@inco/lightning 0.3.2 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/README.md +2 -8
  2. package/manifest.yaml +24 -11
  3. package/package.json +2 -5
  4. package/src/DeployUtils.sol +113 -77
  5. package/src/IIncoLightning.sol +16 -9
  6. package/src/IncoLightning.sol +18 -9
  7. package/src/IncoVerifier.sol +47 -0
  8. package/src/Lib.alphanet.sol +14 -15
  9. package/src/Lib.demonet.sol +14 -15
  10. package/src/Lib.devnet.sol +14 -15
  11. package/src/Lib.sol +14 -15
  12. package/src/Lib.template.sol +15 -44
  13. package/src/Lib.testnet.sol +14 -15
  14. package/src/Types.sol +7 -0
  15. package/src/interfaces/IIncoLightning.sol +20 -0
  16. package/src/interfaces/IIncoVerifier.sol +24 -0
  17. package/src/interfaces/automata-interfaces/BELE.sol +20 -0
  18. package/src/interfaces/automata-interfaces/IAutomataEnclaveIdentityDao.sol +28 -0
  19. package/src/interfaces/automata-interfaces/IFmspcTcbDao.sol +10 -0
  20. package/src/interfaces/automata-interfaces/IPCCSRouter.sol +94 -0
  21. package/src/interfaces/automata-interfaces/IPCCSRouterExtended.sol +10 -0
  22. package/src/interfaces/automata-interfaces/IPcsDao.sol +18 -0
  23. package/src/interfaces/automata-interfaces/IQuoteVerifier.sol +34 -0
  24. package/src/interfaces/automata-interfaces/Types.sol +193 -0
  25. package/src/libs/incoLightning_alphanet_v0_297966649.sol +14 -15
  26. package/src/libs/incoLightning_demonet_v0_863421733.sol +14 -15
  27. package/src/libs/incoLightning_devnet_v0_340846814.sol +14 -15
  28. package/src/libs/incoLightning_testnet_v0_183408998.sol +14 -15
  29. package/src/libs/incoLightning_testnet_v1_938327937.sol +451 -0
  30. package/src/lightning-parts/AccessControl/AdvancedAccessControl.sol +133 -0
  31. package/src/lightning-parts/AccessControl/AdvancedAccessControl.types.sol +18 -0
  32. package/src/lightning-parts/AccessControl/BaseAccessControlList.sol +42 -3
  33. package/src/lightning-parts/AccessControl/interfaces/IAdvancedAccessControl.sol +25 -0
  34. package/src/lightning-parts/AccessControl/interfaces/IBaseAccessControlList.sol +24 -0
  35. package/src/lightning-parts/AccessControl/test/TestAdvancedAccessControl.t.sol +234 -0
  36. package/src/lightning-parts/AccessControl/test/TestBaseAccessControl.t.sol +16 -2
  37. package/src/lightning-parts/DecryptionAttester.sol +45 -0
  38. package/src/lightning-parts/DecryptionAttester.types.sol +7 -0
  39. package/src/lightning-parts/EncryptedInput.sol +10 -13
  40. package/src/lightning-parts/EncryptedOperations.sol +78 -28
  41. package/src/lightning-parts/TEELifecycle.sol +180 -88
  42. package/src/lightning-parts/TrivialEncryption.sol +9 -9
  43. package/src/lightning-parts/interfaces/IDecryptionAttester.sol +9 -0
  44. package/src/lightning-parts/interfaces/IEncryptedInput.sol +19 -0
  45. package/src/lightning-parts/interfaces/IEncryptedOperations.sol +31 -0
  46. package/src/lightning-parts/interfaces/ITEELifecycle.sol +26 -0
  47. package/src/lightning-parts/interfaces/ITrivialEncryption.sol +10 -0
  48. package/src/lightning-parts/primitives/EventCounter.sol +15 -3
  49. package/src/lightning-parts/primitives/HandleGeneration.sol +8 -3
  50. package/src/lightning-parts/primitives/HandleMetadata.sol +1 -1
  51. package/src/lightning-parts/primitives/LightningAddressGetter.sol +10 -0
  52. package/src/lightning-parts/primitives/SignatureVerifier.sol +2 -9
  53. package/src/lightning-parts/primitives/VerifierAddressGetter.sol +13 -0
  54. package/src/lightning-parts/primitives/{EventCounter.gen.sol → interfaces/IEventCounter.sol} +4 -2
  55. package/src/lightning-parts/primitives/interfaces/IHandleGeneration.sol +41 -0
  56. package/src/lightning-parts/primitives/interfaces/ISignatureVerifier.sol +9 -0
  57. package/src/lightning-parts/primitives/interfaces/IVerifierAddressGetter.sol +8 -0
  58. package/src/lightning-parts/test/HandleMetadata.t.sol +25 -6
  59. package/src/lightning-parts/test/TestDecryptionAttestationInSynchronousFlow.t.sol +78 -0
