@ethernity-cloud/sdk-js 1.7.11 → 1.7.14

package/README.md

@@ -142,7 +142,11 @@ sets the enclave heap (default `1024M`).
   bootnode and reports its progress) and writes it from the same wallet
   (`setImageCert`). Keep the publish running until it prints the registration:
   your node is the image's first source. `ECLD_KUBO_SWARM_PORT` (default
-  4001) is the port your node listens on when it is free.
+  4001) is the port your node listens on when it is free. `ECLD_ASSUME_YES=1`
+  accepts the extraction-service prompt without asking, for a publish run
+  from a script. On a two-step registry the publish waits up to three
+  minutes for the service to queue the image from the chain event before
+  posting the hash itself.
 
 - **Test (local, no chain)**: To run your backend locally with the enclave's own
   executor — no SGX, no gas, instant — run:
@@ -182,6 +186,9 @@ sets the enclave heap (default `1024M`).
   intake once the request is on chain; `--ipfs <url>` writes and reads through
   that IPFS RPC API instead, with `ECLD_IPFS_TOKEN` (or `IPFS_TOKEN`) as its
   Authorization header, and a URL naming the public API is refused without one.
+  The chain calls of a run go through the network's own RPC (publicnode's Sepolia
+  endpoint, LitVM's Caldera endpoint, IoTeX's babel API); the runner's defaults
+  cover the other networks.
   The intake serves the networks the bootnode's agent runs, today the bloxberg
   testnet, LitVM LiteForge and Ethereum Sepolia, each with its unsafe twin: a dApp on any other
   network (Bloxberg mainnet, Polygon, IoTeX) needs an IPFS API of its

package/cas/config.js

@@ -14,8 +14,9 @@
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml
 // (cas_session_registry_address, validator_registry_address).
 const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
-  'etny-nodenithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
+  // The Phase 2 ValidatorRegistry of 2026-10-21 (ethernity-cas CAS-SETUP.md).
+  'etny-pynithy-testnet': '0x8CC8B1dc22f0E06193161CeC79d75987b0640e02',
+  'etny-nodenithy-testnet': '0x8CC8B1dc22f0E06193161CeC79d75987b0640e02',
   'ecld-pynithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
@@ -23,8 +24,10 @@ const VALIDATOR_REGISTRY = {
 };
 
 const SESSION_REGISTRY = {
-  'etny-pynithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
-  'etny-nodenithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
+  // The SessionRegistry with image binding of 2026-10-22; it links an image
+  // only once the Image Registry records it under the session's name.
+  'etny-pynithy-testnet': '0x78f0c5E92E7A9Ec2f2A36A4509ED4a75D0f9463B',
+  'etny-nodenithy-testnet': '0x78f0c5E92E7A9Ec2f2A36A4509ED4a75D0f9463B',
   'ecld-pynithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
   'ecld-nodenithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
   // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
@@ -71,6 +74,26 @@ const UNSAFE_NETWORKS = {
 const isUnsafeNetwork = (network) =>
   Object.keys(UNSAFE_NETWORKS).some((name) => name.toUpperCase() === String(network || '').toUpperCase());
 
+// The testnets, by BLOCKCHAIN_NETWORK: every network ecld-init offers but the
+// two mainnets, the -unsafe ones included. A session relaxes attestation on
+// these alone (sessionAttestation).
+const TESTNETS = [
+  'Bloxberg_Testnet', 'Polygon_Amoy_Testnet', 'IoTeX_Testnet', 'Ethereum_Sepolia', 'LitVM_LiteForge',
+  ...Object.keys(UNSAFE_NETWORKS),
+];
+const isTestnetNetwork = (network) =>
+  TESTNETS.some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The attestation rules a securelock session declares on `network`, as the
+// YAML flow sequences its template takes for __TOLERATE__ and
+// __IGNORE_ADVISORIES__. A testnet tolerates a debug-signed enclave and ignores
+// every Intel advisory. Any other network, a mainnet or a name not in TESTNETS,
+// gets the production rules: no debug-mode, and INTEL-SA-00615 the one
+// advisory ignored.
+const sessionAttestation = (network) => (isTestnetNetwork(network)
+  ? { tolerate: '[hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]', ignoreAdvisories: '["*"]' }
+  : { tolerate: '[hyperthreading, outdated-tcb, software-hardening-needed]', ignoreAdvisories: '["INTEL-SA-00615"]' });
+
 // The name an image is registered and run under on `network`: <name>-unsafe
 // on an -unsafe network. A dApp's securelock is <project>-unsafe there, so its
 // two variants never share an image name, and an -unsafe network's
@@ -99,5 +122,6 @@ const renderCompose = (content, cas, unsafe) => content
 
