-        await new Promise(resolve => setTimeout(resolve, 10000)); // Wait for 10 seconds before checking again
+        await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+        checkResponse = await checkIpfsHashStatus(hhash);
     }
-})();
+}
+if (require.main === module) main();
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };

package/nodenithy/run.js CHANGED Viewed

@@ -177,7 +177,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -186,7 +186,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -258,15 +258,13 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        // Mainnet attests production enclaves only; a testnet tolerates a
-        // debug-signed one. Both lines were edited by text replacement, which
-        // had to repeat the advisory list verbatim to delete it and broke the
-        // moment either string moved. Written out per network instead.
+        // The session's attestation rules for this network: a debug-signed
+        // enclave and every Intel advisory are tolerated on a testnet only
+        // (cas/config.js sessionAttestation).
+        const attestation = casConfig.sessionAttestation(process.env.BLOCKCHAIN_NETWORK);
         content = content
-            .replace(/__TOLERATE__/g, isMainnet
-                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
-                : '[hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]')
-            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
+            .replace(/__TOLERATE__/g, attestation.tolerate)
+            .replace(/__IGNORE_ADVISORIES__/g, attestation.ignoreAdvisories);
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -657,7 +655,7 @@ const main = async () => {
         console.log("");
         const opt = ["yes", "no"];
-        const choice = await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
+        const choice = process.env.ECLD_ASSUME_YES ? 'yes' : await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
         if (choice.toLowerCase() !== 'yes') {
             console.log("Exiting.");
@@ -665,7 +663,7 @@ const main = async () => {
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"${registryV2 ? ' --chain-registered' : ''}`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -754,7 +752,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.10",
+  "version": "1.7.13",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",
@@ -39,7 +39,7 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.5",
+    "@ethernity-cloud/runner": "^0.6.6",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/pynithy/build/securelock/Dockerfile.tpl CHANGED Viewed

