@inco/lightning 0.2.16 → 0.3.1

package/src/lightning-parts/TEELifecycle.sol

@@ -0,0 +1,255 @@
+/// SPDX-License-Identifier: No License
+pragma solidity ^0.8.19;
+
+import "./TEELifecycle.types.sol";
+
+import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+import {EIP712} from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import {IQuoteVerifier} from "automata-dcap-attestation/interfaces/IQuoteVerifier.sol";
+import {BELE} from "automata-dcap-attestation/utils/BELE.sol";
+import {HEADER_LENGTH} from "automata-dcap-attestation/types/Constants.sol";
+import {TD10ReportBody, Header} from "automata-dcap-attestation/types/V4Structs.sol";
+import {EIP712Upgradeable} from "@openzeppelin/contracts-upgradeable/utils/cryptography/EIP712Upgradeable.sol";
+import {EnclaveIdentityJsonObj, IdentityObj} from "@automata-network/on-chain-pccs/helpers/EnclaveIdentityHelper.sol";
+import {TcbInfoJsonObj} from "@automata-network/on-chain-pccs/helpers/FmspcTcbHelper.sol";
+import {AutomataFmspcTcbDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataFmspcTcbDao.sol";
+import {AutomataEnclaveIdentityDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataEnclaveIdentityDao.sol";
+
+// @todo: Make this contract UUPSUpgradeable: https://github.com/Inco-fhevm/inco-monorepo/issues/875
+contract TEELifecycle is OwnableUpgradeable, EIP712Upgradeable {
+
+    event QuoteVerifierUpdated(uint16 indexed version);
+
+    event BootstrapStageComplete(
+        address indexed newEOASigner,
+        BootstrapResult bootstrapResult
+    );
+
+    event TEEVersionUpdated(
+        TEEVersion teeVersion
+    );
+
+    event NewCovalidatorAdded(
+        address covalidatorAddress,
+        bytes quote
+    );
+
+    bytes32 public constant BootstrapResultStructHash = 
+        keccak256(bytes(
+            "BootstrapResult(bytes ecies_pubkey)"
+        ));
+
+    uint16 public constant QUOTE_VERIFIER_VERSION = 4;
+
+    IQuoteVerifier quoteVerifier;
+
+    BootstrapResult public VerifiedBootstrapResult;
+
+    TEEVersion[] public TEEVersionHistory;
+    bytes public ECIESPubkey;
+    mapping(address => bool) public EOASigners;
+
+    function initialize(address owner, string memory eip712Name, string memory eip712Version, address quoteVerifierAddress) public initializer {
+        __Ownable_init(owner);
+        __EIP712_init(eip712Name, eip712Version);
+        quoteVerifier = IQuoteVerifier(quoteVerifierAddress);
+        require(quoteVerifier.quoteVersion() == QUOTE_VERIFIER_VERSION, "Invalid quote verifier version");
+    }
+
+    /**
+     * @notice Uploads the collateral to the contract
+     * @param tcbInfo - The TCB info to upload
+     * @param identity - The identity to upload
+     */
+    function uploadCollateral(TcbInfoJsonObj memory tcbInfo, EnclaveIdentityJsonObj memory identity) public onlyOwner {
+        require(bytes(tcbInfo.tcbInfoStr).length != 0, "tcbInfo.tcbInfoStr must not be empty");
+        require(bytes(identity.identityStr).length != 0, "identity.identityStr must not be empty");
+
+        AutomataFmspcTcbDao fmspcTcbDao = AutomataFmspcTcbDao(quoteVerifier.pccsRouter().fmspcTcbDaoAddr());
+        fmspcTcbDao.upsertFmspcTcb(tcbInfo);
+        AutomataEnclaveIdentityDao enclaveIdDao = AutomataEnclaveIdentityDao(quoteVerifier.pccsRouter().qeIdDaoAddr());
+        (IdentityObj memory identityObj,) = enclaveIdDao.EnclaveIdentityLib().parseIdentityString(identity.identityStr);
+        enclaveIdDao.upsertEnclaveIdentity(uint256(identityObj.id), 4, identity);
+    }
+
+    /**
+     * @notice Verifies the bootstrap data against the provided quote and signature
+     * @param bootstrapResult - The bootstrap data to verify
+     * @param quote - The quote to verify against
+     * @param signature - The signature to verify against
+     */
+    function verifyBootstrapResult(BootstrapResult calldata bootstrapResult, bytes calldata quote, bytes calldata signature) public onlyOwner {
+        // Make sure the bootstrap is not already complete, and that the contract owner
+        // has already submitted the pending TEE MRTD.
+        require(!isBootstrapComplete(), "Bootstrap already completed");
+        require(TEEVersionHistory.length == 1, "TEEVersionHistory must have exactly one version, please call approveNewTEEVersion first");