 module.exports = {
   VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
-  UNSAFE_NETWORKS, isUnsafeNetwork, nameOnNetwork, sessionTag, renderCompose,
+  UNSAFE_NETWORKS, isUnsafeNetwork, TESTNETS, isTestnetNetwork, sessionAttestation,
+  nameOnNetwork, sessionTag, renderCompose,
 };

package/network.js

@@ -14,13 +14,14 @@
 const casConfig = require('./cas/config.js');
 
 /* Accepts a few spellings per network. Returns the normalised key, the
- * network ({ address, chainId?, unsafe? }) or null, and the known keys. */
+ * network ({ address, chainId?, unsafe? }) or null, and the known keys; rpcUrl names
+ * the RPC of a network whose token the runner cannot key an RPC by. */
 function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
   const key = String(raw || '').trim().toUpperCase().replace(/\s+/g, '_');
   const bloxbergTestnet = { address: ECAddress.BLOXBERG.TESTNET_ADDRESS };
   const amoy = { address: ECAddress.POLYGON.TESTNET_ADDRESS };
-  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET };
-  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET };
+  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET, rpcUrl: 'https://ethereum-sepolia-rpc.publicnode.com' };
+  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET, rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http' };
   const table = {
     BLOXBERG_TESTNET: bloxbergTestnet,
     BLOXBERG_TESTNET_UNSAFE: { ...bloxbergTestnet, unsafe: ['BLOXBERG', 'TESTNET_UNSAFE'] },
@@ -28,7 +29,7 @@ function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
     POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
     POLYGON_AMOY: amoy,
     POLYGON_AMOY_TESTNET: amoy,
-    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET },
+    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET, rpcUrl: 'https://babel-api.testnet.iotex.io' },
     ETHEREUM_SEPOLIA: sepolia,
     SEPOLIA: sepolia,
     ETHEREUM_SEPOLIA_UNSAFE: { ...sepolia, unsafe: ['SEPOLIA', 'TESTNET_UNSAFE'] },

package/nodenithy/build.mjs

@@ -45,9 +45,11 @@ export const ECRunner = {
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
-  // --- ethereum sepolia ---
-  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- ethereum sepolia: the family of 2026-10-14 (PoX EthernityImplementationV2 1.1, ECImageRegistryV3) ---
+  'ecld-pynithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-pynithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
   'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
@@ -259,7 +261,7 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 
 // runCommand(`cat Dockerfile.tmpl | sed s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > Dockerfile`);
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
-let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
+let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\r?\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
 // Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
 // run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.

package/nodenithy/run/public_key_service.js

@@ -1,9 +1,19 @@
+// The publish's client of publickey.ethernity.cloud, the certificate
+// extraction service: queues the image and polls for its certificate.
+//
+// An image registered on chain first (--chain-registered, the two-step
+// registries) is queued by the service's registry watcher from the
+// ImageRegistered event, with this publish's IPFS peer; the hash is posted to
+// /api/addHash only when that row has not appeared within
+// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
-const program = new Command();
 
 const BASE_URL = "https://publickey.ethernity.cloud";
+// The watcher polls the registries every 30 s.
+const CHAIN_ROW_GRACE_SECONDS = 180;
+const POLL_SECONDS = 10;
 
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -17,7 +27,6 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     };
     try {
         const response = await axios.post(url, payload);
-        // console.log(`response: ${response}`);
         return response.data;
     } catch (error) {
         console.error("Error:", error.response ? error.response.data : error.message);
@@ -25,51 +34,84 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     }
 }
 
+// The service's answer for the hash, or null while the service does not
+// know the hash yet (404).
 async function checkIpfsHashStatus(hash) {
     const url = `${BASE_URL}/api/checkHash/${hash}`;
     try {
         const response = await axios.get(url);
         return response.data;
     } catch (error) {
+        if (error.response && error.response.status === 404) return null;
         console.error("Error:", error.response ? error.response.data : error.message);
         process.exit(1);
     }
 }
 
