@super-protocol/addons-tee 0.9.10 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (116) hide show
  1. package/bindings/nvidia-native/README.md +174 -0
  2. package/bindings/nvidia-native/package.json +26 -0
  3. package/bindings/nvidia-native/postinstall.js +40 -0
  4. package/dist/index.d.ts +1 -1
  5. package/dist/index.js +1 -28
  6. package/package.json +4 -2
  7. package/.editorconfig +0 -15
  8. package/.eslintrc.json +0 -61
  9. package/.prettierignore +0 -3
  10. package/.prettierrc +0 -15
  11. package/bindings/amd-sev-snp-napi-rs/amd-sev-snp-napi-rs.linux-x64-gnu.node +0 -0
  12. package/bindings/amd-sev-snp-napi-rs/index.d.ts +0 -51
  13. package/bindings/amd-sev-snp-napi-rs/index.js +0 -339
  14. package/bindings/amd-sev-snp-napi-rs/package-lock.json +0 -40
  15. package/bindings/sgx-native/build/Release/libmbedcrypto_gramine.so.15 +0 -0
  16. package/bindings/sgx-native/build/Release/libmbedx509_gramine.so.6 +0 -0
  17. package/bindings/sgx-native/build/Release/libsgx_dcap_quoteverify.so.1 +0 -0
  18. package/bindings/sgx-native/build/Release/libtdx_attest.so.1 +0 -0
  19. package/bindings/sgx-native/build/Release/sgx_native.node +0 -0
  20. package/bindings/sgx-native/package-lock.json +0 -23
  21. package/bindings/sp-sev/.github/auto_assign-issues.yml +0 -5
  22. package/bindings/sp-sev/.github/auto_assign.yml +0 -21
  23. package/bindings/sp-sev/.github/dependabot.yml +0 -6
  24. package/bindings/sp-sev/.github/workflows/dco.yml +0 -10
  25. package/bindings/sp-sev/.github/workflows/lint.yml +0 -56
  26. package/bindings/sp-sev/.github/workflows/test.yml +0 -215
  27. package/bindings/sp-sev/.rustfmt.toml +0 -2
  28. package/bindings/sp-sev/CODEOWNERS +0 -1
  29. package/bindings/sp-sev/Cargo.lock +0 -2461
  30. package/bindings/sp-sev/Cargo.toml +0 -80
  31. package/bindings/sp-sev/LICENSE +0 -201
  32. package/bindings/sp-sev/README.md +0 -82
  33. package/bindings/sp-sev/build.rs +0 -17
  34. package/bindings/sp-sev/docs/attestation/README.md +0 -239
  35. package/bindings/sp-sev/docs/attestation/certchain.dot +0 -14
  36. package/bindings/sp-sev/docs/attestation/certchain.dot.png +0 -0
  37. package/bindings/sp-sev/docs/attestation/prerequisites.md +0 -6
  38. package/bindings/sp-sev/docs/attestation/process.msc +0 -60
  39. package/bindings/sp-sev/docs/attestation/process.msc.png +0 -0
  40. package/bindings/sp-sev/docs/attestation/protections.md +0 -53
  41. package/bindings/sp-sev/package-version.py +0 -11
  42. package/bindings/sp-sev/tests/api.rs +0 -194
  43. package/bindings/sp-sev/tests/certs.rs +0 -142
  44. package/bindings/sp-sev/tests/certs_data/cert_chain_milan +0 -74
  45. package/bindings/sp-sev/tests/certs_data/cert_chain_turin +0 -74
  46. package/bindings/sp-sev/tests/certs_data/report_milan.hex +0 -1
  47. package/bindings/sp-sev/tests/certs_data/vcek_milan.der +0 -0
  48. package/bindings/sp-sev/tests/certs_data/vcek_turin.der +0 -0
  49. package/bindings/sp-sev/tests/guest.rs +0 -57
  50. package/bindings/sp-sev/tests/id-block.rs +0 -172
  51. package/bindings/sp-sev/tests/measurement/ovmf_AmdSev_suffix.bin +0 -0
  52. package/bindings/sp-sev/tests/measurement/ovmf_OvmfX64_suffix.bin +0 -0
  53. package/bindings/sp-sev/tests/measurement/test_auth_block.bin +0 -0
  54. package/bindings/sp-sev/tests/measurement/test_auth_key.pem +0 -6
  55. package/bindings/sp-sev/tests/measurement/test_auth_sig.bin +0 -0
  56. package/bindings/sp-sev/tests/measurement/test_id_key.pem +0 -6
  57. package/bindings/sp-sev/tests/measurement/test_id_sig.bin +0 -0
  58. package/bindings/sp-sev/tests/measurement.rs +0 -510
  59. package/bindings/sp-sev/tests/naples/ark.cert.bad +0 -0
  60. package/bindings/sp-sev/tests/naples/ark.cert.sig +0 -0
  61. package/bindings/sp-sev/tests/naples/ark.rs +0 -38
  62. package/bindings/sp-sev/tests/naples/ask.rs +0 -29
  63. package/bindings/sp-sev/tests/naples/cek.cert +0 -0
  64. package/bindings/sp-sev/tests/naples/cek.rs +0 -30
  65. package/bindings/sp-sev/tests/naples/mod.rs +0 -20
  66. package/bindings/sp-sev/tests/naples/oca.cert +0 -0
  67. package/bindings/sp-sev/tests/naples/oca.rs +0 -45
  68. package/bindings/sp-sev/tests/naples/pdh.cert +0 -0
  69. package/bindings/sp-sev/tests/naples/pdh.rs +0 -28
  70. package/bindings/sp-sev/tests/naples/pek.cert +0 -0
  71. package/bindings/sp-sev/tests/naples/pek.rs +0 -32
  72. package/bindings/sp-sev/tests/rome/ark.rs +0 -33
  73. package/bindings/sp-sev/tests/rome/ask.rs +0 -29
  74. package/bindings/sp-sev/tests/rome/cek.cert +0 -0
  75. package/bindings/sp-sev/tests/rome/cek.rs +0 -29
  76. package/bindings/sp-sev/tests/rome/mod.rs +0 -16
  77. package/bindings/sp-sev/tests/rome/oca.cert +0 -0
  78. package/bindings/sp-sev/tests/rome/oca.rs +0 -45
  79. package/bindings/sp-sev/tests/rome/pdh.cert +0 -0
  80. package/bindings/sp-sev/tests/rome/pdh.rs +0 -28
  81. package/bindings/sp-sev/tests/rome/pek.cert +0 -0
  82. package/bindings/sp-sev/tests/rome/pek.rs +0 -32
  83. package/bindings/sp-sev/tests/session.rs +0 -39
  84. package/bindings/sp-sev/tests/sev_launch.rs +0 -120
  85. package/bindings/sp-sev/tests/snp_launch.rs +0 -108
  86. package/bindings/utils/virtee/LICENSE +0 -201
  87. package/bindings/utils/virtee/libsev.so +0 -0
  88. package/bindings/utils/virtee/snpguest +0 -0
  89. package/dist/proto/AmdSevSnp.d.ts +0 -194
  90. package/dist/proto/AmdSevSnp.js +0 -363
  91. package/dist/sgx-native-module/consts.d.ts +0 -24
  92. package/dist/sgx-native-module/consts.js +0 -38
  93. package/dist/sgx-native-module/dcap-quote-verify.service.d.ts +0 -12
  94. package/dist/sgx-native-module/dcap-quote-verify.service.js +0 -84
  95. package/dist/sgx-native-module/enclave.service.d.ts +0 -93
  96. package/dist/sgx-native-module/enclave.service.js +0 -211
  97. package/dist/sgx-native-module/errors.d.ts +0 -19
  98. package/dist/sgx-native-module/errors.js +0 -69
  99. package/dist/sgx-native-module/helpers.d.ts +0 -1
  100. package/dist/sgx-native-module/helpers.js +0 -50
  101. package/dist/sgx-native-module/index.d.ts +0 -9
  102. package/dist/sgx-native-module/index.js +0 -26
  103. package/dist/sgx-native-module/pki.service.d.ts +0 -52
  104. package/dist/sgx-native-module/pki.service.js +0 -89
  105. package/dist/sgx-native-module/sev-snp-mrenclave.d.ts +0 -59
  106. package/dist/sgx-native-module/sev-snp-mrenclave.js +0 -323
  107. package/dist/sgx-native-module/sev-snp-schema.d.ts +0 -22
  108. package/dist/sgx-native-module/sev-snp-schema.js +0 -24
  109. package/dist/sgx-native-module/sev-snp.d.ts +0 -126
  110. package/dist/sgx-native-module/sev-snp.js +0 -491
