ethernity-cloud-sdk-py 0.2.45__tar.gz → 0.3.0__tar.gz

{ethernity_cloud_sdk_py-0.2.45/ethernity_cloud_sdk_py.egg-info → ethernity_cloud_sdk_py-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethernity-cloud-sdk-py
-Version: 0.2.45
+Version: 0.3.0
 Summary: Ethernity Cloud SDK Python
 Home-page: https://github.com/ethernity-cloud/ethernity-cloud-sdk-py
 Author: Ethernity Cloud Team

ethernity_cloud_sdk_py-0.3.0/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/securelock.py.tmpl

@@ -0,0 +1,468 @@
+#!/usr/bin/python
+# update 29.12.2022
+import binascii
+import hashlib
+import os
+import re
+import string
+import io
+import time
+import requests
+from etny_crypto import etny_crypto as crypto
+from web3 import Web3
+from eth_account import Account
+from web3.middleware import geth_poa_middleware
+from key_generation import get_wallet_address
+from etny_exec import execute_task_v3, TaskStatus
+from etny_exec_flask import execute_task_v4, execute_server_v4
+from models import *
+from swift_stream_service import SwiftStreamService
+from eth_account.messages import defunct_hash_message
+
+"""
+EtnySecureLock: Secure task execution handler for Ethernity Cloud.
+
+Ethernity Cloud is a decentralized cloud computing platform that leverages blockchain for secure, private computations.
+This class runs within a trusted enclave (a secure, isolated environment) to handle task execution:
+- Fetches and decrypts user-submitted code (payload) and input data.
+- Validates integrity via checksums and signatures.
+- Executes the task securely.
+- Encrypts and stores results for retrieval.
+It integrates with blockchain smart contracts for metadata and Web3 for interactions, and SwiftStream for encrypted storage.
+Debug mode allows local testing; otherwise, it runs in production enclave setup.
+"""
+
+class EtnySecureLock:
+    debug = False
+
+    def __init__(self, swiftStreamClient):
+        """
+        Initialize the EtnySecureLock instance.
+
+        Sets up file paths, environment variables, blockchain connections, and storage client.
+        Uploads the public certificate to storage for verification.
+
+        :param swiftStreamClient: Client instance for SwiftStream storage service.
+        """
+        self.swift_stream_service = swiftStreamClient
+        self.version = 'v3.1'
+        print(f'ETNY Pynithy [{self.version}]')
+        self.__set_initializers()
+        self.save_pub_cert()
+        self.__load_env()
+        self.read_contract_abi()
+        self.init_web3()
+        self.print_env()
+
+    @staticmethod
+    def read_env_str(env_str):
+        """
+        Parse and set environment variables from a string (e.g., content of .env file).
+
+        Each line is expected in 'KEY=VALUE' format.
+
+        :param env_str: String containing environment variables.
+        """
+        with io.StringIO(env_str) as f:
+            for line in f:
+                key, value = line.split('=', 1)
+                os.environ[key] = re.sub(r'\n', '', value)
+
+    def __extract_signer(self, checksum, signature):
+        """
+        Recover the Ethereum address that signed a given checksum message.
+
+        Uses Web3's recovery function for signature verification.
+
+        :param checksum: The message (checksum) that was signed.
+        :param signature: The signature to recover from.
+        :return: The signer's Ethereum address.
+        """
+        signer = self.w3.eth.account.recoverHash(defunct_hash_message(text=checksum), signature=signature)
+        return signer
+
+    def __set_initializers(self):
+        """
+        Set initial values for instance variables.
+
+        Configures file paths, contract addresses, and debug mode overrides.
+        In Ethernity Cloud, these paths point to secure enclave-mounted volumes.
+        """
+        self.is_valid_client_data = True
+        self.key_file = "/private/__SECURELOCK_SESSION__/key.pem"
+        self.cert_file = "/app/__SECURELOCK_SESSION__/cert.pem"
+        self.pub_cert_file = "/app/__SECURELOCK_SESSION__/enclave_pub_cert.pem"
+        self.payload = 'payload.etny.securelock'
+        self.input = 'input.txt.securelock'
+        self.result_file = '/app/result.txt'
+        self.transaction_file = '/app/transaction.txt'
+        self.smart_contract_address = '__SMART_CONTRACT_ADDRESS__'
+        self.image_registry_address = '__IMAGE_REGISTRY_ADDRESS__'
+        self.chain_id = __CHAIN_ID__
+        self.web3_provider = '__RPC_URL__'
+        self.etny_bucket = "__BUCKET_NAME__"
+        self.trusted_zone_public_key = ''
+        if EtnySecureLock.debug:
+            self.key_file = "./app/cert1-ca1-clean.key"
+            self.cert_file = "./app/cert1-ca1-clean.crt"
+            self.payload = 'payload.py'
+            self.input = 'input.txt'
+            self.result_file = './app/result.txt'
+            self.transaction_file = './app/transaction.txt'
+            self.pub_cert_file = "./app/enclave_pub_cert.pem"
+
+    def validate_client_payload(self, payload_data, input_data):
+        """
+        Validate the integrity of client-submitted payload and input.
+
+        Fetches task metadata from the blockchain, computes checksums, and verifies signatures.
+        Ensures the data matches what was submitted on-chain by the task owner.
+
+        :param payload_data: Decrypted payload (code to execute).