-program
-    .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
-    .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
-    .requiredOption('--network <network>', 'Network')
-    .requiredOption('--template_version <templateVersion>', 'Template version');
+// Queues the image as described above and returns the service's first
+// answer for it. `submit`, `check`, `sleep` and `now` are the functions
+// above and the clock, replaceable for tests.
+async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
+    sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
+    log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
+    if (chainRegistered) {
+        const deadline = now() + graceSeconds;
+        while (true) {
+            const answer = await check(hash);
+            if (answer !== null) return answer;
+            if (now() >= deadline) {
+                log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
+                break;
+            }
+            log("Waiting for the certificate service to pick the registration up from the chain...");
+            await sleep(pollSeconds);
+        }
+    }
+    const submitResponse = await submit(hash, ...submitArgs);
+    log("Submit IPFS Hash Response:", submitResponse);
+    return null;
+}
 
-program.parse(process.argv);
+async function main() {
+    const program = new Command();
+    program
+        .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
+        .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
+        .requiredOption('--network <network>', 'Network')
+        .requiredOption('--template_version <templateVersion>', 'Template version')
+        .option('--chain-registered', 'the image is registered on chain; wait for the service to queue it from the event before posting the hash');
+    program.parse(process.argv);
 
-const options = program.opts();
-const enclaveName = options.enclave_name;
-const protocolVersion = options.protocol_version;
-const network = options.network.toLowerCase().split("_")[1];
-const templateVersion = options.template_version;
+    const options = program.opts();
+    const enclaveName = options.enclave_name;
+    const protocolVersion = options.protocol_version;
+    const network = options.network.toLowerCase().split("_")[1];
+    const templateVersion = options.template_version;
 
-const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
-const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+    const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+    const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
 
-console.log("IPFS Hash:", hhash);
-console.log("Enclave Name:", enclaveName);
-console.log("Protocol Version:", protocolVersion);
-console.log("Network:", network);
-console.log("Template Version:", templateVersion);
-console.log("Docker Composer Hash:", dockerComposerHash);
+    console.log("IPFS Hash:", hhash);
+    console.log("Enclave Name:", enclaveName);
+    console.log("Protocol Version:", protocolVersion);
+    console.log("Network:", network);
+    console.log("Template Version:", templateVersion);
+    console.log("Docker Composer Hash:", dockerComposerHash);
 
-(async () => {
-    // Submit IPFS Hash
-    const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
-    console.log("Submit IPFS Hash Response:", submitResponse);
+    let checkResponse = await queueImage({
+        hash: hhash, chainRegistered: Boolean(options.chainRegistered),
+        submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
+    });
 
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
     // (with reason) and the certificate when done.
     while (true) {
-        const checkResponse = await checkIpfsHashStatus(hhash);
+        if (checkResponse === null) {
+            await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+            checkResponse = await checkIpfsHashStatus(hhash);
+            continue;
+        }
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
                 if (checkResponse.status === "running") {
@@ -103,6 +145,11 @@ console.log("Docker Composer Hash:", dockerComposerHash);
             process.exit(1);
         }
 
-        await new Promise(resolve => setTimeout(resolve, 10000)); // Wait for 10 seconds before checking again
+        await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+        checkResponse = await checkIpfsHashStatus(hhash);
     }
-})();
+}
+
+if (require.main === module) main();
+
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };

package/nodenithy/run.js

@@ -177,7 +177,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -186,7 +186,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -258,15 +258,13 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        // Mainnet attests production enclaves only; a testnet tolerates a
-        // debug-signed one. Both lines were edited by text replacement, which
-        // had to repeat the advisory list verbatim to delete it and broke the
-        // moment either string moved. Written out per network instead.
+        // The session's attestation rules for this network: a debug-signed
+        // enclave and every Intel advisory are tolerated on a testnet only
+        // (cas/config.js sessionAttestation).
+        const attestation = casConfig.sessionAttestation(process.env.BLOCKCHAIN_NETWORK);
         content = content
-            .replace(/__TOLERATE__/g, isMainnet
-                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
-                : '[hyperthreading, outdated-tcb, software-hardening-needed, debug-mode]')
-            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
+            .replace(/__TOLERATE__/g, attestation.tolerate)
+            .replace(/__IGNORE_ADVISORIES__/g, attestation.ignoreAdvisories);
 