  60. package/src/periphery/SessionVerifier.sol +63 -0
  61. package/src/test/AddTwo.sol +20 -24
  62. package/src/test/FakeIncoInfra/FakeDecryptionAttester.sol +198 -0
  63. package/src/test/FakeIncoInfra/FakeIncoInfraBase.sol +0 -15
  64. package/src/test/FakeIncoInfra/FakeQuoteVerifier.sol +10 -6
  65. package/src/test/FakeIncoInfra/MockOpHandler.sol +0 -7
  66. package/src/test/FakeIncoInfra/MockRemoteAttestation.sol +19 -7
  67. package/src/test/FakeIncoInfra/getOpForSelector.sol +0 -3
  68. package/src/test/IncoTest.sol +12 -11
  69. package/src/test/TEELifecycle/TEELifecycleMockTest.t.sol +98 -77
  70. package/src/test/TestAddTwo.t.sol +16 -9
  71. package/src/test/TestFakeInfra.t.sol +10 -27
  72. package/src/test/TestUpgrade.t.sol +11 -4
  73. package/src/test/TestVersion.t.sol +0 -7
  74. package/src/version/IncoLightningConfig.sol +4 -3
  75. package/src/version/SessionVerifierConfig.sol +8 -0
  76. package/src/version/Version.sol +7 -9
  77. package/src/version/interfaces/IVersion.sol +8 -0
  78. package/src/DeployTEE.sol +0 -153
  79. package/src/IncoLightning.gen.sol +0 -15
  80. package/src/lightning-parts/AccessControl/BaseAccessControlList.gen.sol +0 -19
  81. package/src/lightning-parts/DecryptionHandler.gen.sol +0 -54
  82. package/src/lightning-parts/DecryptionHandler.sol +0 -307
  83. package/src/lightning-parts/DecryptionHandler.types.sol +0 -34
  84. package/src/lightning-parts/EncryptedInput.gen.sol +0 -16
  85. package/src/lightning-parts/EncryptedOperations.gen.sol +0 -59
  86. package/src/lightning-parts/TEELifecycle.gen.sol +0 -58
  87. package/src/lightning-parts/TrivialEncryption.gen.sol +0 -15
  88. package/src/lightning-parts/primitives/HandleGeneration.gen.sol +0 -19
  89. package/src/lightning-parts/primitives/HandleMetadata.gen.sol +0 -4
  90. package/src/lightning-parts/primitives/SignatureVerifier.gen.sol +0 -16
  91. package/src/test/FibonacciDecrypt.sol +0 -49
  92. package/src/test/TEELifecycle/TEELifecycleHWTest.t.sol +0 -119
  93. package/src/test/TEELifecycle/addnode_data/eoa.txt +0 -1
  94. package/src/test/TEELifecycle/addnode_data/quote.bin +0 -0
  95. package/src/test/TEELifecycle/bootstrap_data/ecies_pubkey.bin +0 -1
  96. package/src/test/TEELifecycle/bootstrap_data/eip712_signature.bin +0 -1
  97. package/src/test/TEELifecycle/bootstrap_data/eoa.txt +0 -1
  98. package/src/test/TEELifecycle/bootstrap_data/qe_identity +0 -1
  99. package/src/test/TEELifecycle/bootstrap_data/qe_identity_signature.bin +0 -1
  100. package/src/test/TEELifecycle/bootstrap_data/quote.bin +0 -0
  101. package/src/test/TEELifecycle/bootstrap_data/tcb_info +0 -1
  102. package/src/test/TEELifecycle/bootstrap_data/tcb_info_signature.bin +0 -1
  103. package/src/test/TEELifecycle/test_cert/AttestationReportSigningCA.crl +0 -0
  104. package/src/test/TEELifecycle/test_cert/Intel_SGX_Attestation_RootCA.cer +0 -0
  105. package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_CRL.crl +0 -0
  106. package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_PlatformCA.cer +0 -0
  107. package/src/test/TEELifecycle/test_cert/Intel_SGX_TCB_Signing.cer +0 -0
  108. package/src/version/Version.gen.sol +0 -14
@@ -2,13 +2,14 @@
2
2
  pragma solidity ^0.8;
3
3
 
4
4
  import {IncoTest} from "./IncoTest.sol";
5
- import {e, euint256, ebool, eaddress} from "../Lib.sol";
5
+ import {e, euint256, ebool, eaddress, inco} from "../Lib.sol";
6
6
  import {SenderNotAllowedForHandle} from "../Types.sol";
7
7
  import {TEELifecycle} from "../lightning-parts/TEELifecycle.sol";
8
8
  import {MockRemoteAttestation} from "./FakeIncoInfra/MockRemoteAttestation.sol";
9
-
10
- import {MINIMUM_QUOTE_LENGTH} from "@automata-network/dcap-attestation/types/Constants.sol";
11
- import {TD10ReportBody} from "@automata-network/dcap-attestation/types/V4Structs.sol";
9
+ import {
10
+ TD10ReportBody,
11
+ MINIMUM_QUOTE_LENGTH
12
+ } from "../interfaces/automata-interfaces/Types.sol";
12
13
 