+        :param input_data: Decrypted input data for the task.
+        """
+        self.get_do_request_metadata()
+        if self._metadata.payload_metadata_obj.checksum is not None:
+            payload_checksum = self.compute_sha256_checksum(payload_data)
+            if self._metadata.payload_metadata_obj.checksum.startswith('0x'):
+                checksum_signer = self.__extract_signer(payload_checksum, self._metadata.payload_metadata_obj.checksum)
+                transaction_checksum = payload_checksum
+            else:
+                checksum_signer = self.order_metadata.do_owner
+                transaction_checksum = self._metadata.payload_metadata_obj.checksum
+            if checksum_signer.lower() != self.order_metadata.do_owner.lower() and transaction_checksum != payload_checksum:
+                self.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR
+                self.task_result = 'PAYLOAD CHECKSUM DOES NOT MATCH THE EXPECTED VALUE'
+                self.is_valid_client_data = False
+                return
+        if self._metadata.input_metadata_obj.checksum is not None:
+            input_checksum = self.compute_sha256_checksum(input_data)
+            if self._metadata.input_metadata_obj.checksum.startswith('0x'):
+                checksum_signer = self.__extract_signer(input_checksum, self._metadata.input_metadata_obj.checksum)
+                transaction_checksum = input_checksum
+            else:
+                checksum_signer = self.order_metadata.do_owner
+                transaction_checksum = self._metadata.input_metadata_obj.checksum
+            if checksum_signer.lower() != self.order_metadata.do_owner.lower() and transaction_checksum != input_checksum:
+                self.task_code = TaskStatus.INPUT_CHECKSUM_ERROR
+                self.task_result = 'INPUT CHECKSUM DOES NOT MATCH THE EXPECTED VALUE'
+                self.is_valid_client_data = False
+                return
+
+    def wait_for_payload_and_input(self):
+        """
+        Wait for payload and input files to become available in storage.
+
+        Polls the SwiftStream bucket until both files are present.
+        """
+        print('Waiting for payload and input')
+        self.wait_for_trustedzone(self.etny_bucket, self.payload)
+        self.wait_for_trustedzone(self.etny_bucket, self.input)
+
+    def wait_for_trustedzone(self, bucket_name, object_name, timeout=3600):
+        """
+        Poll for the existence of an object in a SwiftStream bucket.
+
+        Used to wait for client-uploaded files in the trusted zone.
+
+        :param bucket_name: Name of the storage bucket.
+        :param object_name: Name of the object to wait for.
+        :param timeout: Maximum wait time in seconds (default: 1 hour).
+        """
+        i = 0
+        print(f'Checking if object {object_name} exists in bucket {bucket_name}')
+        while True:
+            time.sleep(1)
+            i = i + 1
+            if i > timeout:
+                break
+            (status, result) = self.__retry_swift_call(self.swift_stream_service.is_object_in_bucket, bucket_name, object_name)
+            if status:
+                break
+        print('secure lock finished the execution')
+
+    def get_do_request_metadata(self):
+        """
+        Fetch metadata for the current task (Distributed Operation Request) from the blockchain.
+
+        Retrieves order details and metadata using the Ethernity smart contract.
+        """
+        order_data = self.__retry_web3_call(self.etny.caller()._getOrder, self.order_id)
+        order = Order(order_data, self.order_id)
+        metadata_data = self.__retry_web3_call(self.etny.caller()._getDORequestMetadata, order.do_req)
+        self._metadata = DOReqMetadata(metadata_data, order.do_req)
+        self.order_metadata = order
+
+    def compute_sha256_checksum(self, file_data):
+        """
+        Compute the SHA-256 checksum of given data.
+
+        Used for integrity validation of payload and input.
+
+        :param file_data: Data to checksum (string or bytes).
+        :return: Hex digest of the checksum.
+        """
+        if type(file_data) is str:
+            file_data = file_data.encode('utf-8')
+        return hashlib.sha256(file_data).hexdigest()
+
+    def print_env(self):
+        """
+        Print key environment and configuration values for logging/debugging.
+        """
+        print('ETNY_CHAIN_ID:', self.chain_id)
+        print('ETNY_PROTOCOL_CONTRACT_ADDRESS:', self.smart_contract_address)
+        print('ETNY_WEB3_PROVIDER:', self.web3_provider)
+        print('ETNY_CLIENT_CHALLENGE:', self.client_challenge)
+        print('ETNY_ORDER_ID:', self.order_id)
+
+    def init_web3(self):
+        """
+        Initialize Web3 connection to the Ethernity blockchain.
+
+        Connects to the RPC provider, injects PoA middleware, and sets up contract instances.
+        """
+        self.w3 = Web3(Web3.HTTPProvider(self.web3_provider))
+        self.w3.middleware_onion.inject(geth_poa_middleware, layer=0)
+        self.etny = self.w3.eth.contract(address=self.w3.toChecksumAddress(self.smart_contract_address),
+                                        abi=self.contract_abi)
+        self.image_registry = self.w3.eth.contract(address=self.w3.toChecksumAddress(self.image_registry_address),
+                                                  abi=self.image_registry_abi)
+