+        require(TEEVersionHistory[0].status == TEEVersionStatus.PENDING, "TEEVersionHistory must still be pending");
+
+        bytes32 _bootstrapResultDigest = bootstrapResultDigest(bootstrapResult);
+        (bool success, bytes memory output) = _verifyAndAttestOnChain(quote);
+        require(success, string(output));
+
+        bytes memory v0MRTD = TEEVersionHistory[0].mrtd;
+
+        TD10ReportBody memory tdReport = parseTD10ReportBody(quote);
+        (address reportDataSigner, bytes memory reportMRTD) = parseReport(tdReport);
+        require(keccak256(reportMRTD) == keccak256(v0MRTD), "Invalid report MRTD");
+        address recoveredAddress = ECDSA.recover(_bootstrapResultDigest, signature);
+        require(recoveredAddress == reportDataSigner, "Invalid signature for bootstrap data");
+
+        VerifiedBootstrapResult = bootstrapResult;
+        TEEVersionHistory[0].status = TEEVersionStatus.ACTIVE;
+        emit BootstrapStageComplete(reportDataSigner, bootstrapResult);
+        ECIESPubkey = bootstrapResult.ecies_pubkey;
+        EOASigners[reportDataSigner] = true;
+        //TODO: update ECIES public key to ?? contract state and EOA addresses signers to the Signers contract state
+    }
+
+    /**
+     * @notice Approves a new TEE version and updates the TEEVersionHistory
+     * @param newMRTD - The MRTD bytes of the new TEE version
+     * @dev This function increments the version number automatically based on the current history
+     */
+    function approveNewTEEVersion(bytes calldata newMRTD) public onlyOwner {
+        require(newMRTD.length == 48, "MRTD must be 48 bytes");
+        
+        TEEVersionHistory.push(TEEVersion({
+            mrtd: newMRTD,
+            status: TEEVersionStatus.PENDING
+        }));
+        
+        emit TEEVersionUpdated(TEEVersionHistory[TEEVersionHistory.length - 1]);
+    }
+
+    /**
+     * @notice Adds a new covalidator to the contract state
+     * @param quote - The quote from the new covalidator that contains the current MRTD and the eoa address of the new party in the report data
+     */
+    function addNewCovalidator(bytes calldata quote) public onlyOwner {
+        require(isBootstrapComplete(), "Bootstrap not complete");
+
+        (bool success, bytes memory output) = _verifyAndAttestOnChain(quote);
+        require(success, string(output));
+        TD10ReportBody memory tdReport = parseTD10ReportBody(quote);
+        (address reportDataSigner, bytes memory reportMRTD) = parseReport(tdReport);
+        require(!EOASigners[reportDataSigner], "EOA signer already initialized");
+        
+        require(keccak256(reportMRTD) == keccak256(TEEVersionHistory[TEEVersionHistory.length - 1].mrtd), "Invalid report MRTD");
+        require(reportDataSigner != address(0), "Invalid report data signer");
+        emit NewCovalidatorAdded(reportDataSigner, quote);
+        EOASigners[reportDataSigner] = true;
+        //TODO: Add the new covalidator signers to the Signers contract state
+    }
+
+    /**
+     * @notice Checks if the bootstrap is complete, meaning that there is an active TEE version.
+     * @return true if the bootstrap is complete, false otherwise
+     */
+    function isBootstrapComplete() public view returns (bool) {
+        return TEEVersionHistory.length >= 1 && TEEVersionHistory[0].status == TEEVersionStatus.ACTIVE;
+    }
+
+    /**
+     * @notice From https://github.com/automata-network/automata-dcap-attestation/blob/evm-v1.0.0/evm/contracts/AttestationEntrypointBase.sol#L103
+     * @notice full on-chain verification for an attestation
+     * @param rawQuote - Intel DCAP Quote serialized in raw bytes
+     * @return success - whether the quote has been successfully verified or not
+     * @return output - the output upon completion of verification. The output data may require post-processing by the consumer.
+     * For verification failures, the output is simply a UTF-8 encoded string, describing the reason for failure.
+     * @dev can directly type-cast the failed output as a string
+     */
+    function _verifyAndAttestOnChain(bytes calldata rawQuote) internal view returns (bool success, bytes memory output) {
+        // Parse the header
+        Header memory header;
+        (success, header) = _parseQuoteHeader(rawQuote);
+        if (!success) {