13
14
  contract TakesEInput {
14
15
  using e for bytes;
@@ -26,18 +27,6 @@ contract TakesEInput {
26
27
  function setB(bytes memory boolEInput) external {
27
28
  b = boolEInput.newEbool(msg.sender);
28
29
  }
29
-
30
- function decryptA() external {
31
- a.requestDecryption(this.aDecryptionCallback.selector, "");
32
- }
33
-
34
- function aDecryptionCallback(
35
- uint256,
36
- uint256 _decryptedA,
37
- bytes memory
38
- ) external {
39
- decryptedA = _decryptedA;
40
- }
41
30
  }
42
31
 
43
32
  // its meta: this is testing correct behavior of our testing infrastructure
@@ -288,14 +277,6 @@ contract TestFakeInfra is IncoTest, MockRemoteAttestation {
288
277
  assertEq(getBoolValue(inputContract.b()), true);
289
278
  }
290
279
 
291
- function testDecryption() public {
292
- TakesEInput inputContract = new TakesEInput();
293
- inputContract.setA(fakePrepareEuint256Ciphertext(37));
294
- inputContract.decryptA();
295
- processAllOperations();
296
- assertEq(inputContract.decryptedA(), 37);
297
- }
298
-
299
280
  function testUninitializedHandleIsDisallowed() public {
300
281
  bytes32 randomHandle = keccak256("random handle");
301
282
  euint256 a = e.asEuint256(12);
@@ -310,12 +291,14 @@ contract TestFakeInfra is IncoTest, MockRemoteAttestation {
310
291
  }
311
292
 
312
293
  function testCreateQuote() public {
313
- bytes memory mrtd = hex"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
294
+ bytes
295
+ memory mrtd = hex"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
314
296
  address signer = address(0x1234567890123456789012345678901234567890);
315
297
  bytes memory quote = createQuote(mrtd, signer);
316
- TEELifecycle lifecycle = new TEELifecycle();
298
+ TEELifecycle lifecycle = TEELifecycle(address(inco.incoVerifier()));
317
299
  TD10ReportBody memory tdReport = lifecycle.parseTD10ReportBody(quote);
318
- (address reportDataSigner, bytes memory reportMrtd) = lifecycle.parseReport(tdReport);
300
+ (address reportDataSigner, bytes memory reportMrtd) = lifecycle
301
+ .parseReport(tdReport);
319
302
  assertEq(reportDataSigner, signer);
320
303
  assertEq(keccak256(reportMrtd), keccak256(mrtd));
321
304
  assertEq(quote.length, MINIMUM_QUOTE_LENGTH);
@@ -9,6 +9,9 @@ import {IOwnerManager} from "safe-smart-account/interfaces/IOwnerManager.sol";
9
9
  import {IncoTest} from "./IncoTest.sol";
10
10
  import {inco} from "../Lib.sol";
11
11
  import {IncoLightning} from "../IncoLightning.sol";
12
+ import {IVersion} from "../version/interfaces/IVersion.sol";
13
+ import {Version} from "../version/Version.sol";
14
+ import {IIncoVerifier} from "../interfaces/IIncoVerifier.sol";
12
15
  import {
13
16
  MAJOR_VERSION,
14
17
  MINOR_VERSION,
@@ -27,9 +30,15 @@ contract IncoLightningV2 is IncoLightning {
27
30
  uint8 constant MINOR_VERSION_MOCK = 255;
28
31
  uint8 constant PATCH_VERSION_MOCK = 255;
29
32
 
30
- constructor(bytes32 salt) IncoLightning(salt) {}
33
+ constructor(bytes32 salt) IncoLightning(salt, IIncoVerifier(address(0))) {}
31
34
 
32
- function getVersion() public view virtual override returns (string memory) {
35
+ function getVersion()
36
+ public
37
+ view
38
+ virtual
39
+ override(IVersion, Version)
40
+ returns (string memory)
41
+ {
33
42
  return
34
43
  versionString(
35
44
  MAJOR_VERSION_MOCK,
@@ -86,8 +95,6 @@ contract TestUpgrade is IncoTest {
86
95
  bytes32 salt = getSalt(
87
96
  "IncoLightningV2",
88
97
  255,
89
- 255,
90
- 255,
91
98
  testDeployer,
92
99
  "testnet"
93
100
  );
@@ -26,11 +26,4 @@ contract TestVersion is Test {
26
26
  "SomeContract_1_2_3__12345678"
27
27
  );
28
28
  }
29
-
30
- function testVersionEip712() public view {
31
- (, string memory name, string memory version, , , , ) = someContract
32
- .eip712Domain();
33
- assertEq(name, "SomeContract");
34
- assertEq(version, "1_2_3");
35
- }
36
29
  }
@@ -4,10 +4,11 @@ pragma solidity ^0.8;
4
4
  // Change these constants for new contracts
5
5