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -657,7 +655,7 @@ const main = async () => {
         console.log("");
 
         const opt = ["yes", "no"];
-        const choice = await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
+        const choice = process.env.ECLD_ASSUME_YES ? 'yes' : await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
 
         if (choice.toLowerCase() !== 'yes') {
             console.log("Exiting.");
@@ -665,7 +663,7 @@ const main = async () => {
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"${registryV2 ? ' --chain-registered' : ''}`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -754,7 +752,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.11",
+  "version": "1.7.14",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",

package/pynithy/build/securelock/Dockerfile.tpl

@@ -1,131 +1,131 @@
-# syntax=docker/dockerfile:1
-#
-# Securelock enclave build. The whole build is SGX-free: heavy Python work
-# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
-# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
-# build tools, which run in simulation/build mode without an SGX device.
-
-########################################################################
-# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
-########################################################################
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
-# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
-# (get_sgx_report.so) -- never the .c source. The source of truth for
-# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
-# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
-# stripped) and committed here. No source is compiled during the developer's
-# build, so a developer inspecting the wheel or build tree never sees the
-# derivation algorithm.
-#
-# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
-# enclave image is public, so this hides the SOURCE, not the algorithm; on
-# testnet the key remains reproducible because there is no attestation.
-COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
-
-########################################################################
-# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
-# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
-# and runs pyinstaller to produce the frozen COLLECT dir. Same python
-# version + musl as the SCONE runtime python, so the output is compatible.
-########################################################################
-FROM python:3.14-alpine AS pyfreeze
-RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
-ENV SODIUM_INSTALL=system
-WORKDIR /etny-securelock
-
-# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
-# and native builds work normally).
-RUN pip install --no-cache-dir \
-      pyinstaller \
-      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
-
-# User-supplied additional modules (the customization hook).
-COPY ./src/serverless/requirements.txt /requirements.txt
-RUN pip install --no-cache-dir -r /requirements.txt || true
-
-COPY ./src /etny-securelock/
-COPY ./scripts/* /etny-securelock/
-COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
-
-# Render securelock.py from the template, then run PyInstaller (off-SCONE).
-ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
-ENV BUCKET_NAME=__BUCKET_NAME__
-ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
-ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
-ENV RPC_URL=__RPC_URL__
-ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
-ENV NETWORK_TYPE=__NETWORK_TYPE__
-ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
-RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
-
-########################################################################
-# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
-# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
-# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
-# them into the measured binary-fs.
-########################################################################
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
-RUN mkdir -p /binary-fs-dir /etny-securelock
-# SCONE-built static python + its stdlib, from the runtime base image
-COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
-COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
-# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
-# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
-# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
-# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
-# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
-COPY --from=pyfreeze /etny-securelock /etny-securelock
-COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
-COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
-RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
-RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
-
-########################################################################
-# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
-########################################################################
-FROM etny-securelock-serverless
-
-COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
-COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
-
-RUN openssl genrsa -3 -out /enclave-key.pem 3072
-
-# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
-# abort with "$HOME is not defined" and kill the enclave before it emits its
-# public key. Set a writable HOME so startup (and cert emission) succeeds.
-ENV HOME=/tmp
-ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
-ENV SCONE_LOG=FATAL
-ENV SCONE_DEBUG=0
-ENV SCONE_STACK=4M
-__SCONE_ALLOW_DLOPEN__
-ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-# securelock.py does relative imports of its sibling modules (etny_crypto,
-# models, ...) and reads abi/ by relative path; run from its own directory so
-# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
-# in as the enclave PWD).
-ENV SCONE_PWD=/etny-securelock
-__ESR_ENV__
-WORKDIR /etny-securelock
-
-# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
-# explicit enclave-creation params; mainnet adds --production, testnet omits it
-# (non-CAS self-sign mode).
-__SCONE_SIGN__
-
-# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
-# measurement matches what was signed BEFORE registering the CAS session /
-# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
-# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
-# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
-# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
-# under buildkit's `ash -eo pipefail`.
-RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
-    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
-      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
-    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
-
-RUN rm -rf /enclave-key.pem
-
-ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]