+    def read_contract_abi(self):
+        """
+        Load ABI (Application Binary Interface) for smart contracts.
+
+        Reads from local files for the main PoX contract and image registry.
+        """
+        self.contract_abi = self.__read_contract_abi('pox.abi')
+        self.image_registry_abi = self.__read_contract_abi('image_registry.abi')
+
+    def __read_contract_abi(self, contract_name):
+        """
+        Read ABI file content from the script's directory.
+
+        :param contract_name: Name of the ABI file.
+        :return: ABI string.
+        """
+        f = open(os.path.dirname(os.path.realpath(__file__)) + f'/{contract_name}')
+        contract_abi = f.read()
+        f.close()
+        return contract_abi
+
+    def __load_env(self):
+        """
+        Load configuration from environment variables.
+
+        Sets chain ID, contract addresses, RPC URL, client challenge, and order ID.
+        These are typically set via the .env file fetched from storage.
+        Validates types and sets error states if invalid.
+        """
+        try:
+            if os.getenv('ETNY_CHAIN_ID') is not None:
+                self.chain_id = int(os.getenv('ETNY_CHAIN_ID'))
+            if os.getenv('ETNY_SMART_CONTRACT_ADDRESS') is not None:
+                self.smart_contract_address = os.getenv('ETNY_SMART_CONTRACT_ADDRESS').rstrip()
+            if os.getenv('ETNY_WEB3_PROVIDER') is not None:
+                self.web3_provider = os.getenv('ETNY_WEB3_PROVIDER').rstrip()
+            self.client_challenge = os.getenv('ETNY_CLIENT_CHALLENGE')
+            self.order_id = int(os.getenv('ETNY_ORDER_ID'))
+        except ValueError as e:
+            print(f'Invalid environment variable type: {e}')
+            self.task_code = TaskStatus.SYSTEM_ERROR
+            self.task_result = 'INVALID ENVIRONMENT VARIABLES DETECTED DURING LOADING'
+            self.is_valid_client_data = False
+
+    def save_result(self):
+        """
+        Save task execution results to storage.
+
+        Fetches the latest trusted zone public key with retries, encrypts results,
+        and uploads them to SwiftStream.
+        """
+        self.encrypt_file_and_push_to_swifstream(str(self.task_result), "result.txt")
+        self.encrypt_file_and_push_to_swifstream(str(self.task_code), "result_code.txt")
+
+    def save_pub_cert(self):
+        """
+        Upload the enclave's public certificate to storage.
+
+        Creates the bucket if needed and stores the cert for client verification.
+        """
+        self.__ensure_bucket_exists()
+        self.__retry_swift_call(self.swift_stream_service.put_file_content, self.etny_bucket,
+                                "cert.pem",
+                                self.cert_file)
+
+    def execute(self):
+        """
+        Execute the client-submitted task.
+
+        Fetches and decrypts payload/input, validates them, and runs the task
+        using the appropriate executor based on metadata version.
+        Sets task_code and task_result accordingly.
+        """
+        payload_data = self.__get_file_content_and_decrypt(self.payload)
+        input_data = self.__get_file_content_and_decrypt(self.input)
+        print('Validate client payload and input')
+        self.validate_client_payload(payload_data, input_data)
+        if self.is_valid_client_data:
+            print('Client payload and input are valid')
+        else:
+            print('Client payload and input are NOT valid')
+            return
+        if self._metadata._payload_metadata_obj._version == 'v3':
+            task_result = execute_task_v3(payload_data, input_data)
+        else:
+            task_result = execute_server_v4(payload_data, input_data)
+        self.task_code = str(task_result[0])
+        self.task_result = task_result[1]
+
+    def __get_file_content_and_decrypt(self, object_name):
+        """
+        Fetch and decrypt a file from SwiftStream storage.
+
+        :param object_name: Name of the object to fetch.
+        :return: Decrypted content as string.
+        """
+        status, encrypted_base64 = self.__retry_swift_call(self.swift_stream_service.get_file_content, self.etny_bucket, object_name)
+        if not status:
+            print(f'Failed to get {object_name} file')
+            raise Exception(f'Failed to get {object_name} file')
+        encrypted_tuple = crypto.encrypted_data_from_base64_json(encrypted_base64.encode('utf-8'))
+        decrypted_result = crypto.decrypt(self.key_file, encrypted_tuple)
+        return decrypted_result.decode('utf-8')
+
+    def encrypt_file_and_push_to_swifstream(self, file_data, file_name):
+        """
+        Encrypt data with trusted zone public key and upload to SwiftStream.
+
+        Appends '.securelock' to filename for identification.
+
+        :param file_data: Data to encrypt and upload.
+        :param file_name: Base name for the uploaded file.
+        """
+        encrypted_input = crypto.encrypt_with_pub_key(self.trusted_zone_public_key, file_data.encode('utf-8'))
+        encrypted_input_base64 = crypto.encrypted_data_to_base64_json(encrypted_input)
+        file_name = file_name + '.securelock'
+        self.__ensure_bucket_exists()
+        data = io.BytesIO(encrypted_input_base64)
+        status, _ = self.__retry_swift_call(self.swift_stream_service.put_file_content, self.etny_bucket,
+                                            file_name,