  111. package/dto/src/AmdSevSnp.proto +0 -31
  112. package/dto/src/Compression.proto +0 -11
  113. package/dto/src/Hash.proto +0 -6
  114. package/dto/src/OrderReport.proto +0 -21
  115. package/dto/src/TRI.proto +0 -22
  116. package/dto/src/TeeDeviceInfo.proto +0 -46
@@ -1,491 +0,0 @@
1
- "use strict";
2
- var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3
- if (k2 === undefined) k2 = k;
4
- var desc = Object.getOwnPropertyDescriptor(m, k);
5
- if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
6
- desc = { enumerable: true, get: function() { return m[k]; } };
7
- }
8
- Object.defineProperty(o, k2, desc);
9
- }) : (function(o, m, k, k2) {
10
- if (k2 === undefined) k2 = k;
11
- o[k2] = m[k];
12
- }));
13
- var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
14
- Object.defineProperty(o, "default", { enumerable: true, value: v });
15
- }) : function(o, v) {
16
- o["default"] = v;
17
- });
18
- var __importStar = (this && this.__importStar) || function (mod) {
19
- if (mod && mod.__esModule) return mod;
20
- var result = {};
21
- if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
22
- __setModuleDefault(result, mod);
23
- return result;
24
- };
25
- var __importDefault = (this && this.__importDefault) || function (mod) {
26
- return (mod && mod.__esModule) ? mod : { "default": mod };
27
- };
28
- Object.defineProperty(exports, "__esModule", { value: true });
29
- exports.SevSNP = exports.getDefaultArkHashes = exports.EMPTY_INITRD_SHA256_HASH = exports.AMD_EPYC_MILAN_CPUINFO = void 0;
30
- const amd_sev_snp_napi_rs_1 = require("../../bindings/amd-sev-snp-napi-rs/");
31
- const sdk_js_1 = require("@super-protocol/sdk-js");
32
- const axios_1 = __importDefault(require("axios"));
33
- const forge = __importStar(require("node-forge"));
34
- const fs = __importStar(require("fs/promises"));
35
- const path = __importStar(require("path"));
36
- const os = __importStar(require("os"));
37
- const child_process_1 = require("child_process");
38
- const crypto_1 = require("crypto");
39
- const helpers_1 = require("./helpers");
40
- const AmdSevSnp_1 = require("../proto/AmdSevSnp");
41
- const sev_snp_schema_1 = require("./sev-snp-schema");
42
- const value_1 = require("@sinclair/typebox/value");
43
- exports.AMD_EPYC_MILAN_CPUINFO = {
44
- family: 25,
45
- model: 1,
46
- stepping: 1,
47
- };
48
- exports.EMPTY_INITRD_SHA256_HASH = Buffer.from("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "hex");
49
- function getDefaultArkHashes() {
50
- const ark_hashes = {};
51
- ark_hashes["ARK-Milan"] = SevSNP.getCertHash({
52
- format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
53
- cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_MILAN_PEM),
54
- });
55
- ark_hashes["ARK-Genoa"] = SevSNP.getCertHash({
56
- format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
57
- cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_GENOA_PEM),
58
- });
59
- ark_hashes["ARK-Turin"] = SevSNP.getCertHash({
60
- format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
61
- cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_TURIN_PEM),
62
- });
63
- return ark_hashes;
64
- }
65
- exports.getDefaultArkHashes = getDefaultArkHashes;
66
- class SevSNP {
67
- static serializeSNPReport(report) {
68
- return Buffer.from(AmdSevSnp_1.SNPReportWithChain.encode(report).finish());
69
- }
70
- static deserializeSNPReport(serialized) {
71
- return AmdSevSnp_1.SNPReportWithChain.decode(serialized);
72
- }
73
- static convertCertToPem(cert) {
74
- const pemHeader = "-----BEGIN CERTIFICATE-----\n";
75
- const pemFooter = "\n-----END CERTIFICATE-----";
76
- if (cert.slice(0, pemHeader.length).compare(Buffer.from(pemHeader)) === 0) {
77
- return cert.toString();
78
- }
79
- const formattedBase64 = cert
80
- .toString("base64")
81
- .match(/.{1,64}/g)
82
- ?.join("\n");
83
- return pemHeader + formattedBase64 + pemFooter;
84
- }
85
- static convertPemToDer(cert) {
86
- return Buffer.from(forge.pki.pemToDer(cert).getBytes(), "binary");
87
- }
88
- static splitCerts(certsPem) {
89
- const certRegex = /-----BEGIN CERTIFICATE-----(?:\s|.)*?-----END CERTIFICATE-----/g;
90
- const matches = certsPem.match(certRegex);
91
- return Array.from(matches || []);
92
- }
93
- static async readCmdLine() {
94
- const data = await fs.readFile("/proc/cmdline", "utf-8");
95
- // Workaround: VM in direct boot mode sometimes adds to the end of the cmdline initrd=initrd, need to remove it
96
- return data.replace(/initrd=initrd\s*/, "");
97
- }
98
- /**
99
- * Method for generation AMD SEV-SNP Report
100
- * @param userData - The data that will be included in the report and will be signed
101
- * @param vmpl - Optional VMPL value to pass to the firmware when requesting a report (default: 0)
102
- */
103
- static async generateSNPReport(userData, vmpl = 0) {
104
- if (userData.length > amd_sev_snp_napi_rs_1.SNP_REPORT_DATA_SIZE) {
105
- throw new Error(`userData cannot exceed ${amd_sev_snp_napi_rs_1.SNP_REPORT_DATA_SIZE} bytes.`);
106
- }
107
- const paddedUserData = Buffer.alloc(64);
108
- userData.copy(paddedUserData);
109
- const rawReport = (0, amd_sev_snp_napi_rs_1.getSnpReport)(paddedUserData, vmpl);
110
- const cpuInfo = (0, amd_sev_snp_napi_rs_1.getCpuInfo)();
111
- const cpuSig = (0, amd_sev_snp_napi_rs_1.getCpuSig)(cpuInfo);
112
- const cores = (0, amd_sev_snp_napi_rs_1.getLogicalCoresCount)();
113
- const cmdLine = await SevSNP.readCmdLine();
114
- return {
115
- rawReport,
116
- cpuSig,
117
- cores,
118
- cmdLineHash: SevSNP.calculateCmdlineHash(cmdLine),
119
- build: SevSNP.extractBuildFromCmdline(cmdLine),
120
- };
121
- }
122
- /**
123
- * Method for fetch certificates from AMD KDS
124
- * @param report - report generated by the `generateSNPReport` method
125
- * @param options - options for working with HTTP, allows you to configure repetitions and the interval between them,
126
- * as well as the format of the returned certificates
127
- */
128
- static async getReportChain(report, options) {
129
- const retryMax = options?.retryMax ?? 50;
130
- const retryInterval = options?.retryInterval ?? Math.floor(Math.random() * 10000) + 5000;
131
- const certFormat = options?.certFormat ?? AmdSevSnp_1.SevSnpCertificateFormat.DER;
132
- const certs = [];
133
- const axiosInstance = axios_1.default.create();
134
- let vcek = Buffer.alloc(0);
135
- let cpuGeneration = amd_sev_snp_napi_rs_1.WellKnownSnpCodeNames.Milan;
136
- let generations = Object.values(amd_sev_snp_napi_rs_1.WellKnownSnpCodeNames);
137
- // Try to detect CPU generation from the report itself. If detection
138
- // succeeds, only attempt to fetch VCEK for the detected generation.