@@ -1,131 +1,131 @@
-# syntax=docker/dockerfile:1
-#
-# Securelock enclave build. The whole build is SGX-free: heavy Python work
-# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
-# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
-# build tools, which run in simulation/build mode without an SGX device.
-########################################################################
-# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
-########################################################################
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
-# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
-# (get_sgx_report.so) -- never the .c source. The source of truth for
-# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
-# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
-# stripped) and committed here. No source is compiled during the developer's
-# build, so a developer inspecting the wheel or build tree never sees the
-# derivation algorithm.
-#
-# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
-# enclave image is public, so this hides the SOURCE, not the algorithm; on
-# testnet the key remains reproducible because there is no attestation.
-COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
-########################################################################
-# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
-# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
-# and runs pyinstaller to produce the frozen COLLECT dir. Same python
-# version + musl as the SCONE runtime python, so the output is compatible.
-########################################################################
-FROM python:3.14-alpine AS pyfreeze
-RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
-ENV SODIUM_INSTALL=system
-WORKDIR /etny-securelock
-# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
-# and native builds work normally).
-RUN pip install --no-cache-dir \
-      pyinstaller \
-      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
-# User-supplied additional modules (the customization hook).
-COPY ./src/serverless/requirements.txt /requirements.txt
-RUN pip install --no-cache-dir -r /requirements.txt || true
-COPY ./src /etny-securelock/
-COPY ./scripts/* /etny-securelock/
-COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
-# Render securelock.py from the template, then run PyInstaller (off-SCONE).
-ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
-ENV BUCKET_NAME=__BUCKET_NAME__
-ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
-ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
-ENV RPC_URL=__RPC_URL__
-ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
-ENV NETWORK_TYPE=__NETWORK_TYPE__
-ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
-RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
-########################################################################
-# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
-# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
-# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
-# them into the measured binary-fs.
-########################################################################
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
-RUN mkdir -p /binary-fs-dir /etny-securelock
-# SCONE-built static python + its stdlib, from the runtime base image
-COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
-COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
-# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
-# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
-# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
-# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
-# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
-COPY --from=pyfreeze /etny-securelock /etny-securelock
-COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
-COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
-RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
-RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
-########################################################################
-# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
-########################################################################
-FROM etny-securelock-serverless
-COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
-COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
-RUN openssl genrsa -3 -out /enclave-key.pem 3072
-# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
-# abort with "$HOME is not defined" and kill the enclave before it emits its
-# public key. Set a writable HOME so startup (and cert emission) succeeds.
-ENV HOME=/tmp
-ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
-ENV SCONE_LOG=FATAL
-ENV SCONE_DEBUG=0
-ENV SCONE_STACK=4M
-__SCONE_ALLOW_DLOPEN__
-ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-# securelock.py does relative imports of its sibling modules (etny_crypto,
-# models, ...) and reads abi/ by relative path; run from its own directory so
-# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
-# in as the enclave PWD).
-ENV SCONE_PWD=/etny-securelock
-__ESR_ENV__
-WORKDIR /etny-securelock
-# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
-# explicit enclave-creation params; mainnet adds --production, testnet omits it
-# (non-CAS self-sign mode).
-__SCONE_SIGN__
-# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
-# measurement matches what was signed BEFORE registering the CAS session /
-# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
-# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
-# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
-# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
-# under buildkit's `ash -eo pipefail`.
-RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
-    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
-      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
-    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
-RUN rm -rf /enclave-key.pem
-ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]
+# syntax=docker/dockerfile:1
+#
+# Securelock enclave build. The whole build is SGX-free: heavy Python work
+# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
+# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
+# build tools, which run in simulation/build mode without an SGX device.
+########################################################################
+# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
+# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
+# (get_sgx_report.so) -- never the .c source. The source of truth for
+# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
+# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
+# stripped) and committed here. No source is compiled during the developer's
+# build, so a developer inspecting the wheel or build tree never sees the
+# derivation algorithm.
+#
+# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
+# enclave image is public, so this hides the SOURCE, not the algorithm; on
+# testnet the key remains reproducible because there is no attestation.
+COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
+########################################################################
+# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
+# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
+# and runs pyinstaller to produce the frozen COLLECT dir. Same python
+# version + musl as the SCONE runtime python, so the output is compatible.
+########################################################################
+FROM python:3.14-alpine AS pyfreeze
+RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
+ENV SODIUM_INSTALL=system
+WORKDIR /etny-securelock
+# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
+# and native builds work normally).
+RUN pip install --no-cache-dir \
+      pyinstaller \
+      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
+# User-supplied additional modules (the customization hook).
+COPY ./src/serverless/requirements.txt /requirements.txt
+RUN pip install --no-cache-dir -r /requirements.txt || true
+COPY ./src /etny-securelock/
+COPY ./scripts/* /etny-securelock/
+COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
+# Render securelock.py from the template, then run PyInstaller (off-SCONE).
+ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
+ENV BUCKET_NAME=__BUCKET_NAME__
+ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
+ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
+ENV RPC_URL=__RPC_URL__
+ENV CHAIN_ID=__CHAIN_ID__
+ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
+ENV NETWORK_TYPE=__NETWORK_TYPE__
+ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
+RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
+########################################################################
+# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
+# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
+# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
+# them into the measured binary-fs.
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
+RUN mkdir -p /binary-fs-dir /etny-securelock
+# SCONE-built static python + its stdlib, from the runtime base image
+COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
+COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
+# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
+# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
+# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
+# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
+# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
+COPY --from=pyfreeze /etny-securelock /etny-securelock
+COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
+COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
+RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
+RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
+########################################################################
+# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
+########################################################################
+FROM etny-securelock-serverless
+COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
+COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
+RUN openssl genrsa -3 -out /enclave-key.pem 3072
+# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
+# abort with "$HOME is not defined" and kill the enclave before it emits its
+# public key. Set a writable HOME so startup (and cert emission) succeeds.
+ENV HOME=/tmp
+ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
+ENV SCONE_LOG=FATAL
+ENV SCONE_DEBUG=0
+ENV SCONE_STACK=4M
+__SCONE_ALLOW_DLOPEN__
+ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+# securelock.py does relative imports of its sibling modules (etny_crypto,
+# models, ...) and reads abi/ by relative path; run from its own directory so
+# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
+# in as the enclave PWD).
+ENV SCONE_PWD=/etny-securelock
+__ESR_ENV__
+WORKDIR /etny-securelock
+# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
+# explicit enclave-creation params; mainnet adds --production, testnet omits it
+# (non-CAS self-sign mode).
+__SCONE_SIGN__
+# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
+# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
+# under buildkit's `ash -eo pipefail`.
+RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
+    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
+      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
+    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
+RUN rm -rf /enclave-key.pem
+ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]