  // Since this file only contains these constants, it could be generated reacting to cli inputs
6
6
 
7
- // IMPORTANT if you are changing this file, run `make update_config` afterwards for it to take effect
8
7
  // UPDATE the CHANGELOG on new versions
9
8
 
10
9
  string constant CONTRACT_NAME = "incoLightning";
11
10
  uint8 constant MAJOR_VERSION = 0;
12
- uint8 constant MINOR_VERSION = 2;
13
- uint8 constant PATCH_VERSION = 1;
11
+ uint8 constant MINOR_VERSION = 3;
12
+ uint8 constant PATCH_VERSION = 0;
13
+
14
+ string constant VERIFIER_NAME = "incoVerifier";
@@ -0,0 +1,8 @@
1
+ // SPDX-License-Identifier: No License
2
+ pragma solidity ^0.8;
3
+
4
+ string constant SESSION_VERIFIER_NAME = "sessionVerifier";
5
+ uint8 constant SESSION_VERIFIER_MAJOR_VERSION = 0;
6
+ uint8 constant SESSION_VERIFIER_MINOR_VERSION = 1;
7
+ uint8 constant SESSION_VERIFIER_PATCH_VERSION = 2;
8
+ bytes32 constant SESSION_VERIFIER_PEPPER = keccak256("");
@@ -2,10 +2,13 @@
2
2
  pragma solidity ^0.8;
3
3
 
4
4
  import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
5
- import {EIP712} from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
6
- import {ShortStrings, ShortString} from "@openzeppelin/contracts/utils/ShortStrings.sol";
5
+ import {
6
+ ShortStrings,
7
+ ShortString
8
+ } from "@openzeppelin/contracts/utils/ShortStrings.sol";
9
+ import {IVersion} from "./interfaces/IVersion.sol";
7
10
 
8
- contract Version is EIP712 {
11
+ contract Version is IVersion {
9
12
  using ShortStrings for ShortString;
10
13
  using ShortStrings for string;
11
14
 
@@ -21,12 +24,7 @@ contract Version is EIP712 {
21
24
  uint8 _patchVersion,
22
25
  bytes32 _salt,
23
26
  string memory _name
24
- )
25
- EIP712(
26
- _name,
27
- versionString(_majorVersion, _minorVersion, _patchVersion)
28
- )
29
- {
27
+ ) {
30
28
  majorVersion = _majorVersion;
31
29
  minorVersion = _minorVersion;
32
30
  patchVersion = _patchVersion;
@@ -0,0 +1,8 @@
1
+ /// SPDX-License-Identifier: No License
2
+ pragma solidity ^0.8;
3
+
4
+ interface IVersion {
5
+ function getVersionedName() external view returns (string memory);
6
+ function getVersion() external view returns (string memory);
7
+ function getName() external view returns (string memory);
8
+ }
package/src/DeployTEE.sol DELETED
@@ -1,153 +0,0 @@
1
- // SPDX-License-Identifier: No License
2
- pragma solidity ^0.8;
3
-
4
- import {Script} from "forge-std/Script.sol";
5
- import {Vm} from "forge-std/Vm.sol";
6
- import {console} from "forge-std/console.sol";
7
-
8
- import {IQuoteVerifier} from "automata-dcap-attestation/interfaces/IQuoteVerifier.sol";
9
- import {TEELifecycle} from "./lightning-parts/TEELifecycle.sol";
10
-
11
- import {CA} from "@automata-network/on-chain-pccs/Common.sol";
12
- import {EnclaveIdentityJsonObj, IdentityObj, EnclaveIdentityHelper} from "@automata-network/on-chain-pccs/helpers/EnclaveIdentityHelper.sol";
13
- import {TcbInfoJsonObj, FmspcTcbHelper} from "@automata-network/on-chain-pccs/helpers/FmspcTcbHelper.sol";
14
- import {PCKHelper} from "@automata-network/on-chain-pccs/helpers/PCKHelper.sol";
15
- import {X509CRLHelper} from "@automata-network/on-chain-pccs/helpers/X509CRLHelper.sol";
16
- import {AutomataFmspcTcbDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataFmspcTcbDao.sol";
17
- import {AutomataEnclaveIdentityDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataEnclaveIdentityDao.sol";
18
- import {AutomataPcsDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataPcsDao.sol";
19
- import {AutomataPckDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataPckDao.sol";
20
- import {AutomataDaoStorage} from "@automata-network/on-chain-pccs/automata_pccs/shared/AutomataDaoStorage.sol";
21
- import {PCCSRouter} from "@automata-network/dcap-attestation/PCCSRouter.sol";
22
- import {V4QuoteVerifier} from "@automata-network/dcap-attestation/verifiers/V4QuoteVerifier.sol";
23
-
24
- // For now we don't use deployments for TEELifecycle, as we do for IncoLightning.