+                                            "",
+                                            data)
+        if status:
+            print(f'File {file_name} encrypted and saved to swift stream successfully')
+
+    def get_latest_trusted_zone_public_key(self):
+        """
+        Fetch the latest public key for the trusted zone from the image registry contract.
+
+        Uses retry logic with exponential backoff to handle connection issues or timeouts.
+        In Ethernity Cloud, the trusted zone refers to secure enclave images registered on-chain.
+        Caches the key after successful fetch.
+        """
+        if self.trusted_zone_public_key:
+            return  # Already cached
+        print('getting latest public key of the trusted zone enclave')
+        try:
+            result = self.__retry_web3_call(self.image_registry.caller().getLatestTrustedZoneImageCertPublicKey,
+                                            '__TRUSTED_ZONE_IMAGE__', 'v3')
+            self.trusted_zone_public_key = result[1]
+        except Exception as e:
+            print(f"Failed to get trusted zone public key: {e}")
+            self.task_code = TaskStatus.KEY_ERROR
+            self.task_result = 'FAILED TO FETCH TRUSTED ZONE PUBLIC KEY FROM IMAGE REGISTRY'
+
+    def __retry_web3_call(self, fn, *args, **kwargs):
+        """
+        Retry wrapper for Web3 calls with exponential backoff.
+
+        :param fn: The Web3 function to call.
+        :param args: Positional arguments for the function.
+        :param kwargs: Keyword arguments for the function.
+        :return: Result of the function call.
+        """
+        retries = 0
+        max_retries = 500
+        while retries < max_retries:
+            try:
+                return fn(*args, **kwargs)
+            except (requests.exceptions.ConnectionError, requests.exceptions.Timeout, Exception) as e:  # Catch broad for resilience
+                print(f"Web3 call failed: {e}. Retrying in 1 seconds...")
+                time.sleep(1)
+                retries += 1
+        raise Exception(f"Web3 call failed after {max_retries} retries")
+
+    def __retry_swift_call(self, fn, *args, **kwargs):
+        """
+        Retry wrapper for SwiftStream calls with exponential backoff.
+
+        :param fn: The SwiftStream function to call.
+        :param args: Positional arguments for the function.
+        :param kwargs: Keyword arguments for the function.
+        :return: Result of the function call.
+        """
+        retries = 0
+        max_retries = 500
+        while retries < max_retries:
+            try:
+                return fn(*args, **kwargs)
+            except Exception as e:  # Catch broad for resilience
+                print(f"SwiftStream call failed: {e}. Retrying in 1 seconds...")
+                time.sleep(1)
+                retries += 1
+        raise Exception(f"SwiftStream call failed after {max_retries} retries")
+
+    def __ensure_bucket_exists(self):
+        """
+        Ensure the bucket exists in SwiftStream, creating it if necessary.
+
+        Makes the operation idempotent by checking existence first.
+        Assumes swift_stream_service has bucket_exists; if not, wraps create in try-except.
+        """
+        try:
+            # Assuming SwiftStreamService has bucket_exists method; if not, implement via try-create
+            if not self.swift_stream_service.bucket_exists(self.etny_bucket):
+                self.__retry_swift_call(self.swift_stream_service.create_bucket, self.etny_bucket)
+        except AttributeError:
+            # Fallback if bucket_exists not available: try to create and ignore if exists
+            try:
+                self.__retry_swift_call(self.swift_stream_service.create_bucket, self.etny_bucket)
+            except Exception as e:
+                if 'already exists' not in str(e).lower():  # Check for existence error
+                    raise
+
+if __name__ == '__main__':
+    print('[SecureLock] Loading env variables..')
+    try:
+        if EtnySecureLock.debug:
+            swiftStreamClient = SwiftStreamService("localhost:9000",
+                                                   "swiftstreamadmin",
+                                                   "swiftstreamadmin")
+        else:
+            swiftStreamClient = SwiftStreamService("etny-swift-stream:9000",
+                                                   "swiftstreamadmin",
+                                                   "swiftstreamadmin")
+        status, env_content = swiftStreamClient.get_file_content("__BUCKET_NAME__", ".env")
+        if not status:
+            print("Failed to get .env file")
+            raise Exception("Failed to get .env file")
+        EtnySecureLock.read_env_str(env_content)
+    except:
+        cert_file = "/app/__SECURELOCK_SESSION__/cert.pem"
+        with open(cert_file, 'r') as f:
+            print("PUBLIC_CERT:", f.read())
+        exit(1)
+    print('Initializing..')
+    app = EtnySecureLock(swiftStreamClient)
+    print('Validate client payload and input')
+    app.get_latest_trusted_zone_public_key()
+    app.wait_for_payload_and_input()
+    if app.is_valid_client_data:
+        print('Executing client code..')
+        app.execute()
+    else:
+        print('Failed client payload and input validation')
+    app.save_result()
+    print('Finished the execution')