package/pynithy/build/securelock/src/securelock.py.tmpl CHANGED Viewed

@@ -616,6 +616,12 @@ class EtnySecureLock:
         # attests this order and this run's challenge; the data itself is
         # pushed unchanged. Without a binding (older trustedzone) the bare
         # data is signed, which that trustedzone verifies.
+        if not self.trustedzone_public_key_pem:
+            # A failure before execute() (the client-data check) reaches here
+            # with neither the trustedzone's certificate, which the result is
+            # encrypted to, nor the task binding it is signed over.
+            self.__get_trustedzone_public_key()
+            self.__load_task_binding()
         binding = getattr(self, "task_binding", None)
         prefix = f"{binding['challenge']}:{binding['order_id']}:" if binding else ""
         self.encrypt_file_and_push_to_swifstream(str(self.task_result), self.result, signed_prefix=prefix)
@@ -817,6 +823,9 @@ class EtnySecureLock:
                 f"No attested task caller supplied "
                 f"({e.__class__.__name__}); treating task as anonymous")
+        self.__load_task_binding()
+    def __load_task_binding(self):
         # Task binding: the order id and enclave challenge the trustedzone
         # generated for this task, forwarded as task.securelock + .sig. When
         # present (and only with a valid trustedzone signature) the result and

package/pynithy/build.mjs CHANGED Viewed

@@ -45,9 +45,11 @@ export const ECRunner = {
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
-  // --- ethereum sepolia ---
-  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- ethereum sepolia: the family of 2026-10-14 (PoX EthernityImplementationV2 1.1, ECImageRegistryV3) ---
+  'ecld-pynithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-pynithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
   'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
@@ -224,7 +226,7 @@ fs.writeFileSync('Dockerfile', fs.readFileSync('Dockerfile.tpl', 'utf8')
   .replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet')
   .replace(/__VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '')
   .replace(/__MEMORY_TO_ALLOCATE__/g, MEMORY_TO_ALLOCATE)
-  .replace(/__ESR_ENV__\n/, esrEnvBlock)
+  .replace(/__ESR_ENV__\r?\n/, esrEnvBlock)
   .replace('__SCONE_ALLOW_DLOPEN__', 'ENV SCONE_ALLOW_DLOPEN=1')
   .replace('__SCONE_SIGN__',
     `RUN scone-signer sign ${signFlags}${casProvisioned ? ' --production' : ''} /usr/local/bin/python`));

package/pynithy/run/image_registry.js CHANGED Viewed

@@ -41,6 +41,17 @@ function setVars(network = "") {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
         IMAGE_REGISTRY_ADDRESS = "0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D";
         CHAIN_ID = 4441;
+    } else if (BLOCKCHAIN_NETWORK.includes("Sepolia")) {
+        // Sepolia's ECImageRegistryV3 of 2026-10-14; Tenderly's gateway serves
+        // the log ranges publicnode prunes.
+        NETWORK_RPC = "https://sepolia.gateway.tenderly.co";
+        IMAGE_REGISTRY_ADDRESS = "0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F";
+        CHAIN_ID = 11155111;
+        // Sepolia's EVM charges storage-heavy calls several times the local
+        // EVM's gas (a contract creation about seven times); the base fee is
+        // under 0.0001 gwei, so 0.1 gwei is paid in full as the tip.
+        GAS = 20000000;
+        GAS_PRICE = 100000000;
     }
 }