25
- // @todo: Use deployments for TEELifecycle
26
- // ref: https://github.com/Inco-fhevm/inco-monorepo/issues/875
27
- string constant EIP712_NAME = "TEELifecycle";
28
- string constant EIP712_VERSION = "1.0.0";
29
-
30
- // DeployTEE is a script that deplots all TEE-related supporting contracts for IncoLightning.
31
- contract DeployTEE is Script {
32
-
33
- // The default address of the P256 Verifier contract that is used to verify the P256 signatures.
34
- // It is deployed with this address on Ethereum L1, OP Mainnet, Base, Arbitrum.
35
- // @dev From: https://github.com/daimo-eth/p256-verifier?tab=readme-ov-file#usage
36
- address public P256_VERIFIER = 0xc2b78104907F722DABAc4C69f826a522B2754De4;
37
-
38
- // The PCCSRouter contract is used as the entrypoint for the management of collateral used to verify quotes.
39
- // It is used by the QuoteVerifier to fetch collateral.
40
- PCCSRouter public pccsRouter;
41
-
42
- // These helpers are used to parse the collateral files and upload them to the PCCSRouter.
43
- AutomataFmspcTcbDao fmspcTcbDao;
44
- AutomataEnclaveIdentityDao enclaveIdDao;
45
-
46
- // This function deploys a TEELifecycle contract that is used to manage the TEE lifecycle for the IncoLightning contract.
47
- // @dev The TEELifecycle contract is used to manage the TEE lifecycle for the IncoLightning contract.
48
- // It is used to verify quotes, and to manage the TEE lifecycle.
49
- // It is also used to manage the EOA signers for the IncoLightning contract.
50
- // @param quoteVerifierAddress The address of the QuoteVerifier contract to be used by the TEELifecycle contract.
51
- function deployTEELifecycle(address deployer, address quoteVerifierAddress) internal returns (TEELifecycle) {
52
- // TODO: Currently TEELifecycle is not UUPS
53
- // ref: https://github.com/Inco-fhevm/inco-monorepo/issues/875
54
- TEELifecycle implementation = new TEELifecycle();
55
- implementation.initialize(
56
- deployer,
57
- EIP712_NAME,
58
- EIP712_VERSION,
59
- quoteVerifierAddress
60
- );
61
- return implementation;
62
- }
63
-
64
- // This function deploys a QuoteVerifier contract that is used to verify quotes for the IncoLightning contract.
65
- // @dev: TDX_HW environment variable is used to determine whether to use the FakeQuoteVerifier or the V4QuoteVerifier.
66
- // @dev We deploy two flavors of the QuoteVerifier contract:
67
- // - FakeQuoteVerifier: A fake implementation of the QuoteVerifier contract that is used to test the IncoLightning contract.
68
- // This is used for testing purposes, and returns true for all quote verifications.
69
- // - V4QuoteVerifier: The real implementation of the QuoteVerifier contract that is used to verify quotes for the IncoLightning contract.
70
- // This is taken from the automata-dcap-attestation package.