+            return (false, bytes("Could not parse quote header"));
+        }
+
+        if (QUOTE_VERIFIER_VERSION != header.version) {
+            return (false, bytes("Unsupported quote version"));
+        }
+
+        // We found a supported version, begin verifying the quote
+        // Note: The quote header cannot be trusted yet, it will be validated by the Verifier library
+        (success, output) = quoteVerifier.verifyQuote(header, rawQuote);
+    }
+
+    /**
+     * @notice From https://github.com/automata-network/automata-dcap-attestation/blob/evm-v1.0.0/evm/contracts/AttestationEntrypointBase.sol#L168
+     * @notice Parses the header to get basic information about the quote, such as the version, TEE types etc.
+     */
+    function _parseQuoteHeader(bytes calldata rawQuote) private pure returns (bool success, Header memory header) {
+        success = rawQuote.length >= HEADER_LENGTH;
+        if (success) {
+            uint16 version = uint16(BELE.leBytesToBeUint(rawQuote[0:2]));
+            bytes4 teeType = bytes4(rawQuote[4:8]);
+            bytes2 attestationKeyType = bytes2(rawQuote[2:4]);
+            bytes2 qeSvn = bytes2(rawQuote[8:10]);
+            bytes2 pceSvn = bytes2(rawQuote[10:12]);
+            bytes16 qeVendorId = bytes16(rawQuote[12:28]);
+            bytes20 userData = bytes20(rawQuote[28:48]);
+
+            header = Header({
+                version: version,
+                attestationKeyType: attestationKeyType,
+                teeType: teeType,
+                qeSvn: qeSvn,
+                pceSvn: pceSvn,
+                qeVendorId: qeVendorId,
+                userData: userData
+            });
+        }
+    }
+
+    /**
+     * @notice From https://github.com/automata-network/automata-dcap-attestation/blob/evm-v1.0.0/evm/contracts/verifiers/V4QuoteVerifier.sol#L309
+     * @notice Parses the TD10 report body from the raw quote
+     * @param rawQuote - The raw quote bytes
+     * @return report - The parsed TD10 report body
+     */
+    function parseTD10ReportBody(bytes calldata rawQuote) public pure returns (TD10ReportBody memory report) {
+        report = TD10ReportBody({
+            teeTcbSvn: bytes16(rawQuote[HEADER_LENGTH:HEADER_LENGTH+16]),
+            mrSeam: bytes(rawQuote[HEADER_LENGTH+16:HEADER_LENGTH+64]),
+            mrsignerSeam: bytes(rawQuote[HEADER_LENGTH+64:HEADER_LENGTH+112]),
+            seamAttributes: bytes8(uint64(BELE.leBytesToBeUint(rawQuote[HEADER_LENGTH+112:HEADER_LENGTH+120]))),
+            tdAttributes: bytes8(uint64(BELE.leBytesToBeUint(rawQuote[HEADER_LENGTH+120:HEADER_LENGTH+128]))),
+            xFAM: bytes8(uint64(BELE.leBytesToBeUint(rawQuote[HEADER_LENGTH+128:HEADER_LENGTH+136]))),
+            mrTd: bytes(rawQuote[HEADER_LENGTH+136:HEADER_LENGTH+184]),
+            mrConfigId: bytes(rawQuote[HEADER_LENGTH+184:HEADER_LENGTH+232]),
+            mrOwner: bytes(rawQuote[HEADER_LENGTH+232:HEADER_LENGTH+280]),
+            mrOwnerConfig: bytes(rawQuote[HEADER_LENGTH+280:HEADER_LENGTH+328]),
+            rtMr0: bytes(rawQuote[HEADER_LENGTH+328:HEADER_LENGTH+376]),
+            rtMr1: bytes(rawQuote[HEADER_LENGTH+376:HEADER_LENGTH+424]),
+            rtMr2: bytes(rawQuote[HEADER_LENGTH+424:HEADER_LENGTH+472]),
+            rtMr3: bytes(rawQuote[HEADER_LENGTH+472:HEADER_LENGTH+520]),
+            reportData: bytes(rawQuote[HEADER_LENGTH+520:HEADER_LENGTH+584])
+        });
+    }
+
+    /**
+     * @notice Parses the TD10 report to extract the report data and MRTD
+     * @param tdReport - The TD10 report body
+     * @return reportDataSigner - The signing address of the report data signer
+     * @return reportMRTD - The MRTD bytes from the report
+     */
+    function parseReport(TD10ReportBody memory tdReport) public pure returns (address, bytes memory) {
+        return (address(bytes20(tdReport.reportData)), tdReport.mrTd);
+    }
+
+    function bootstrapResultDigest(
+        BootstrapResult memory bootstrapResult
+    ) public view returns (bytes32) {
+        return 
+            _hashTypedDataV4(
+                keccak256(
+                    abi.encode(
+                        BootstrapResultStructHash,
+                        keccak256(bootstrapResult.ecies_pubkey)
+                    )
+                )
+            );
+    }
+}