139
- try {
140
- const cpuInfo = await SevSNP.getReportCpuInfo(Buffer.from(report.rawReport));
141
- const detected = await SevSNP.getCpuGeneration(cpuInfo);
142
- generations = [detected];
143
- }
144
- catch (err) {
145
- // Detection failed or report doesn't contain CPU info; fall back to
146
- // trying all known generations.
147
- }
148
- for (const generation of generations) {
149
- cpuGeneration = generation;
150
- const vcekUrl = (0, amd_sev_snp_napi_rs_1.getVcekKdsUrl)(Buffer.from(report.rawReport), generation);
151
- try {
152
- const response = await sdk_js_1.helpers.tryWithInterval({
153
- checkResult(response) {
154
- return { isResultOk: response.status === 200 };
155
- },
156
- handler() {
157
- return axiosInstance.get(vcekUrl, {
158
- responseType: "arraybuffer",
159
- });
160
- },
161
- checkError(err) {
162
- if (axios_1.default.isAxiosError(err) && err.response) {
163
- const status = err.response.status;
164
- return { retryable: status == 429 };
165
- }
166
- return { retryable: axios_1.default.isAxiosError(err) };
167
- },
168
- retryInterval,
169
- retryMax,
170
- });
171
- vcek = response.data;
172
- break;
173
- }
174
- catch (err) {
175
- const isLast = generation === generations[generations.length - 1];
176
- if (isLast) {
177
- throw err;
178
- }
179
- }
180
- }
181
- const pemVcek = SevSNP.convertCertToPem(vcek);
182
- certs.push({
183
- type: AmdSevSnp_1.SevSNPCertType.VCEK,
184
- format: certFormat,
185
- cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? Buffer.from(pemVcek) : SevSNP.convertPemToDer(pemVcek),
186
- });
187
- const caUrl = `${amd_sev_snp_napi_rs_1.KDS_CERT_SITE}/${amd_sev_snp_napi_rs_1.KDS_VCEK}/${cpuGeneration}/cert_chain`;
188
- const response = await sdk_js_1.helpers.tryWithInterval({
189
- checkResult(response) {
190
- return { isResultOk: response.status === 200 };
191
- },
192
- handler() {
193
- return axiosInstance.get(caUrl, {
194
- responseType: "arraybuffer",
195
- });
196
- },
197
- checkError(err) {
198
- if (axios_1.default.isAxiosError(err) && err.response) {
199
- const status = err.response.status;
200
- return { retryable: status == 429 };
201
- }
202
- return { retryable: axios_1.default.isAxiosError(err) };
203
- },
204
- retryInterval,
205
- retryMax,
206
- });
207
- const CAChain = SevSNP.splitCerts(response.data.toString());
208
- if (CAChain.length !== 2) {
209
- throw new Error("Cert chain must have 2 certificates");
210
- }
211
- certs.push({
212
- type: AmdSevSnp_1.SevSNPCertType.ARK,
213
- format: certFormat,
214
- cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM
215
- ? Buffer.from(CAChain[1])
216
- : SevSNP.convertPemToDer(CAChain[1]),
217
- });
218
- certs.push({
219
- type: AmdSevSnp_1.SevSNPCertType.ASK,
220
- format: certFormat,
221
- cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM
222
- ? Buffer.from(CAChain[0])
223
- : SevSNP.convertPemToDer(CAChain[0]),
224
- });
225
- return certs;
226
- }
227
- /**
228
- * Method for generation AMD SEV-SNP Report and fetching certificates
229
- * @param userData - @see generateSNPReport
230
- * @param options - @see getReportChain
231
- */
232
- static async generateSNPReportWithChain(userData, options) {
233
- const snpReport = await SevSNP.generateSNPReport(userData);
234
- const certs = await SevSNP.getReportChain(snpReport, options);
235
- return {
236
- snpReport,
237
- certs: certs,
238
- };
239
- }
240
- static async runSubProcess(binaryPath, args = [], options = {}) {
241
- return new Promise((resolve, reject) => {
242
- const subprocess = (0, child_process_1.spawn)(binaryPath, args, {
243
- cwd: options.cwd,
244
- stdio: "pipe",
245
- });
246
- let stdout = "";
247
- let stderr = "";
248
- subprocess.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
249
- subprocess.stderr?.on("data", (chunk) => (stderr += chunk.toString()));
250
- let timeoutId;
251
- if (options.timeoutMs && options.timeoutMs > 0) {
252
- timeoutId = setTimeout(() => {
253
- subprocess.kill();
254
- reject(new Error(`Process timed out after ${options.timeoutMs}ms`));
255
- }, options.timeoutMs);
256
- }
257
- subprocess.on("close", (exitCode) => {
258
- if (timeoutId)
259
- clearTimeout(timeoutId);
260
- resolve({
261
- exitCode: exitCode || 0,
262
- stdout,
263
- stderr,
264
- });
265
- });
266
- subprocess.on("error", (error) => {
267
- if (timeoutId)
268
- clearTimeout(timeoutId);
269
- reject(new Error(`Failed to start process: ${error.message}`));
270
- });
271
- });
272
- }
273
- static getCertHash(cert) {
274
- const hash = (0, crypto_1.createHash)("sha256");
275
- if (cert.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM) {
276
- hash.update(SevSNP.convertPemToDer(cert.cert.toString()));
277
- }
278
- else {
279
- hash.update(cert.cert);
280
- }
281
- return hash.digest();
282
- }
283
- static isValidArk(ARK, trustedHashes) {
284
- const ArkCert = forge.pki.certificateFromPem(ARK.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM
285
- ? ARK.cert.toString()
286
- : SevSNP.convertCertToPem(Buffer.from(ARK.cert)));
287
- const ArkCN = ArkCert.subject.attributes.find((attr) => attr.name === "commonName")?.value;
288
- if (!ArkCN) {
289
- throw new Error("Can't extract CN from ARK certificate");
290
- }
291
- const ArkHash = SevSNP.getCertHash(ARK);