+# syntax=docker/dockerfile:1
+#
+# Securelock enclave build. The whole build is SGX-free: heavy Python work
+# (pip installs + PyInstaller freeze) runs on a STOCK python:3.14-alpine with
+# no SCONE and no SGX; only the binary-fs packaging and signing use the SCONE
+# build tools, which run in simulation/build mode without an SGX device.
+
+########################################################################
+# Stage 1 - SGX report helper (unchanged, crosscompiler build tool)
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS build-sgx-module
+# The SDK ships the SGX key-gen module ONLY as a PREBUILT .so
+# (get_sgx_report.so) -- never the .c source. The source of truth for
+# get_sgx_report.c lives in the etny-pynithy / etny-nodenithy repos; the .so is
+# produced once from it via scripts/build_keygen_so.sh (scone-gcc, hardened +
+# stripped) and committed here. No source is compiled during the developer's
+# build, so a developer inspecting the wheel or build tree never sees the
+# derivation algorithm.
+#
+# NOTE (see esr_wallet.py): the .so still contains the executable logic and the
+# enclave image is public, so this hides the SOURCE, not the algorithm; on
+# testnet the key remains reproducible because there is no attestation.
+COPY src/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+########################################################################
+# Stage 2 - PyInstaller freeze on a NORMAL python 3.14 (no SCONE / no SGX)
+# Installs the user's requirements.txt + PyInstaller, renders securelock.py,
+# and runs pyinstaller to produce the frozen COLLECT dir. Same python
+# version + musl as the SCONE runtime python, so the output is compatible.
+########################################################################
+FROM python:3.14-alpine AS pyfreeze
+RUN apk add --no-cache bash gcc g++ musl-dev libffi-dev openssl-dev rust cargo make libsodium-dev zlib-dev binutils
+ENV SODIUM_INSTALL=system
+WORKDIR /etny-securelock
+
+# Core securelock runtime deps + PyInstaller (built here, off-SCONE, where pip
+# and native builds work normally).
+RUN pip install --no-cache-dir \
+      pyinstaller \
+      python-dotenv "web3>=6" cryptography ecdsa pyasn1 tinyec minio pynacl
+
+# User-supplied additional modules (the customization hook).
+COPY ./src/serverless/requirements.txt /requirements.txt
+RUN pip install --no-cache-dir -r /requirements.txt || true
+
+COPY ./src /etny-securelock/
+COPY ./scripts/* /etny-securelock/
+COPY --from=build-sgx-module /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
+# Render securelock.py from the template, then run PyInstaller (off-SCONE).
+ENV SECURELOCK_SESSION=__SECURELOCK_SESSION__
+ENV BUCKET_NAME=__BUCKET_NAME__
+ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
+ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
+ENV RPC_URL=__RPC_URL__
+ENV CHAIN_ID=__CHAIN_ID__
+ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
+ENV NETWORK_TYPE=__NETWORK_TYPE__
+ENV VALIDATOR_REGISTRY_ADDRESS=__VALIDATOR_REGISTRY_ADDRESS__
+RUN chmod +x /etny-securelock/pyfreeze.sh && /etny-securelock/pyfreeze.sh
+
+########################################################################
+# Stage 3 - binary-fs packaging with the SCONE build tools (no SGX).
+# Assembles the SCONE python + stdlib + the (off-SCONE) installed site-packages
+# + the rendered securelock.py + PyInstaller's collected .so list, and bakes
+# them into the measured binary-fs.
+########################################################################
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 AS binfs
+RUN mkdir -p /binary-fs-dir /etny-securelock
+# SCONE-built static python + its stdlib, from the runtime base image
+COPY --from=etny-securelock-serverless /usr/local/bin/python3 /usr/local/bin/python3
+COPY --from=etny-securelock-serverless /usr/local/lib/python3.14 /usr/local/lib/python3.14
+# The ENTIRE /etny-securelock tree (rendered securelock.py + its sibling modules
+# etny_crypto.py, etny_exec.py, models.py, swift_stream_service.py, the abi/
+# dir, get_sgx_report.so, scripts) - all must be baked into binary-fs or the
+# enclave fails at import (ModuleNotFoundError: No module named 'etny_crypto').
+# site-packages + COLLECT toc also come from the OFF-SCONE pyfreeze stage.
+COPY --from=pyfreeze /etny-securelock /etny-securelock
+COPY --from=pyfreeze /etny-securelock/build/securelock/COLLECT-00.toc /etny-securelock/COLLECT-00.toc
+COPY --from=pyfreeze /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
+RUN chmod +x /etny-securelock/binary-fs-build.sh && /etny-securelock/binary-fs-build.sh
+RUN cd /binary-fs-dir && scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
+
+########################################################################
+# Stage 4 - final SCONE runtime image (lean scone python base) + sign.
+########################################################################
+FROM etny-securelock-serverless
+
+COPY --from=binfs /usr/local/bin/scone /usr/local/bin/scone
+COPY --from=binfs /libbinary-fs.so /lib/libbinary-fs.so
+
+RUN openssl genrsa -3 -out /enclave-key.pem 3072
+
+# SCONE enclaves run with no HOME; libraries calling os.path.expanduser('~')
+# abort with "$HOME is not defined" and kill the enclave before it emits its
+# public key. Set a writable HOME so startup (and cert emission) succeeds.
+ENV HOME=/tmp
+ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
+ENV SCONE_LOG=FATAL
+ENV SCONE_DEBUG=0
+ENV SCONE_STACK=4M
+__SCONE_ALLOW_DLOPEN__
+ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+# securelock.py does relative imports of its sibling modules (etny_crypto,
+# models, ...) and reads abi/ by relative path; run from its own directory so
+# those resolve (the base image's build WORKDIR /b/Python-3.14.6 otherwise leaks
+# in as the enclave PWD).
+ENV SCONE_PWD=/etny-securelock
+__ESR_ENV__
+WORKDIR /etny-securelock
+
+# Rendered by build.py: signs the EXECUTED binary (/usr/local/bin/python) with
+# explicit enclave-creation params; mainnet adds --production, testnet omits it
+# (non-CAS self-sign mode).
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish.py can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing (mismatch => SCONE recomputed at load => debug => CAS rejects).
+# scone-signer info prints two tab-indented "MRENCLAVE:" lines (non-EDMM first;
+# runtime has EDMM disabled, so the first is what SCONE_HASH produces). Capture
+# to a file first: piping into `head` kills scone-signer with SIGPIPE (exit 141)
+# under buildkit's `ash -eo pipefail`.
+RUN scone-signer info /usr/local/bin/python > /tmp/siginfo.txt 2>&1; \
+    grep -iE "MRENCLAVE:" /tmp/siginfo.txt | sed -n '1p' \
+      | sed -E 's/.*MRENCLAVE:[[:space:]]*//I' | tr -d '[:space:]' > /signed_mrenclave.txt && \
+    echo "SIGNED_MRENCLAVE=$(cat /signed_mrenclave.txt)"
+
+RUN rm -rf /enclave-key.pem
+
+ENTRYPOINT ["/usr/local/bin/python", "/etny-securelock/securelock.py"]