71
- function deployQuoteVerifier() internal returns (IQuoteVerifier quoteVerifier) {
72
- // deploys the QuoteVerifier contract
73
- quoteVerifier = new V4QuoteVerifier(
74
- P256_VERIFIER,
75
- address(pccsRouter)
76
- );
77
-
78
- pccsRouter.setAuthorized(address(quoteVerifier), true);
79
- }
80
-
81
- function deployPCCS(address owner, string memory collateralDir) internal {
82
-
83
- EnclaveIdentityHelper enclaveIdHelper = new EnclaveIdentityHelper();
84
- FmspcTcbHelper tcbHelper = new FmspcTcbHelper();
85
- PCKHelper x509 = new PCKHelper();
86
- X509CRLHelper x509Crl = new X509CRLHelper();
87
-
88
- AutomataDaoStorage pccsStorage = new AutomataDaoStorage(owner);
89
- AutomataPcsDao pcsDao = new AutomataPcsDao(address(pccsStorage), P256_VERIFIER, address(x509), address(x509Crl));
90
- AutomataPckDao pckDao = new AutomataPckDao(address(pccsStorage), P256_VERIFIER, address(pcsDao), address(x509), address(x509Crl));
91
- enclaveIdDao = new AutomataEnclaveIdentityDao(
92
- address(pccsStorage), P256_VERIFIER, address(pcsDao), address(enclaveIdHelper), address(x509), address(x509Crl)
93
- );
94
- fmspcTcbDao = new AutomataFmspcTcbDao(address(pccsStorage), P256_VERIFIER, address(pcsDao), address(tcbHelper), address(x509), address(x509Crl));
95
- // grants dao permissions to write to the storage
96
- pccsStorage.grantDao(address(pcsDao));
97
- pccsStorage.grantDao(address(pckDao));
98
- pccsStorage.grantDao(address(fmspcTcbDao));
99
- pccsStorage.grantDao(address(enclaveIdDao));
100
-
101
- // grants admin address permission to read collaterals
102
- pccsRouter = new PCCSRouter(
103
- owner,
104
- address(enclaveIdDao),
105
- address(fmspcTcbDao),
106
- address(pcsDao),
107
- address(pckDao),
108
- address(x509),
109
- address(x509Crl),
110
- address(tcbHelper)
111
- );
112
- // allow PCCS Router to read collaterals from the storage
113
- pccsStorage.setCallerAuthorization(address(pccsRouter), true);
114
-
115
- // Upload Root Certs/CRLs
116
- bytes memory rootCaDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_Attestation_RootCA.cer"));
117
- pcsDao.upsertPcsCertificates(CA.ROOT, rootCaDer);
118
- bytes memory tcbDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_TCB_Signing.cer"));
119
- pcsDao.upsertPcsCertificates(CA.SIGNING, tcbDer);
120
- bytes memory platformDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_PCK_PlatformCA.cer"));
121
- pcsDao.upsertPcsCertificates(CA.PLATFORM, platformDer);
122
- bytes memory platformCrlDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_PCK_CRL.crl"));
123
- pcsDao.upsertPckCrl(CA.PLATFORM, platformCrlDer);
124
- bytes memory rootCrlDer = vm.readFileBinary(string.concat(collateralDir, "AttestationReportSigningCA.crl"));
125
-
126
- pcsDao.upsertRootCACrl(rootCrlDer);
127
- }
128
-
129
- // This function deploys the P256 Verifier contract that is used to verify P256 signatures.
130
- // @dev The code is taken from https://github.com/automata-network/automata-on-chain-pccs/blob/v1.0.0/test/TestSetupBase.t.sol#L91
131
- function deployP256() internal {
132
- // Known chains that have the P256 Verifier deployed:
133
- // Ethereum Mainnet, Optimism Mainnet, Base, Arbitrum
134
- // https://github.com/daimo-eth/p256-verifier/tree/master/broadcast/Deploy.s.sol
135
- if (block.chainid == 1 || block.chainid == 10 || block.chainid == 8453 || block.chainid == 84531 ) {
136
- console.log("P256 Verifier contract is already deployed on this chain, skipping deployment.");
137
- return;
138
- }
139
- require(block.chainid == 31337, "Deploying P256 Verifier is only supported on Anvil chain");
140
- bytes memory txdata =
141
- hex"00000000000000000000000000000000000000000000000000000000000000006080806040523461001657610dd1908161001c8239f35b600080fdfe60e06040523461001a57610012366100c7565b602081519101f35b600080fd5b6040810190811067ffffffffffffffff82111761003b57604052565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b60e0810190811067ffffffffffffffff82111761003b57604052565b90601f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0910116810190811067ffffffffffffffff82111761003b57604052565b60a08103610193578060201161001a57600060409180831161018f578060601161018f578060801161018f5760a01161018c57815182810181811067ffffffffffffffff82111761015f579061013291845260603581526080356020820152833560203584356101ab565b15610156575060ff6001915b5191166020820152602081526101538161001f565b90565b60ff909161013e565b6024837f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b80fd5b5080fd5b5060405160006020820152602081526101538161001f565b909283158015610393575b801561038b575b8015610361575b6103585780519060206101dc818301938451906103bd565b1561034d57604051948186019082825282604088015282606088015260808701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f60a08701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551958660c082015260c081526102588161006a565b600080928192519060055afa903d15610345573d9167ffffffffffffffff831161031857604051926102b1857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190516102e693929185908181890994099151906104eb565b061490565b807f4e487b7100000000000000000000000000000000000000000000000000000000602492526001600452fd5b6024827f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b6060916102ba565b505050505050600090565b50505050600090565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