package/src/lightning-parts/TEELifecycle.types.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: No License
+pragma solidity ^0.8.19;
+
+struct BootstrapResult {
+    bytes ecies_pubkey;
+}
+
+enum TEEVersionStatus {
+    PENDING,
+    ACTIVE
+}
+
+/**
+ * @notice A struct representing a TEE version. The actual version number is the index in the TEEVersionHistory array.
+ * @param mrtd - The MRTD of the TEE version
+ * @param status - The status of the TEE version
+ */
+struct TEEVersion {
+    bytes mrtd;
+    TEEVersionStatus status;
+}

package/src/lightning-parts/primitives/SignatureVerifier.gen.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8;
 
 import { OwnableUpgradeable } from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 import { ECDSA } from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+import { TEELifecycle } from "../TEELifecycle.sol";
 
 interface ISignatureVerifierGen {
     function addSigner(address signerAddress) external;

package/src/lightning-parts/primitives/SignatureVerifier.sol

@@ -4,6 +4,7 @@ pragma solidity ^0.8;
 import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 import {ISignatureVerifierGen} from "./SignatureVerifier.gen.sol";
+import {TEELifecycle} from "../TEELifecycle.sol";
 
 contract SignatureVerifierStorage {
     struct StorageForSigVerifier {
@@ -35,11 +36,20 @@ contract SignatureVerifier is ISignatureVerifierGen, OwnableUpgradeable, Signatu
     event AddedSignatureVerifier(address signerAddress);
     event RemovedSignatureVerifier(address signerAddress);
 