package/pynithy/build/securelock/src/securelock.py.tmpl

@@ -616,6 +616,12 @@ class EtnySecureLock:
         # attests this order and this run's challenge; the data itself is
         # pushed unchanged. Without a binding (older trustedzone) the bare
         # data is signed, which that trustedzone verifies.
+        if not self.trustedzone_public_key_pem:
+            # A failure before execute() (the client-data check) reaches here
+            # with neither the trustedzone's certificate, which the result is
+            # encrypted to, nor the task binding it is signed over.
+            self.__get_trustedzone_public_key()
+            self.__load_task_binding()
         binding = getattr(self, "task_binding", None)
         prefix = f"{binding['challenge']}:{binding['order_id']}:" if binding else ""
         self.encrypt_file_and_push_to_swifstream(str(self.task_result), self.result, signed_prefix=prefix)
@@ -817,6 +823,9 @@ class EtnySecureLock:
                 f"No attested task caller supplied "
                 f"({e.__class__.__name__}); treating task as anonymous")
 
+        self.__load_task_binding()
+
+    def __load_task_binding(self):
         # Task binding: the order id and enclave challenge the trustedzone
         # generated for this task, forwarded as task.securelock + .sig. When
         # present (and only with a valid trustedzone signature) the result and

package/pynithy/build.mjs

@@ -45,9 +45,11 @@ export const ECRunner = {
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
-  // --- ethereum sepolia ---
-  'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  // --- ethereum sepolia: the family of 2026-10-14 (PoX EthernityImplementationV2 1.1, ECImageRegistryV3) ---
+  'ecld-pynithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-pynithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
+  'ecld-nodenithy-ethereum-sepolia-unsafe': ['0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c', '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
   'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
@@ -224,7 +226,7 @@ fs.writeFileSync('Dockerfile', fs.readFileSync('Dockerfile.tpl', 'utf8')
   .replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet')
   .replace(/__VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '')
   .replace(/__MEMORY_TO_ALLOCATE__/g, MEMORY_TO_ALLOCATE)
-  .replace(/__ESR_ENV__\n/, esrEnvBlock)
+  .replace(/__ESR_ENV__\r?\n/, esrEnvBlock)
   .replace('__SCONE_ALLOW_DLOPEN__', 'ENV SCONE_ALLOW_DLOPEN=1')
   .replace('__SCONE_SIGN__',
     `RUN scone-signer sign ${signFlags}${casProvisioned ? ' --production' : ''} /usr/local/bin/python`));