518310156101c4565b5082156101bd565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518410156101b6565b7fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818110801590610466575b8015610455575b61044d577f5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b8282818080957fffffffff00000001000000000000000000000000fffffffffffffffffffffffc0991818180090908089180091490565b505050600090565b50801580156103f1575082156103f1565b50818310156103ea565b7f800000000000000000000000000000000000000000000000000000000000000081146104bc577fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0190565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b909192608052600091600160a05260a05193600092811580610718575b61034d57610516838261073d565b95909460ff60c05260005b600060c05112156106ef575b60a05181036106a1575050507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2969594939291965b600060c05112156105c7575050505050507fffffffff00000001000000000000000000000000ffffffffffffffffffffffff91506105c260a051610ca2565b900990565b956105d9929394959660a05191610a98565b9097929181928960a0528192819a6105f66080518960c051610722565b61060160c051610470565b60c0528061061b5750505050505b96959493929196610583565b969b5061067b96939550919350916001810361068857507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5937f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29693610952565b979297919060a05261060f565b6002036106985786938a93610952565b88938893610952565b600281036106ba57505050829581959493929196610583565b9197917ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0161060f575095508495849661060f565b506106ff6080518560c051610722565b8061070b60c051610470565b60c052156105215761052d565b5060805115610508565b91906002600192841c831b16921c1681018091116104bc5790565b8015806107ab575b6107635761075f91610756916107b3565b92919091610c42565b9091565b50507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296907f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f590565b508115610745565b919082158061094a575b1561080f57507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29691507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5906001908190565b7fb01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff808481600186090894817f94e82e0c1ed3bdb90743191a9c5bbf0d88fc827fd214cc5f0b5ec6ba27673d6981600184090893841561091b575050808084800993840994818460010994828088600109957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908935b93929190565b9350935050921560001461093b5761093291610b6d565b91939092610915565b50506000806000926000610915565b5080156107bd565b91949592939095811580610a90575b15610991575050831580610989575b61097a5793929190565b50600093508392508291508190565b508215610970565b85919294951580610a88575b610a78577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff968703918783116104bc5787838189850908938689038981116104bc5789908184840908928315610a5d575050818880959493928180848196099b8c9485099b8c920999099609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908929190565b965096505050509093501560001461093b5761093291610b6d565b9550509150915091906001908190565b50851561099d565b508015610961565b939092821580610b65575b61097a577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff908185600209948280878009809709948380888a0998818080808680097fffffffff00000001000000000000000000000000fffffffffffffffffffffffc099280096003090884808a7fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818380090898898603918683116104bc57888703908782116104bc578780969481809681950994089009089609930990565b508015610aa3565b919091801580610c3a575b610c2d577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818460020991808084800980940991817fffffffff00000001000000000000000000000000fffffffffffffffffffffffc81808088860994800960030908958280837fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818980090896878403918483116104bc57858503928584116104bc5785809492819309940890090892565b5060009150819081908190565b508215610b78565b909392821580610c9a575b610c8d57610c5a90610ca2565b9182917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff80809581940980099009930990565b5050509050600090600090565b508015610c4d565b604051906020918281019183835283604083015283606083015260808201527fffffffff00000001000000000000000000000000fffffffffffffffffffffffd60a08201527fffffffff00000001000000000000000000000000ffffffffffffffffffffffff60c082015260c08152610d1a8161006a565b600080928192519060055afa903d15610d93573d9167ffffffffffffffff83116103185760405192610d73857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190565b606091610d7c56fea2646970667358221220fa55558b04ced380e93d0a46be01bb895ff30f015c50c516e898c341cd0a230264736f6c63430008150033";
142
-
143
- // deploys the P256 Verifier contract using the default CREATE2 deterministic deployment contract available of EVM chains including on Anvil
144
- // https://github.com/Arachnid/deterministic-deployment-proxy?tab=readme-ov-file#latest-outputs
145
- // https://getfoundry.sh/guides/deterministic-deployments-using-create2
146
- (bool succ,) = address(0x4e59b44847b379578588920cA78FbF26c0B4956C).call(txdata);
147
- require(succ, "Failed to deploy P256");
148
-
149
- // check code
150
- uint256 codesize = P256_VERIFIER.code.length;
151
- require(codesize > 0, "P256 deployed to the wrong address");
152
- }
153
- }
@@ -1,15 +0,0 @@
1
- /// SPDX-License-Identifier: No License
2
- pragma solidity ^0.8;
3
-
4