+    // Reference to the TEELifecycle contract, to get the list of EOA signers
+    TEELifecycle teeLifecycle;
+
+    function __SignatureVerifier_init(address _teeLifecycleAddress) internal {
+        teeLifecycle = TEELifecycle(_teeLifecycleAddress);
+    }
+
+    // @todo: This function should be removed once we have a way to read the signers from the TEELifecycle contract
     function addSigner(address signerAddress) external onlyOwner {
         getSigVerifierStorage().isSigner[signerAddress] = true;
         emit AddedSignatureVerifier(signerAddress);
     }
 
+    // @todo: This function should be removed once we have a way to read the signers from the TEELifecycle contract
     function removeSigner(address signerAddress) external onlyOwner {
         require(
             getSigVerifierStorage().isSigner[signerAddress],
@@ -49,6 +59,7 @@ contract SignatureVerifier is ISignatureVerifierGen, OwnableUpgradeable, Signatu
         emit AddedSignatureVerifier(signerAddress);
     }
 
+    // @todo: This function should read from the TEELifecycle contract instead of the storage
     function isSigner(address signerAddress) public view returns (bool) {
         return getSigVerifierStorage().isSigner[signerAddress];
     }

package/src/lightning-parts/test/HandleMetadata.t.sol

@@ -7,7 +7,7 @@ import {TrivialEncryption} from "../TrivialEncryption.sol";
 import {EncryptedOperations} from "../EncryptedOperations.sol";
 import {EncryptedInput} from "../EncryptedInput.sol";
 import {EIP712} from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
-import {ETypes, ebool, euint256, eaddress} from "../../Types.sol";
+import {ETypes, ebool, euint256, eaddress, typeToBitMask} from "../../Types.sol";
 
 contract TestHandleMetadata is
     EIP712,

package/src/test/FakeIncoInfra/FakeQuoteVerifier.sol

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: No License
+pragma solidity ^0.8;
+
+import {IPCCSRouter} from "@automata-network/dcap-attestation/interfaces/IPCCSRouter.sol";
+import {Header} from "@automata-network/dcap-attestation/types/CommonStruct.sol";
+import {IQuoteVerifier} from "automata-dcap-attestation/interfaces/IQuoteVerifier.sol";
+
+// This contract is used to test the IncoLightning contract. It is a simple implementation of the QuoteVerifier interface.
+// It is used to test the IncoLightning contract without relying on the real QuoteVerifier contract.
+contract FakeQuoteVerifier is IQuoteVerifier {
+    /// @dev immutable
+    function pccsRouter() external pure returns (IPCCSRouter) {
+        return IPCCSRouter(address(0));
+    }
+
+    /// @dev immutable
+    function quoteVersion() external pure returns (uint16) {
+        return 4;
+    }
+
+    function verifyQuote(Header calldata, bytes calldata quote) external pure returns (bool, bytes memory) {
+        return (true, quote);
+    }
+
+    function verifyZkOutput(bytes calldata quote) external pure returns (bool, bytes memory) {
+        return (true, quote);
+    }
+
+}