package/pynithy/run/public_key_service.js

@@ -1,9 +1,19 @@
+// The publish's client of publickey.ethernity.cloud, the certificate
+// extraction service: queues the image and polls for its certificate.
+//
+// An image registered on chain first (--chain-registered, the two-step
+// registries) is queued by the service's registry watcher from the
+// ImageRegistered event, with this publish's IPFS peer; the hash is posted to
+// /api/addHash only when that row has not appeared within
+// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
-const program = new Command();
 
 const BASE_URL = "https://publickey.ethernity.cloud";
+// The watcher polls the registries every 30 s.
+const CHAIN_ROW_GRACE_SECONDS = 180;
+const POLL_SECONDS = 10;
 
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -17,7 +27,6 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     };
     try {
         const response = await axios.post(url, payload);
-        // console.log(`response: ${response}`);
         return response.data;
     } catch (error) {
         console.error("Error:", error.response ? error.response.data : error.message);
@@ -25,51 +34,84 @@ async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templ
     }
 }
 
+// The service's answer for the hash, or null while the service does not
+// know the hash yet (404).
 async function checkIpfsHashStatus(hash) {
     const url = `${BASE_URL}/api/checkHash/${hash}`;
     try {
         const response = await axios.get(url);
         return response.data;
     } catch (error) {
+        if (error.response && error.response.status === 404) return null;
         console.error("Error:", error.response ? error.response.data : error.message);
         process.exit(1);
     }
 }
 
-program
-    .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
-    .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
-    .requiredOption('--network <network>', 'Network')
-    .requiredOption('--template_version <templateVersion>', 'Template version');
+// Queues the image as described above and returns the service's first
+// answer for it. `submit`, `check`, `sleep` and `now` are the functions
+// above and the clock, replaceable for tests.
+async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
+    sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
+    log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
+    if (chainRegistered) {
+        const deadline = now() + graceSeconds;
+        while (true) {
+            const answer = await check(hash);
+            if (answer !== null) return answer;
+            if (now() >= deadline) {
+                log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
+                break;
+            }
+            log("Waiting for the certificate service to pick the registration up from the chain...");
+            await sleep(pollSeconds);
+        }
+    }
+    const submitResponse = await submit(hash, ...submitArgs);
+    log("Submit IPFS Hash Response:", submitResponse);
+    return null;
+}
 
-program.parse(process.argv);
+async function main() {
+    const program = new Command();
+    program
+        .requiredOption('--enclave_name <enclaveName>', 'Enclave name')
+        .requiredOption('--protocol_version <protocolVersion>', 'Protocol version')
+        .requiredOption('--network <network>', 'Network')
+        .requiredOption('--template_version <templateVersion>', 'Template version')
+        .option('--chain-registered', 'the image is registered on chain; wait for the service to queue it from the event before posting the hash');
+    program.parse(process.argv);
 
-const options = program.opts();
-const enclaveName = options.enclave_name;
-const protocolVersion = options.protocol_version;
-const network = options.network.toLowerCase().split("_")[1];
-const templateVersion = options.template_version;
+    const options = program.opts();
+    const enclaveName = options.enclave_name;
+    const protocolVersion = options.protocol_version;
+    const network = options.network.toLowerCase().split("_")[1];
+    const templateVersion = options.template_version;
 
-const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
-const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+    const hhash = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+    const dockerComposerHash = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
 
-console.log("IPFS Hash:", hhash);
-console.log("Enclave Name:", enclaveName);
-console.log("Protocol Version:", protocolVersion);
-console.log("Network:", network);
-console.log("Template Version:", templateVersion);
-console.log("Docker Composer Hash:", dockerComposerHash);
+    console.log("IPFS Hash:", hhash);
+    console.log("Enclave Name:", enclaveName);
+    console.log("Protocol Version:", protocolVersion);
+    console.log("Network:", network);
+    console.log("Template Version:", templateVersion);
+    console.log("Docker Composer Hash:", dockerComposerHash);
 
-(async () => {
-    // Submit IPFS Hash
-    const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
-    console.log("Submit IPFS Hash Response:", submitResponse);
+    let checkResponse = await queueImage({
+        hash: hhash, chainRegistered: Boolean(options.chainRegistered),
+        submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
+    });
 