- import { IIncoLightning } from "./IIncoLightning.sol";
5
- import { CONTRACT_NAME, MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION } from "./version/IncoLightningConfig.sol";
6
- import { DecryptionHandler } from "./lightning-parts/DecryptionHandler.sol";
7
- import { EncryptedInput } from "./lightning-parts/EncryptedInput.sol";
8
- import { EncryptedOperations } from "./lightning-parts/EncryptedOperations.sol";
9
- import { TrivialEncryption } from "./lightning-parts/TrivialEncryption.sol";
10
- import { UUPSUpgradeable } from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
11
- import { Version } from "./version/Version.sol";
12
-
13
- interface IIncoLightningGen {
14
- function initialize(address owner, address teeLifecycleAddress) external;
15
- }
@@ -1,19 +0,0 @@
1
- /// SPDX-License-Identifier: No License
2
- pragma solidity ^0.8;
3
-
4
- import { SenderNotAllowedForHandle } from "../../Types.sol";
5
-
6
- interface IBaseAccessControlListGen {
7
- /// @dev persistent
8
- function allow(bytes32 handle, address account) external;
9
-
10
- function allowTransient(bytes32 handle, address account) external;
11
-
12
- function allowedTransient(bytes32 handle, address account) external view returns (bool);
13
-
14
- function cleanTransientStorage() external;
15
-
16
- function persistAllowed(bytes32 handle, address account) external view returns (bool);
17
-
18
- function isAllowed(bytes32 handle, address account) external view returns (bool);
19
- }
@@ -1,54 +0,0 @@
1
- /// SPDX-License-Identifier: No License
2
- pragma solidity ^0.8;
3
-
4
- import "./DecryptionHandler.types.sol";
5
- import { BaseAccessControlList } from "./AccessControl/BaseAccessControlList.sol";
6
- import { EIP712 } from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
7
- import { EventCounter } from "./primitives/EventCounter.sol";
8
- import { IDecryptionHandlerEip712CheckerGen } from "./DecryptionHandler.gen.sol";
9
- import { SenderNotAllowedForHandle } from "../Types.sol";
10
- import { SignatureVerifier } from "./primitives/SignatureVerifier.sol";
11
-
12
- interface IDecryptionHandlerEip712CheckerGen {
13
- function decryptionResultDigest(DecryptionResult memory result) external view returns (bytes32);
14
- }
15
-
16
- interface IDecryptionHandlerGen {
17
- /// @dev callback function MUST be of form `function name(bytes32 requestId, bytes32 result, bytes memory data)`
18
- function requestDecryption(bytes4 callbackSelector, uint256 maxTimestamp, bytes32 handle, bytes memory data) external returns (uint256 requestId);
19
-
20
- function fulfillRequest(DecryptionResult memory result, bytes memory signature) external;
21
-
22
- function fulfillRequestsBatch(SignedDecryptionResult[] memory results) external;
23
-
24
- /// @dev Get some pending requests.
25
- /// @param offset A parameter for paginating through the whole set of pending requests.
26
- /// Use zero for an initial query, then use the previous query's nextOffset to continue traversal.
27
- /// @param maxRequests The maximum number of pending to return.
28
- /// @param iterationBound The maximum number of non-pending requests to iterate over before returning.
29
- /// @return nextOffset The next offset to use to continue to scan through the pending request set.
30
- /// Returns the input offset if the whole set has been scanned. Can re-query with this offset
31
- /// to see any new pending requests, or re-query with a zero offset to return the whole set again.
32
- /// @return requests Some pending requests. May be fewer than requested, possibly zero. There may be
33
- /// more requests available if the returned nextOffset is greater than the input offset.
34
- function getPendingRequests(uint256 offset, uint256 maxRequests, uint256 iterationBound) external view returns (uint256 nextOffset, Request[] memory requests);
35
-
36
- /// @param offset A parameter for paginating through the whole set of pending requests.
37
- /// Use zero for an initial query, then use the previous query's nextOffset to continue traversal.
38
- /// @param maxRequests The maximum number of pending to return.
39
- /// @return nextOffset The next offset to use to continue to scan through the pending request set.
40
- /// Returns the input offset if the whole set has been scanned. Can re-query with this offset
41
- /// to see any new pending requests, or re-query with a zero offset to return the whole set again.
42
- /// @return requests Some pending requests. May be fewer than requested, possibly zero. There may be
43
- /// more requests available if the returned nextOffset is greater than the input offset.
44
- function getPendingRequests(uint256 offset, uint256 maxRequests) external view returns (uint256 nextOffset, Request[] memory requests);
45
-
46
- function getNextRequestId() external view returns (uint256);
47
-
48
- function getLowWatermarkRequestId() external view returns (uint256);
49
-
50
- /// @dev Advance the low watermark until we hit a pending request, the requestId counter, or iterationBound steps.
51
- /// @param iterationBound The maximum number of requests to iterate over.
52
- /// @notice This function is public so that we can externally drive the low watermark in extreme cases.
53
- function advanceLowWatermark(uint256 iterationBound) external;
54
- }