package/src/test/FakeIncoInfra/MockRemoteAttestation.sol

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: No License
+pragma solidity ^0.8;
+
+import {TestUtils} from "@inco/shared/src/TestUtils.sol";
+import {TEELifecycle} from "@inco/lightning/src/lightning-parts/TEELifecycle.sol";
+
+import {HEADER_LENGTH, MINIMUM_QUOTE_LENGTH, TDX_TEE} from "@automata-network/dcap-attestation/types/Constants.sol";
+import {BootstrapResult} from "@inco/lightning/src/lightning-parts/TEELifecycle.types.sol";
+
+contract MockRemoteAttestation is TestUtils {
+    function createQuote(
+        bytes memory mrtd,
+        address signer
+    ) public pure returns (bytes memory quote) {
+        // Mock implementation of quote creation
+        require(mrtd.length == 48, "MRTD should be 48 bytes");
+        /* Quote structure:
+            - version ([0:4], 4 bytes long)
+            - teeType ([4:8], 4 bytes long)
+            - prefix ([8:HEADER_LENGTH+136], HEADER_LENGTH+136 - 8 bytes long)
+            - mrtd ([HEADER_LENGTH+136:HEADER_LENGTH+184], 48 bytes long)
+            - middle ([HEADER_LENGTH+184:HEADER_LENGTH+520], 336 bytes long)
+            - reportData ([HEADER_LENGTH+520:HEADER_LENGTH+584], 64 bytes long)
+                - signer ([HEADER_LENGTH+520:HEADER_LENGTH+540], 20 bytes long)
+                - reportDataSuffix ([HEADER_LENGTH+540:HEADER_LENGTH+584], 44 bytes long)
+           - suffix ([HEADER_LENGTH+584:MINIMUM_QUOTE_LENGTH], remaining bytes to reach MINIMUM_QUOTE_LENGTH)
+
+        */
+        bytes4 version = 0x04000000; // Version 4
+        bytes4 tdxTEEType = TDX_TEE; // TDX TEETYPE
+        bytes memory prefix = new bytes(HEADER_LENGTH + 136 - 8);
+        bytes memory middle = new bytes(520 - 184);
+        bytes memory reportDataSuffix = new bytes(44);
+        bytes memory suffix = new bytes(MINIMUM_QUOTE_LENGTH - HEADER_LENGTH - 584);
+        quote = abi.encodePacked(version, tdxTEEType, prefix, mrtd, middle, abi.encodePacked(signer), reportDataSuffix, suffix);
+    }
+}

package/src/test/FibonacciDecrypt.sol

@@ -17,6 +17,7 @@ contract FibonacciDecrypt {
     function fib(
         uint256 n
     ) external returns (uint256 lastRequestId, euint256 nthTerm) {
+        require(address(inco) != address(0), "IncoLightning not set");
         euint256 prev = inco.asEuint256(0);
         lastRequestId = emitTerm(prev);
         nthTerm = inco.asEuint256(1);

package/src/test/IncoTest.sol

@@ -7,6 +7,7 @@ import {inco} from "../Lib.sol";
 import {DeployUtils} from "../DeployUtils.sol";
 import {deployedBy} from "../Lib.sol";
 import {console} from "forge-std/console.sol";
+import {FakeQuoteVerifier} from "./FakeIncoInfra/FakeQuoteVerifier.sol";
 
 contract IncoTest is MockOpHandler, DeployUtils {
     address immutable owner;
@@ -25,12 +26,15 @@ contract IncoTest is MockOpHandler, DeployUtils {
     function setUp() public virtual {
         deployCreateX();
         vm.startPrank(testDeployer);
+        vm.setEnv("USE_TDX_HW", "false"); // results in the test deployment using the FakeQuoteVerifier
         IncoLightning proxy = deployIncoLightningUsingConfig({
             deployer: testDeployer,
         // The highest precedent deployment
             pepper: "testnet",
             minorVersionForSalt: 1,
-            patchVersionForSalt: 29
+            patchVersionForSalt: 29,
+            includePreviewFeatures: false,
+            teeLifecycleAddress: address(0)
         });
         proxy.transferOwnership(owner);
         vm.stopPrank();