292
- const TrustedHash = (trustedHashes && trustedHashes[ArkCN]) || Buffer.alloc(0);
293
- return ArkHash.equals(TrustedHash);
294
- }
295
- /**
296
- * AMD SEV-SNP verification method
297
- * @param report - report with full certificate chain
298
- * @param options - trustedHashes - map of trusted AMD ARK Certificates (CommonName as Key, Sha256 Hash of Der Certificate as Value) - optional
299
- * timeoutMs - timeout of the utility snpnost in ms
300
- * snpGuestBinaryPath - path for snpguest util
301
- */
302
- static async verifyReport(report, options) {
303
- const trustedHashes = options?.trustedHashes ?? getDefaultArkHashes();
304
- const timeoutMs = options?.timeoutMs ?? 10000;
305
- const snpGuestBinaryPath = options?.snpGuestBinaryPath ?? path.resolve(__dirname, "../../bindings/utils/virtee/snpguest");
306
- const tmpDirTemplate = options?.tmpDirTemplate ?? path.join(os.tmpdir(), "temp-");
307
- if (!path.isAbsolute(snpGuestBinaryPath)) {
308
- throw new Error("snpGuestBinaryPath must be an absolute path");
309
- }
310
- const ARK = report.certs.find((cert) => cert.type === AmdSevSnp_1.SevSNPCertType.ARK);
311
- if (!ARK) {
312
- throw new Error("Can't find ARK certificate in certificate chain");
313
- }
314
- if (!SevSNP.isValidArk(ARK, trustedHashes)) {
315
- throw new Error("The supplied certificate chain contains an untrusted root certificate");
316
- }
317
- const tempDir = await fs.mkdtemp(tmpDirTemplate);
318
- try {
319
- for (const certEntry of report.certs) {
320
- const fileName = (0, AmdSevSnp_1.sevSNPCertTypeToJSON)(certEntry.type).toLowerCase();
321
- const extension = certEntry.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? "pem" : "der";
322
- await fs.writeFile(`${tempDir}/${fileName}.${extension}`, certEntry.cert, certEntry.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? "utf8" : undefined);
323
- }
324
- const reportPath = `${tempDir}/report.bin`;
325
- await fs.writeFile(reportPath, Buffer.from(report.snpReport.rawReport));
326
- const snpguestRes = await SevSNP.runSubProcess(snpGuestBinaryPath, ["verify", "attestation", tempDir, reportPath], { timeoutMs });
327
- if (snpguestRes.exitCode != 0) {
328
- throw new Error(`Error validating report. Output: ${snpguestRes.stdout}\n${snpguestRes.stderr}`);
329
- }
330
- }
331
- finally {
332
- await (0, helpers_1.gramineCompatibleRmDir)(tempDir);
333
- }
334
- }
335
- static calcMrEnclave(measure, vmpl, policy) {
336
- const hash = (0, crypto_1.createHash)("sha256");
337
- hash.update(measure);
338
- const vmplBuf = Buffer.alloc(4);
339
- vmplBuf.writeUInt32LE(vmpl, 0);
340
- hash.update(vmplBuf);
341
- const policyBuf = Buffer.alloc(8);
342
- policyBuf.writeBigUint64LE(policy, 0);
343
- hash.update(policyBuf);
344
- return hash.digest();
345
- }
346
- /**
347
- * Method for obtaining mrEnclave from report. MrEnclave includes report measure, report vmpl and report policy
348
- * @param report - report without certificates
349
- */
350
- static getMrEnclave(report) {
351
- const measure = (0, amd_sev_snp_napi_rs_1.getReportMeasure)(report);
352
- const vmpl = (0, amd_sev_snp_napi_rs_1.getReportVmpl)(report);
353
- const policy = (0, amd_sev_snp_napi_rs_1.getReportPolicy)(report);
354
- return SevSNP.calcMrEnclave(measure, vmpl, policy);
355
- }
356
- /**
357
- * Method for obtaining reportData. This data was passed when generating the report
358
- * @param report - report without certificates
359
- */
360
- static async getReportData(report) {
361
- return (0, amd_sev_snp_napi_rs_1.getReportData)(report);
362
- }
363
- /**
364
- * Method for obtaining measure. Please do not confuse with mrenclave. Report measure is part of mrEnclave.
365
- * @param report - report without certificates
366
- */
367
- static async getReportMeasure(report) {
368
- return (0, amd_sev_snp_napi_rs_1.getReportMeasure)(report);
369
- }
370
- static async calculateFileSha256(filePath) {
371
- const fileData = await fs.readFile(filePath);
372
- const hash = (0, crypto_1.createHash)("sha256");
373
- hash.update(fileData);
374
- return hash.digest();
375
- }
376
- static calculateCmdlineHash(cmdLine) {
377
- const cmdLineBytes = Buffer.concat([Buffer.from(cmdLine.trim(), "utf-8"), Buffer.from([0])]);
378
- const hash = (0, crypto_1.createHash)("sha256");
379
- hash.update(cmdLineBytes);
380
- return hash.digest();
381
- }
382
- /**
383
- * The method allows to get the expected mrEnclave without generating a report
384
- * @param params - @see CalcSnpMrEnclaveParams
385
- */
386
- static async calcSnpMrEnclave(params) {
387
- const measure = (0, amd_sev_snp_napi_rs_1.calcSnpMeasure)(params.ovmfPath, params.kernelHash, params.initrdHash ?? exports.EMPTY_INITRD_SHA256_HASH, params.cmdLineHash, params.vcpuSig, params.vcpuCount);
388
- return SevSNP.calcMrEnclave(measure, params.vmpl ?? 0, params.policy ?? BigInt(0x30000));
389
- }
390
- static extractBuildFromCmdline(cmdLine, paramName = "build") {
391
- const regex = new RegExp(`${paramName}=([^\\s]+)`);
392
- const match = cmdLine.match(regex);
393
- if (match) {
394
- return match[1];
395
- }
396
- else {
397
- throw new Error(`${paramName} parameter not found`);
398
- }
399
- }
400
- /**
401
- * Compute the 32-bit CPUID signature from family, model, and stepping.