package/pynithy/run/public_key_service.js CHANGED Viewed

@@ -1,9 +1,19 @@
+// The publish's client of publickey.ethernity.cloud, the certificate
+// extraction service: queues the image and polls for its certificate.
+//
+// An image registered on chain first (--chain-registered, the two-step
+// registries) is queued by the service's registry watcher from the
+// ImageRegistered event, with this publish's IPFS peer; the hash is posted to
+// /api/addHash only when that row has not appeared within
+// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
-const program = new Command();
 const BASE_URL = "https://publickey.ethernity.cloud";
+// The watcher polls the registries every 30 s.
+const CHAIN_ROW_GRACE_SECONDS = 180;
+const POLL_SECONDS = 10;
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -17,7 +27,6 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     };
     try {
         const response = await axios.post(url, payload);
-        // console.log(`response: ${response}`);
         return response.data;
     } catch (error) {
         console.error("Error:", error.response ? error.response.data : error.message);
@@ -25,51 +34,84 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     }
 }
+// The service's answer for the hash, or null while the service does not
+// know the hash yet (404).
 async function checkIpfsHashStatus(hash) {
     const url = `${BASE_URL}/api/checkHash/${hash}`;
     try {
         const response = await axios.get(url);
         return response.data;
     } catch (error) {
+        if (error.response && error.response.status === 404) return null;
         console.error("Error:", error.response ? error.response.data : error.message);
         process.exit(1);
     }
 }
-program
-    .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
-    .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
-    .requiredOption('--network <network>', 'Network')
-    .requiredOption('--template_version <templateVersion>', 'Template version');
+// Queues the image as described above and returns the service's first
+// answer for it. `submit`, `check`, `sleep` and `now` are the functions
+// above and the clock, replaceable for tests.
+async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
+    sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
+    log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
+    if (chainRegistered) {
+        const deadline = now() + graceSeconds;
+        while (true) {
+            const answer = await check(hash);
+            if (answer !== null) return answer;
+            if (now() >= deadline) {
+                log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
+                break;
+            }
+            log("Waiting for the certificate service to pick the registration up from the chain...");
+            await sleep(pollSeconds);
+        }
+    }
+    const submitResponse = await submit(hash, ...submitArgs);
+    log("Submit IPFS Hash Response:", submitResponse);
+    return null;
+}
-program.parse(process.argv);
+async function main() {
+    const program = new Command();
+    program
+        .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
+        .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
+        .requiredOption('--network <network>', 'Network')
+        .requiredOption('--template_version <templateVersion>', 'Template version')
+        .option('--chain-registered', 'the image is registered on chain; wait for the service to queue it from the event before posting the hash');
+    program.parse(process.argv);
-const options = program.opts();
-const enclaveName = options.enclave_name;
-const protocolVersion = options.protocol_version;
-const network = options.network.toLowerCase().split("_")[1];
-const templateVersion = options.template_version;
+    const options = program.opts();
+    const enclaveName = options.enclave_name;
+    const protocolVersion = options.protocol_version;
+    const network = options.network.toLowerCase().split("_")[1];
+    const templateVersion = options.template_version;
-const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
-const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+    const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+    const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
-console.log("IPFS Hash:", hhash);
-console.log("Enclave Name:", enclaveName);
-console.log("Protocol Version:", protocolVersion);
-console.log("Network:", network);
-console.log("Template Version:", templateVersion);
-console.log("Docker Composer Hash:", dockerComposerHash);
+    console.log("IPFS Hash:", hhash);
+    console.log("Enclave Name:", enclaveName);
+    console.log("Protocol Version:", protocolVersion);
+    console.log("Network:", network);
+    console.log("Template Version:", templateVersion);
+    console.log("Docker Composer Hash:", dockerComposerHash);
-(async () => {
-    // Submit IPFS Hash
-    const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
-    console.log("Submit IPFS Hash Response:", submitResponse);
+    let checkResponse = await queueImage({
+        hash: hhash, chainRegistered: Boolean(options.chainRegistered),
+        submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
+    });
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
     // (with reason) and the certificate when done.
     while (true) {
-        const checkResponse = await checkIpfsHashStatus(hhash);
+        if (checkResponse === null) {
+            await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+            checkResponse = await checkIpfsHashStatus(hhash);
+            continue;
+        }
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
                 if (checkResponse.status === "running") {
@@ -85,6 +127,17 @@ console.log("Docker Composer Hash:", dockerComposerHash);
                 console.log("Public Key:", checkResponse.publicKey);
                 // Save public key to file
                 fs.writeFileSync('PUBLIC_KEY.txt', checkResponse.publicKey);
+                // ESR (RFC §5.2): the enclave also prints ESR_WALLET_ADDRESS on the
+                // cert channel. The service currently returns only "publicKey"; when
+                // it starts relaying the enclave's output (or adds an
+                // "esrWalletAddress" field) it is picked up here and written to a
+                // sibling file the caller reads -- no other changes needed. Until
+                // then, ESR projects extract locally on an SGX host once to learn
+                // the address (publish then persists it).
+                if (checkResponse.esrWalletAddress) {
+                    console.log("ESR Wallet Address:", checkResponse.esrWalletAddress);
+                    fs.writeFileSync('ESR_WALLET_ADDRESS.txt', checkResponse.esrWalletAddress);
+                }
                 break;
             }
         } else {
@@ -92,6 +145,11 @@ console.log("Docker Composer Hash:", dockerComposerHash);
             process.exit(1);
         }
-        await new Promise(resolve => setTimeout(resolve, 10000)); // Wait for 10 seconds before checking again
+        await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+        checkResponse = await checkIpfsHashStatus(hhash);
     }
-})();
+}
+if (require.main === module) main();
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };

package/pynithy/run.js CHANGED Viewed

@@ -178,7 +178,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -187,7 +187,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -256,16 +256,13 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        // Mainnet attests production enclaves only; a testnet tolerates a
-        // debug-signed one. The tolerate list was edited by text replacement
-        // ('", debug-mode"'), which never matched this template's LEADING
-        // "debug-mode," -- so mainnet sessions were published tolerating debug
-        // enclaves. Written out per network instead.
+        // The session's attestation rules for this network: a debug-signed
+        // enclave and every Intel advisory are tolerated on a testnet only
+        // (cas/config.js sessionAttestation).
+        const attestation = casConfig.sessionAttestation(process.env.BLOCKCHAIN_NETWORK);
         content = content
-            .replace(/__TOLERATE__/g, isMainnet
-                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
-                : '[debug-mode, hyperthreading, outdated-tcb, software-hardening-needed]')
-            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
+            .replace(/__TOLERATE__/g, attestation.tolerate)
+            .replace(/__IGNORE_ADVISORIES__/g, attestation.ignoreAdvisories);
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -656,7 +653,7 @@ const main = async () => {
         console.log("");
         const opt = ["yes", "no"];
-        const choice = await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
+        const choice = process.env.ECLD_ASSUME_YES ? 'yes' : await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
         if (choice.toLowerCase() !== 'yes') {
             console.log("Exiting.");
@@ -664,7 +661,7 @@ const main = async () => {
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"${registryV2 ? ' --chain-registered' : ''}`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -731,7 +728,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/run.js CHANGED Viewed

@@ -90,7 +90,7 @@ usage: ecld-run 'hello("World")' | ecld-run --file payload.js | ecld-run --input
 payload:   a code string, or --file <path>; input via --input <file> / --input-text <str>
 network:   --network BLOXBERG_TESTNET (default: BLOCKCHAIN_NETWORK from .env)
            --unsafe: the network's -unsafe variant, which runs without a CAS
-           (BLOXBERG_TESTNET_UNSAFE, LITVM_LITEFORGE_UNSAFE)
+           (BLOXBERG_TESTNET_UNSAFE, LITVM_LITEFORGE_UNSAFE, ETHEREUM_SEPOLIA_UNSAFE)
 enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (default TRUSTED_ZONE_IMAGE);
            on an -unsafe network the default is each one's -unsafe variant
 key:       PRIVATE_KEY (a funded 0x key) from .env / env, or ECLD_PRIVATE_KEY
@@ -178,7 +178,7 @@ async function main() {
   // ---- drive the runner ----
   let runner;
   try {
-    runner = new EthernityCloudRunner(network.address, { privateKey }, network.chainId);
+    runner = new EthernityCloudRunner(network.address, network.rpcUrl ? { privateKey, rpcUrl: network.rpcUrl } : { privateKey }, network.chainId);
     if (network.unsafe) await runner.setNetwork(...network.unsafe);
   } catch (e) {
     console.error('ecld-run: could not initialise the runner: ' + e.message);