package/src/test/TEELifecycle/README.md

@@ -0,0 +1,53 @@
+# TEE Lifecycle Test
+
+## TEELifecycle HW Test
+
+This test data was generated using Adrian's V0 TDX VM running in GCP. The data
+was returned collected using the `agent-lib` tool. 
+
+* To generate new test data: for `test_LifecycleBootstrap`
+
+```bash
+cd agent-lib
+
+cargo run --features hw -- start-bootstrap \
+    --expected-mrtd 0x409c0cd3e63d9ea54d817cf851983a220131262664ac8cd02cc6a2e19fd291d2fdd0cc035d7789b982a43a92a4424c99 \
+    --tee-lifecycle-grpc-url http://34.91.236.235:4321 \
+    --output-dir ../contracts/lightning/src/test/TEELifecycle/bootstrap_data 
+```
+
+* To generate new test data for `test_LifecycleNewEOA`
+
+```bash
+cd agent-lib
+
+# TODO: change this to add-node endpoint after https://github.com/Inco-fhevm/inco-monorepo/issues/889
+cargo run --features hw -- start-bootstrap \
+    --expected-mrtd 0x409c0cd3e63d9ea54d817cf851983a220131262664ac8cd02cc6a2e19fd291d2fdd0cc035d7789b982a43a92a4424c99 \
+    --tee-lifecycle-grpc-url http://34.91.236.235:4321 \
+    --output-dir ../contracts/lightning/src/test/TEELifecycle/addnode_data 
+
+# Delete the unused output data since it is not used
+# to add a node
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/ecies_pubkey.bin
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/eip712_signature.bin
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/qe_identity
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/qe_identity_signature.bin
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/tcb_info
+rm ../contracts/lightning/src/test/TEELifecycle/addnode_data/tcb_info_signature.bin
+```
+
+* To generate the Intel root certificates
+
+```bash
+cd contracts/lightning/src/test/TEELifecycle/test_cert
+python3 -m pip install -r ../../../../../lightning-deployment/script/tee/requirements.txt
+python3 ../../../../../lightning-deployment/script/tee/get_ca_certs.py
+```
+
+* Hard code the block timestamp to the current time to ensure that there is no certificate out of date errors 
+by setting  `uint256 collateral_timestamp =` in [TEELifecycleHWTest.t](TEELifecycleHWTest.t.sol#24) to the output of:
+
+```bash
+echo $(date +%s)
+```