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
     // (with reason) and the certificate when done.
     while (true) {
-        const checkResponse = await checkIpfsHashStatus(hhash);
+        if (checkResponse === null) {
+            await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+            checkResponse = await checkIpfsHashStatus(hhash);
+            continue;
+        }
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
                 if (checkResponse.status === "running") {
@@ -85,6 +127,17 @@ console.log("Docker Composer Hash:", dockerComposerHash);
                 console.log("Public Key:", checkResponse.publicKey);
                 // Save public key to file
                 fs.writeFileSync('PUBLIC_KEY.txt', checkResponse.publicKey);
+                // ESR (RFC §5.2): the enclave also prints ESR_WALLET_ADDRESS on the
+                // cert channel. The service currently returns only "publicKey"; when
+                // it starts relaying the enclave's output (or adds an
+                // "esrWalletAddress" field) it is picked up here and written to a
+                // sibling file the caller reads -- no other changes needed. Until
+                // then, ESR projects extract locally on an SGX host once to learn
+                // the address (publish then persists it).
+                if (checkResponse.esrWalletAddress) {
+                    console.log("ESR Wallet Address:", checkResponse.esrWalletAddress);
+                    fs.writeFileSync('ESR_WALLET_ADDRESS.txt', checkResponse.esrWalletAddress);
+                }
                 break;
             }
         } else {
@@ -92,6 +145,11 @@ console.log("Docker Composer Hash:", dockerComposerHash);
             process.exit(1);
         }
 
-        await new Promise(resolve => setTimeout(resolve, 10000)); // Wait for 10 seconds before checking again
+        await new Promise(resolve => setTimeout(resolve, POLL_SECONDS * 1000));
+        checkResponse = await checkIpfsHashStatus(hhash);
     }
-})();
+}
+
+if (require.main === module) main();
+
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };

package/pynithy/run.js

@@ -178,7 +178,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -187,7 +187,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -256,16 +256,13 @@ const main = async () => {
             const regex = new RegExp(`__${key}__`, 'g');
             content = content.replace(regex, value);
         }
-        // Mainnet attests production enclaves only; a testnet tolerates a
-        // debug-signed one. The tolerate list was edited by text replacement
-        // ('", debug-mode"'), which never matched this template's LEADING
-        // "debug-mode," -- so mainnet sessions were published tolerating debug
-        // enclaves. Written out per network instead.
+        // The session's attestation rules for this network: a debug-signed
+        // enclave and every Intel advisory are tolerated on a testnet only
+        // (cas/config.js sessionAttestation).
+        const attestation = casConfig.sessionAttestation(process.env.BLOCKCHAIN_NETWORK);
         content = content
-            .replace(/__TOLERATE__/g, isMainnet
-                ? '[hyperthreading, outdated-tcb, software-hardening-needed]'
-                : '[debug-mode, hyperthreading, outdated-tcb, software-hardening-needed]')
-            .replace(/__IGNORE_ADVISORIES__/g, isMainnet ? '["INTEL-SA-00615"]' : '["*"]');
+            .replace(/__TOLERATE__/g, attestation.tolerate)
+            .replace(/__IGNORE_ADVISORIES__/g, attestation.ignoreAdvisories);
 
         fs.writeFileSync(outputFile, content);
         // console.log(`Contents of ${outputFile}:`);
@@ -656,7 +653,7 @@ const main = async () => {
         console.log("");
 
         const opt = ["yes", "no"];
-        const choice = await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
+        const choice = process.env.ECLD_ASSUME_YES ? 'yes' : await promptOptions("Do you want to continue by generating the necessary certificates using the Ethernity Cloud public certificate extraction services? (yes/no) (default: no): ", opt, "no");
 
         if (choice.toLowerCase() !== 'yes') {
             console.log("Exiting.");
@@ -664,7 +661,7 @@ const main = async () => {
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"${registryV2 ? ' --chain-registered' : ''}`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -731,7 +728,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], ['ignore', 'inherit', 'inherit']);
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/run.js

@@ -178,7 +178,7 @@ async function main() {
   // ---- drive the runner ----
   let runner;
   try {
-    runner = new EthernityCloudRunner(network.address, { privateKey }, network.chainId);
+    runner = new EthernityCloudRunner(network.address, network.rpcUrl ? { privateKey, rpcUrl: network.rpcUrl } : { privateKey }, network.chainId);
     if (network.unsafe) await runner.setNetwork(...network.unsafe);
   } catch (e) {
     console.error('ecld-run: could not initialise the runner: ' + e.message);