402
- * This computation is described in AMD's CPUID Specification, publication #25481
403
- * https://www.amd.com/system/files/TechDocs/25481.pdf
404
- * See section: CPUID Fn0000_0001_EAX Family, Model, Stepping Identifiers
405
- * @param cpuInfo - Structure containing family, model and stepping @see CpuInfo
406
- */
407
- static getCpuSig(cpuInfo) {
408
- return (0, amd_sev_snp_napi_rs_1.getCpuSig)(cpuInfo);
409
- }
410
- static async getReportImportantSecurityFields(report) {
411
- return (0, amd_sev_snp_napi_rs_1.getReportImportantSecurityFields)(report);
412
- }
413
- static async getReportCpuInfo(report) {
414
- return (0, amd_sev_snp_napi_rs_1.getReportCpuInfo)(report);
415
- }
416
- static async getCpuGeneration(cpuInfo) {
417
- return (0, amd_sev_snp_napi_rs_1.getCpuGeneration)(cpuInfo);
418
- }
419
- /**
420
- * Parse and validate policy
421
- * @param input - Raw policy as json-text or object
422
- */
423
- static parsePolicySet(input) {
424
- let parsed;
425
- if (typeof input === "string") {
426
- if (input.trim().length === 0) {
427
- return {};
428
- }
429
- parsed = JSON.parse(input);
430
- }
431
- else {
432
- parsed = input;
433
- }
434
- const { isValid } = (0, sdk_js_1.validateBySchema)(parsed, sev_snp_schema_1.PolicySetSchema);
435
- if (!isValid) {
436
- const validationErrors = Array.from(value_1.Value.Errors(sev_snp_schema_1.PolicySetSchema, parsed));
437
- if (validationErrors.length > 0) {
438
- throw new Error(`Failed to validate policy JSON: ${validationErrors.map((e) => e.message).join(", ")}`);
439
- }
440
- }
441
- return parsed;
442
- }
443
- static checkRule(rule, fields) {
444
- const fieldValue = fields[rule.name];
445
- switch (rule.operator) {
446
- case sev_snp_schema_1.RuleOperator.Le:
447
- return fieldValue <= rule.value;
448
- case sev_snp_schema_1.RuleOperator.Eq:
449
- return fieldValue === rule.value;
450
- case sev_snp_schema_1.RuleOperator.Ge:
451
- return fieldValue >= rule.value;
452
- default:
453
- return false;
454
- }
455
- }
456
- /**
457
- * Verify SNP report against a PolicySet.
458
- * Throws an error if any rule fails.
459
- * @param report - SNPReport
460
- * @param policySet - PolicySet containing rules
461
- */
462
- static async verifyPolicy(report, policySet) {
463
- if (Object.keys(policySet).length === 0) {
464
- return; // No policy set provided, consider it valid
465
- }
466
- const fields = await this.getReportImportantSecurityFields(report);
467
- const commonPolicy = policySet[sev_snp_schema_1.CommonPolicyKeyName];
468
- if (commonPolicy) {
469
- for (const rule of commonPolicy) {
470
- if (!this.checkRule(rule, fields)) {
471
- const fieldValue = fields[rule.name];
472
- throw new Error(`Policy violation in "commonPolicy": field "${rule.name}" has value ${JSON.stringify(fieldValue)}, ` +
473
- `expected ${rule.operator} ${JSON.stringify(rule.value)}`);
474
- }
475
- }
476
- }
477
- const cpuGen = await this.getCpuGeneration(await this.getReportCpuInfo(report));
478
- const cpuPolicy = policySet[cpuGen];
479
- if (cpuPolicy) {
480
- for (const rule of cpuPolicy) {
481
- if (!this.checkRule(rule, fields)) {
482
- const fieldValue = fields[rule.name];
483
- throw new Error(`Policy violation in "${cpuGen}": field "${rule.name}" has value ${JSON.stringify(fieldValue)}, ` +
484
- `expected ${rule.operator} ${JSON.stringify(rule.value)}`);
485
- }
486
- }
487
- }
488
- }
489
- }
490
- exports.SevSNP = SevSNP;
491
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V2LXNucC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZ3gtbmF0aXZlLW1vZHVsZS9zZXYtc25wLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkVBdUI2QztBQUU3QyxtREFBaUY7QUFDakYsa0RBQTZDO0FBQzdDLGtEQUFvQztBQUVwQyxnREFBa0M7QUFDbEMsMkNBQTZCO0FBQzdCLHVDQUF5QjtBQUN6QixpREFBc0M7QUFDdEMsbUNBQW9DO0FBQ3BDLHVDQUFtRDtBQUNuRCxrREFPNEI7QUFDNUIscURBQTZHO0FBQzdHLG1EQUFnRDtBQWFuQyxRQUFBLHNCQUFzQixHQUFZO0lBQzNDLE1BQU0sRUFBRSxFQUFFO0lBQ1YsS0FBSyxFQUFFLENBQUM7SUFDUixRQUFRLEVBQUUsQ0FBQztDQUNkLENBQUM7QUFFVyxRQUFBLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQy9DLGtFQUFrRSxFQUNsRSxLQUFLLENBQ1IsQ0FBQztBQUlGLFNBQWdCLG1CQUFtQjtJQUMvQixNQUFNLFVBQVUsR0FBOEIsRUFBRSxDQUFDO0lBRWpELFVBQVUsQ0FBQyxXQUFXLENBQUMsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDO1FBQ3pDLE1BQU0sRUFBRSxtQ0FBdUIsQ0FBQyxHQUFHO1FBQ25DLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFhLENBQUM7S0FDbkMsQ0FBQyxDQUFDO0lBRUgsVUFBVSxDQUFDLFdBQVcsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDekMsTUFBTSxFQUFFLG1DQUF1QixDQUFDLEdBQUc7UUFDbkMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQWEsQ0FBQztLQUNuQyxDQUFDLENBQUM7SUFFSCxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUN6QyxNQUFNLEVBQUUsbUNBQXVCLENBQUMsR0FBRztRQUNuQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxtQ0FBYSxDQUFDO0tBQ25DLENBQUMsQ0FBQztJQUVILE9BQU8sVUFBVSxDQUFDO0FBQ3RCLENBQUM7QUFuQkQsa0RBbUJDO0FBRUQsTUFBYSxNQUFNO0lBQ1IsTUFBTSxDQUFDLGtCQUFrQixDQUFDLE1BQTBCO1FBQ3ZELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBa0IsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRU0sTUFBTSxDQUFDLG9CQUFvQixDQUFDLFVBQWtCO1FBQ2pELE9BQU8sOEJBQWtCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFUyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsSUFBWTtRQUMxQyxNQUFNLFNBQVMsR0FBRywrQkFBK0IsQ0FBQztRQUNsRCxNQUFNLFNBQVMsR0FBRyw2QkFBNkIsQ0FBQztRQUVoRCxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE9BQU8sSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQzNCLENBQUM7UUFDRCxNQUFNLGVBQWUsR0FBRyxJQUFJO2FBQ3ZCLFFBQVEsQ0FBQyxRQUFRLENBQUM7YUFDbEIsS0FBSyxDQUFDLFVBQVUsQ0FBQztZQUNsQixFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVqQixPQUFPLFNBQVMsR0FBRyxlQUFlLEdBQUcsU0FBUyxDQUFDO0lBQ25ELENBQUM7SUFFUyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQVk7UUFDekMsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFUyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQWdCO1FBQ3hDLE1BQU0sU0FBUyxHQUFHLGlFQUFpRSxDQUFDO1FBQ3BGLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFMUMsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBRVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxXQUFXO1FBQzlCLE1BQU0sSUFBSSxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDekQsK0dBQStHO1FBQy9HLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsUUFBZ0IsRUFBRSxPQUFlLENBQUM7UUFDcEUsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLDBDQUFvQixFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsMENBQW9CLFNBQVMsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFFRCxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3hDLFFBQVEsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFOUIsTUFBTSxTQUFTLEdBQUcsSUFBQSxrQ0FBWSxFQUFDLGNBQWMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNyRCxNQUFNLE9BQU8sR0FBRyxJQUFBLGdDQUFVLEdBQUUsQ0FBQztRQUM3QixNQUFNLE1BQU0sR0FBRyxJQUFBLCtCQUFTLEVBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsTUFBTSxLQUFLLEdBQUcsSUFBQSwwQ0FBb0IsR0FBRSxDQUFDO1FBQ3JDLE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBRTNDLE9BQU87WUFDSCxTQUFTO1lBQ1QsTUFBTTtZQUNOLEtBQUs7WUFDTCxXQUFXLEVBQUUsTUFBTSxDQUFDLG9CQUFvQixDQUFDLE9BQU8sQ0FBQztZQUNqRCxLQUFLLEVBQUUsTUFBTSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sQ0FBQztTQUNqRCxDQUFDO0lBQ04sQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQzlCLE1BQWlCLEVBQ2pCLE9BSUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxPQUFPLEVBQUUsUUFBUSxJQUFJLEVBQUUsQ0FBQztRQUN6QyxNQUFNLGFBQWEsR0FBRyxPQUFPLEVBQUUsYUFBYSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQztRQUN6RixNQUFNLFVBQVUsR0FBRyxPQUFPLEVBQUUsVUFBVSxJQUFJLG1DQUF1QixDQUFDLEdBQUcsQ0FBQztRQUN0RSxNQUFNLEtBQUssR0FBYyxFQUFFLENBQUM7UUFFNUIsTUFBTSxhQUFhLEdBQUcsZUFBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3JDLElBQUksSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDM0IsSUFBSSxhQUFhLEdBQUcsMkNBQXFCLENBQUMsS0FBSyxDQUFDO1FBQ2hELElBQUksV0FBVyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsMkNBQXFCLENBQUMsQ0FBQztRQUV2RCxvRUFBb0U7UUFDcEUsb0VBQW9FO1FBQ3BFLElBQUksQ0FBQztZQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEQsV0FBVyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDN0IsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDWCxvRUFBb0U7WUFDcEUsZ0NBQWdDO1FBQ3BDLENBQUM7UUFFRCxLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ25DLGFBQWEsR0FBRyxVQUFVLENBQUM7WUFDM0IsTUFBTSxPQUFPLEdBQUcsSUFBQSxtQ0FBYSxFQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ3pFLElBQUksQ0FBQztnQkFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFVLENBQUMsZUFBZSxDQUFnQjtvQkFDN0QsV0FBVyxDQUFDLFFBQVE7d0JBQ2hCLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztvQkFDbkQsQ0FBQztvQkFDRCxPQUFPO3dCQUNILE9BQU8sYUFBYSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUU7NEJBQzlCLFlBQVksRUFBRSxhQUFhO3lCQUM5QixDQUFDLENBQUM7b0JBQ1AsQ0FBQztvQkFDRCxVQUFVLENBQUMsR0FBRzt3QkFDVixJQUFJLGVBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDOzRCQUMxQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQzs0QkFFbkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLElBQUksR0FBRyxFQUFFLENBQUM7d0JBQ3hDLENBQUM7d0JBRUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxlQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ2xELENBQUM7b0JBQ0QsYUFBYTtvQkFDYixRQUFRO2lCQUNYLENBQUMsQ0FBQztnQkFDSCxJQUFJLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztnQkFDckIsTUFBTTtZQUNWLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNYLE1BQU0sTUFBTSxHQUFHLFVBQVUsS0FBSyxXQUFXLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDbEUsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDVCxNQUFNLEdBQUcsQ0FBQztnQkFDZCxDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDOUMsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNQLElBQUksRUFBRSwwQkFBYyxDQUFDLElBQUk7WUFDekIsTUFBTSxFQUFFLFVBQVU7WUFDbEIsSUFBSSxFQUFFLFVBQVUsS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDO1NBQzVHLENBQUMsQ0FBQztRQUVILE1BQU0sS0FBSyxHQUFHLEdBQUcsbUNBQWEsSUFBSSw4QkFBUSxJQUFJLGFBQWEsYUFBYSxDQUFDO1FBQ3pFLE1BQU0sUUFBUSxHQUFHLE1BQU0sZ0JBQVUsQ0FBQyxlQUFlLENBQWdCO1lBQzdELFdBQVcsQ0FBQyxRQUFRO2dCQUNoQixPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDbkQsQ0FBQztZQUNELE9BQU87Z0JBQ0gsT0FBTyxhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRTtvQkFDNUIsWUFBWSxFQUFFLGFBQWE7aUJBQzlCLENBQUMsQ0FBQztZQUNQLENBQUM7WUFDRCxVQUFVLENBQUMsR0FBRztnQkFDVixJQUFJLGVBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUMxQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztvQkFFbkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLElBQUksR0FBRyxFQUFFLENBQUM7Z0JBQ3hDLENBQUM7Z0JBRUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxlQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEQsQ0FBQztZQUNELGFBQWE7WUFDYixRQUFRO1NBQ1gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDNUQsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNQLElBQUksRUFBRSwwQkFBYyxDQUFDLEdBQUc7WUFDeEIsTUFBTSxFQUFFLFVBQVU7WUFDbEIsSUFBSSxFQUNBLFVBQVUsS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHO2dCQUN0QyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pCLENBQUMsQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztTQUMvQyxDQUFDLENBQUM7UUFDSCxLQUFLLENBQUMsSUFBSSxDQUFDO1lBQ1AsSUFBSSxFQUFFLDBCQUFjLENBQUMsR0FBRztZQUN4QixNQUFNLEVBQUUsVUFBVTtZQUNsQixJQUFJLEVBQ0EsVUFBVSxLQUFLLG1DQUF1QixDQUFDLEdBQUc7Z0JBQ3RDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDekIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQy9DLENBQUMsQ0FBQztRQUVILE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQywwQkFBMEIsQ0FDMUMsUUFBZ0IsRUFDaEIsT0FJQztRQUVELE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNELE1BQU0sS0FBSyxHQUFHLE1BQU0sTUFBTSxDQUFDLGNBQWMsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFOUQsT0FBTztZQUNILFNBQVM7WUFDVCxLQUFLLEVBQUUsS0FBSztTQUNmLENBQUM7SUFDTixDQUFDO0lBRVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQ2hDLFVBQWtCLEVBQ2xCLE9BQWlCLEVBQUUsRUFDbkIsVUFBZ0QsRUFBRTtRQUVsRCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ25DLE1BQU0sVUFBVSxHQUFHLElBQUEscUJBQUssRUFBQyxVQUFVLEVBQUUsSUFBSSxFQUFFO2dCQUN2QyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7Z0JBQ2hCLEtBQUssRUFBRSxNQUFNO2FBQ2hCLENBQUMsQ0FBQztZQUVILElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztZQUNoQixJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7WUFFaEIsVUFBVSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3ZFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUV2RSxJQUFJLFNBQXFDLENBQUM7WUFDMUMsSUFBSSxPQUFPLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzdDLFNBQVMsR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFO29CQUN4QixVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7b0JBQ2xCLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQywyQkFBMkIsT0FBTyxDQUFDLFNBQVMsSUFBSSxDQUFDLENBQUMsQ0FBQztnQkFDeEUsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUMxQixDQUFDO1lBRUQsVUFBVSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsRUFBRTtnQkFDaEMsSUFBSSxTQUFTO29CQUFFLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsT0FBTyxDQUFDO29CQUNKLFFBQVEsRUFBRSxRQUFRLElBQUksQ0FBQztvQkFDdkIsTUFBTTtvQkFDTixNQUFNO2lCQUNULENBQUMsQ0FBQztZQUNQLENBQUMsQ0FBQyxDQUFDO1lBRUgsVUFBVSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDN0IsSUFBSSxTQUFTO29CQUFFLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLDRCQUE0QixLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ25FLENBQUMsQ0FBQyxDQUFDO1FBQ1AsQ0FBQyxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRU0sTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUEyQjtRQUNqRCxNQUFNLElBQUksR0FBRyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLG1DQUF1QixDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzlDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM5RCxDQUFDO2FBQU0sQ0FBQztZQUNKLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQWMsQ0FBQyxDQUFDO1FBQ3JDLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUN6QixDQUFDO0lBRVMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxHQUFZLEVBQUUsYUFBd0I7UUFDOUQsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FDeEMsR0FBRyxDQUFDLE1BQU0sS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHO1lBQ3RDLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRTtZQUNyQixDQUFDLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQ3ZELENBQUM7UUFDRixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssWUFBWSxDQUFDLEVBQUUsS0FFdEUsQ0FBQztRQUNoQixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDVCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDeEMsTUFBTSxXQUFXLEdBQUcsQ0FBQyxhQUFhLElBQUksYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUUvRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUM1QixNQUEwQixFQUMxQixPQUtDO1FBRUQsTUFBTSxhQUFhLEdBQUcsT0FBTyxFQUFFLGFBQWEsSUFBSSxtQkFBbUIsRUFBRSxDQUFDO1FBQ3RFLE1BQU0sU0FBUyxHQUFHLE9BQU8sRUFBRSxTQUFTLElBQUksS0FBSyxDQUFDO1FBQzlDLE1BQU0sa0JBQWtCLEdBQ3BCLE9BQU8sRUFBRSxrQkFBa0IsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxzQ0FBc0MsQ0FBQyxDQUFDO1FBQ25HLE1BQU0sY0FBYyxHQUFHLE9BQU8sRUFBRSxjQUFjLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFbEYsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssMEJBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxRSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxFQUFFLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBRWpELElBQUksQ0FBQztZQUNELEtBQUssTUFBTSxTQUFTLElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNuQyxNQUFNLFFBQVEsR0FBRyxJQUFBLGdDQUFvQixFQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDcEUsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLE1BQU0sS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO2dCQUNuRixNQUFNLEVBQUUsQ0FBQyxTQUFTLENBQ2QsR0FBRyxPQUFPLElBQUksUUFBUSxJQUFJLFNBQVMsRUFBRSxFQUNyQyxTQUFTLENBQUMsSUFBSSxFQUNkLFNBQVMsQ0FBQyxNQUFNLEtBQUssbUNBQXVCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDeEUsQ0FBQztZQUNOLENBQUM7WUFDRCxNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sYUFBYSxDQUFDO1lBRTNDLE1BQU0sRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFFekUsTUFBTSxXQUFXLEdBQUcsTUFBTSxNQUFNLENBQUMsYUFBYSxDQUMxQyxrQkFBa0IsRUFDbEIsQ0FBQyxRQUFRLEVBQUUsYUFBYSxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsRUFDOUMsRUFBRSxTQUFTLEVBQUUsQ0FDaEIsQ0FBQztZQUNGLElBQUksV0FBVyxDQUFDLFFBQVEsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsV0FBVyxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztZQUNyRyxDQUFDO1FBQ0wsQ0FBQztnQkFBUyxDQUFDO1lBQ1AsTUFBTSxJQUFBLGdDQUFzQixFQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLENBQUM7SUFDTCxDQUFDO0lBRVMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFlLEVBQUUsSUFBWSxFQUFFLE1BQWM7UUFDeEUsTUFBTSxJQUFJLEdBQUcsSUFBQSxtQkFBVSxFQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFckIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoQyxPQUFPLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRXJCLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN0QyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRXZCLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsWUFBWSxDQUFDLE1BQWM7UUFDckMsTUFBTSxPQUFPLEdBQUcsSUFBQSxzQ0FBZ0IsRUFBQyxNQUFNLENBQUMsQ0FBQztRQUN6QyxNQUFNLElBQUksR0FBRyxJQUFBLG1DQUFhLEVBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkMsTUFBTSxNQUFNLEdBQUcsSUFBQSxxQ0FBZSxFQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXZDLE9BQU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFjO1FBQzVDLE9BQU8sSUFBQSxtQ0FBYSxFQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQWM7UUFDL0MsT0FBTyxJQUFBLHNDQUFnQixFQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFUyxNQUFNLENBQUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDLFFBQWdCO1FBQ3ZELE1BQU0sUUFBUSxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM3QyxNQUFNLElBQUksR0FBRyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUV0QixPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUN6QixDQUFDO0lBRVMsTUFBTSxDQUFDLG9CQUFvQixDQUFDLE9BQWU7UUFDakQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3RixNQUFNLElBQUksR0FBRyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUUxQixPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUN6QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxNQUE4QjtRQUMvRCxNQUFNLE9BQU8sR0FBRyxJQUFBLG9DQUFjLEVBQzFCLE1BQU0sQ0FBQyxRQUFRLEVBQ2YsTUFBTSxDQUFDLFVBQVUsRUFDakIsTUFBTSxDQUFDLFVBQVUsSUFBSSxnQ0FBd0IsRUFDN0MsTUFBTSxDQUFDLFdBQVcsRUFDbEIsTUFBTSxDQUFDLE9BQU8sRUFDZCxNQUFNLENBQUMsU0FBUyxDQUNuQixDQUFDO1FBRUYsT0FBTyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFFUyxNQUFNLENBQUMsdUJBQXVCLENBQUMsT0FBZSxFQUFFLFNBQVMsR0FBRyxPQUFPO1FBQ3pFLE1BQU0sS0FBSyxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsU0FBUyxZQUFZLENBQUMsQ0FBQztRQUNuRCxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25DLElBQUksS0FBSyxFQUFFLENBQUM7WUFDUixPQUFPLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNwQixDQUFDO2FBQU0sQ0FBQztZQUNKLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxTQUFTLHNCQUFzQixDQUFDLENBQUM7UUFDeEQsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSSxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQWdCO1FBQ3BDLE9BQU8sSUFBQSwrQkFBUyxFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUFDLE1BQWM7UUFDL0QsT0FBTyxJQUFBLHNEQUFnQyxFQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQWM7UUFDL0MsT0FBTyxJQUFBLHNDQUFnQixFQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE9BQWdCO1FBQ2pELE9BQU8sSUFBQSxzQ0FBZ0IsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBQ0Q7OztPQUdHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUF1QztRQUNoRSxJQUFJLE1BQStCLENBQUM7UUFDcEMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM1QixJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQzVCLE9BQU8sRUFBZSxDQUFDO1lBQzNCLENBQUM7WUFDRCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQixDQUFDO2FBQU0sQ0FBQztZQUNKLE1BQU0sR0FBRyxLQUFLLENBQUM7UUFDbkIsQ0FBQztRQUVELE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFBLHlCQUFnQixFQUFDLE1BQU0sRUFBRSxnQ0FBZSxDQUFDLENBQUM7UUFDOUQsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLGFBQUssQ0FBQyxNQUFNLENBQUMsZ0NBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBQzNFLElBQUksZ0JBQWdCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUM5QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzVHLENBQUM7UUFDTCxDQUFDO1FBRUQsT0FBTyxNQUFtQixDQUFDO0lBQy9CLENBQUM7SUFFTyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQWdCLEVBQUUsTUFBK0I7UUFDdEUsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNyQyxRQUFRLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNwQixLQUFLLDZCQUFZLENBQUMsRUFBRTtnQkFDaEIsT0FBTyxVQUFVLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQztZQUNwQyxLQUFLLDZCQUFZLENBQUMsRUFBRTtnQkFDaEIsT0FBTyxVQUFVLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQztZQUNyQyxLQUFLLDZCQUFZLENBQUMsRUFBRTtnQkFDaEIsT0FBTyxVQUFVLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQztZQUNwQztnQkFDSSxPQUFPLEtBQUssQ0FBQztRQUNyQixDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsTUFBYyxFQUFFLFNBQW9CO1FBQ2pFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEMsT0FBTyxDQUFDLDRDQUE0QztRQUN4RCxDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0NBQWdDLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkUsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLG9DQUFtQixDQUFpQixDQUFDO1FBQ3BFLElBQUksWUFBWSxFQUFFLENBQUM7WUFDZixLQUFLLE1BQU0sSUFBSSxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUM5QixJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztvQkFDaEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDckMsTUFBTSxJQUFJLEtBQUssQ0FDWCw4Q0FBOEMsSUFBSSxDQUFDLElBQUksZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFJO3dCQUNoRyxZQUFZLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztnQkFDTixDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQWlCLENBQUM7UUFDcEQsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNaLEtBQUssTUFBTSxJQUFJLElBQUksU0FBUyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO29CQUNoQyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO29CQUNyQyxNQUFNLElBQUksS0FBSyxDQUNYLHdCQUF3QixNQUFNLGFBQWEsSUFBSSxDQUFDLElBQUksZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFJO3dCQUM3RixZQUFZLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztnQkFDTixDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0NBQ0o7QUF4aEJELHdCQXdoQkMifQ==
@@ -1,31 +0,0 @@
1
- syntax = "proto3";
2
-
3
- enum SevSNPCertType {
4
- ARK = 0;
5
- ASK = 1;
6
- VCEK = 2;
7
- }
8
-
9
- enum SevSnpCertificateFormat {
10
- PEM = 0;
11
- DER = 1;
12
- }
13
-
14
- message SnpCert {
15
- SevSNPCertType type = 1;
16
- bytes cert = 2;
17
- SevSnpCertificateFormat format = 3;
18
- }
19
-
20
- message SNPReport {
21
- bytes rawReport = 1;
22
- uint32 cpuSig = 2;
23
- uint32 cores = 3;
24
- bytes cmdLineHash = 4;
25
- string build = 5;
26
- }
27
-
28
- message SNPReportWithChain {
29
- SNPReport snpReport = 1;
30
- repeated SnpCert certs = 2;
31
- }
@@ -1,11 +0,0 @@
1
- syntax = "proto3";
2
-
3
- message Compression {
4
- enum TYPE {
5
- Uncompressed = 0;
6
- GZIP = 1;
7
- }
8
-
9
- TYPE type = 1;
10
- bytes data = 2;
11
- }
@@ -1,6 +0,0 @@
1
- syntax = "proto3";
2
-
3
- message Hash {
4
- string algo = 1;
5
- bytes hash = 2;
6
- }
@@ -1,21 +0,0 @@
1
- syntax = "proto3";
2
-
3
- import "Hash.proto";
4
-
5
- message OrderReportProto {
6
- repeated bytes certificates = 1;
7
- WorkloadInfo workloadInfo = 2;
8
- }
9
-
10
- message WorkloadInfo {
11
- repeated RuntimeInfo runtimeInfo = 1;
12
- int64 created = 2;
13
- }
14
-
15
- message RuntimeInfo {
16
- string type = 1;
17
- int64 size = 2;
18
- Hash hash = 3;
19
- optional Hash signatureKeyHash = 4;
20
- optional Hash argsHash = 5;
21
- }
package/dto/src/TRI.proto DELETED
@@ -1,22 +0,0 @@
1
- syntax = "proto3";
2
-
3
- import "Hash.proto";
4
-
5
- message Encryption {
6
- string algo = 1;
7
- optional bytes key = 2;
8
- optional string cipher = 3;
9
- optional bytes ciphertext = 4;
10
- optional bytes iv = 6;
11
- optional bytes mac = 7;
12
- string encoding = 8;
13
- }
14
-
15
- message TRI {
16
- repeated Hash solutionHashes = 1;
17
- bytes mrenclave = 2;
18
- string args = 3;
19
- Encryption encryption = 4;
20
- bytes mrsigner = 5;
21
- repeated Hash imageHashes = 6;
22
- }
@@ -1,46 +0,0 @@
1
- syntax = "proto3";
2
-
3
- message TeeDeviceInfo {
4
- CpuInfo cpu = 1;
5
- MemoryInfo memory = 2;
6
- DiskInfo disk = 3;
7
- GpuInfo gpu = 4;
8
- }
9
-
10
- message CpuInfo {
11
- string vendor_id = 1;
12
- int32 cpu_family = 2;
13
- int32 model = 3;
14
- string model_name = 4;
15
- int32 total_physical_cores = 5;
16
- int32 total_logical_cores = 6;
17
- int32 base_freq = 7;
18
- int32 max_freq = 8;
19
- }
20
-
21
- message MemoryInfo {
22
- string type = 1;
23
- int64 size = 2;
24
- }
25
-
26
- message DiskInfo {
27
- string type = 1;
28
- int64 size = 2;
29
- }
30
-
31
- message GpuInfo {
32
- string type = 1;
33
- int32 count = 2;
34
- int64 memory_size = 3;
35
- }
36
-
37
- message NvtrustGPUInfo {
38
- string model = 1;
39
- string driverVersion = 2;
40
- string vbios = 3;
41
- bool dbgStat = 4;
42
- }
43
-
44
- message NvtrustGPUList {
45
- repeated NvtrustGPUInfo gpus = 1;
46
- }