package/src/test/TEELifecycle/TEELifecycleHWTest.t.sol

@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: No License
+pragma solidity ^0.8;
+
+import "forge-std/Test.sol";
+
+import "../../lightning-parts/TEELifecycle.types.sol";
+import "../../lightning-parts/TEELifecycle.sol";
+import "../../DeployUtils.sol";
+import "../../DeployTEE.sol";
+import {TestUtils} from "@inco/shared/src/TestUtils.sol";
+
+import {EnclaveIdentityJsonObj} from "@automata-network/on-chain-pccs/helpers/EnclaveIdentityHelper.sol";
+import {TcbInfoJsonObj} from "@automata-network/on-chain-pccs/helpers/FmspcTcbHelper.sol";
+import {IQuoteVerifier} from "automata-dcap-attestation/interfaces/IQuoteVerifier.sol";
+
+contract TEELifecycleHWTest is DeployUtils , TestUtils, DeployTEE {
+    using stdStorage for StdStorage;
+
+    // This is the MRTD from Adrian's v0 TDX VM running on GCP that was used to generate the test data.
+    bytes public v0mrtd = hex"409c0cd3e63d9ea54d817cf851983a220131262664ac8cd02cc6a2e19fd291d2fdd0cc035d7789b982a43a92a4424c99";
+
+    // This is the address that is used as the lifecycle contract address in Adrian's v0 TDX VM.
+    address lifecycleAddress = 0x63D8135aF4D393B1dB43B649010c8D3EE19FC9fd;
+
+    // Avoid expired collateral and certificate errors by setting time to
+    // the date when the test data was generated.
+    uint256 collateral_timestamp = 1754498833; 
+
+    // This is the location of the bootstrap and add node and test data files
+    string bootstrapDir;
+    string addNodeDir;
+
+    TEELifecycle lifecycle;
+
+    address immutable owner; 
+    
+    constructor() {
+        owner = getLabeledAddress("owner");
+    }
+    
+    function setUp() public {
+        // This test data was generate by running the TEELifecycle binary in a real TDX environment
+        // to generate the quote and other files.
+        bootstrapDir = string.concat(vm.projectRoot(), "/src/test/TEELifecycle/bootstrap_data/");
+        addNodeDir = string.concat(vm.projectRoot(), "/src/test/TEELifecycle/addnode_data/");
+        string memory certDir = string.concat(vm.projectRoot(), "/src/test/TEELifecycle/test_cert/");
+
+        vm.warp(collateral_timestamp);
+        vm.startPrank(owner);
+        
+        // PCCS Setup
+        deployP256();
+        deployPCCS(owner, certDir);
+        IQuoteVerifier quoteVerifier = deployQuoteVerifier();
+
+        bytes memory lifecycleCode = address(deployTEELifecycle(owner, address(quoteVerifier))).code;
+        // Make sure the verifyingContract for the EIP217 domain matches the one in the test data
+        // By using vm.etch to deploy the TEELifecycle contract at a specific address
+        vm.etch(lifecycleAddress, lifecycleCode);
+        lifecycle = TEELifecycle(lifecycleAddress);
+
+        // Make sure the name and version for the EIP712 domain matches the one in the test data
+        lifecycle.initialize(owner, "IncoTeeLifecycleBootstrap", "1.0.0", address(quoteVerifier));
+
+        vm.stopPrank();
+    }
+
+    function test_LifecycleBootstrap() public {
+        _uploadCollateral(bootstrapDir);
+        string memory expected_address_string = vm.readFile(string.concat(bootstrapDir, "eoa.txt"));
+        address expected_address = vm.parseAddress(expected_address_string);
+    
+        vm.startPrank(owner);
+        bytes memory pubkey = vm.readFileBinary(string.concat(bootstrapDir, "ecies_pubkey.bin"));
+        BootstrapResult memory bootstrapResult = BootstrapResult({ecies_pubkey: pubkey});
+        bytes memory quote = vm.readFileBinary(string.concat(bootstrapDir, "quote.bin"));
+        bytes memory sig = vm.readFileBinary(string.concat(bootstrapDir, "eip712_signature.bin"));
+        lifecycle.approveNewTEEVersion(v0mrtd);
+        lifecycle.verifyBootstrapResult(bootstrapResult, quote, sig);
+
+        (bytes memory mrtd,) = lifecycle.TEEVersionHistory(0);
+        assert(keccak256(mrtd) == keccak256(v0mrtd));
+        assert(lifecycle.isBootstrapComplete() == true);
+        assert(keccak256(lifecycle.ECIESPubkey()) == keccak256(pubkey));
+        assert(lifecycle.EOASigners(expected_address));
+        vm.stopPrank();
+    }
+
+    function test_LifecycleNewEOA() public {
+        // This test assumes that the lifecycle bootstrap is already completed
+        test_LifecycleBootstrap();
+
+        string memory expected_address_string = vm.readFile(string.concat(addNodeDir, "eoa.txt"));
+        address expected_address = vm.parseAddress(expected_address_string);
+
+        vm.startPrank(owner);
+        bytes memory quote2 = vm.readFileBinary(string.concat(addNodeDir, "quote.bin"));
+        lifecycle.addNewCovalidator(quote2);
+        vm.stopPrank();
+
+        assert(lifecycle.EOASigners(expected_address));
+    }
+
+    function _uploadCollateral(string memory collateralDir) private {
+        vm.startPrank(owner);
+        // upload collateral
+        string memory tcbInfoStr = vm.readFile(string.concat(collateralDir, "tcb_info"));
+        bytes memory tcbInfoSig = vm.readFileBinary(string.concat(collateralDir, "tcb_info_signature.bin"));
+        TcbInfoJsonObj memory tcbInfo = TcbInfoJsonObj(tcbInfoStr, tcbInfoSig);
+
+        string memory qeIdStr = vm.readFile(string.concat(collateralDir, "qe_identity"));
+        bytes memory qeIdSig = vm.readFileBinary(string.concat(collateralDir, "qe_identity_signature.bin"));
+        EnclaveIdentityJsonObj memory identityJson = EnclaveIdentityJsonObj(qeIdStr, qeIdSig);
+        
+        lifecycle.uploadCollateral(tcbInfo, identityJson);
+
+        vm.stopPrank();
+    }
+}