{ethernity_cloud_sdk_py-0.2.45 → ethernity_cloud_sdk_py-0.3.0}/ethernity_cloud_sdk_py/commands/pynithy/build.py

@@ -111,36 +111,36 @@ def clean_up_registry():
 
 def copy_backend_to_build_dir(build_dir):
     # Copy serverless source code (including subdirectories) to the build directory
-    
+
     src_dir = Path.cwd() / "src" / "serverless"
     dest_dir = Path(build_dir) / "securelock" / "src" / "serverless"
-       
+
     # Remove destination directory if it exists to avoid conflicts
     if dest_dir.exists():
         shutil.rmtree(dest_dir)
     
     # Copy entire directory tree
     shutil.copytree(src_dir, dest_dir)
-    
+
     return True
 
 
 def copy_from_module_to_build_dir(build_dir):
     # Copy module files from module dir to build dir
     module_dir = Path(__file__).resolve().parent
-    
+
     build_dir.mkdir(parents=True, exist_ok=True)
 
     scripts_dir = build_dir / "securelock" / "scripts"
     scripts_dir.mkdir(parents=True, exist_ok=True)
 
 
-    src_file = module_dir / "build" / "securelock" / "Dockerfile.base.tpl" 
+    src_file = module_dir / "build" / "securelock" / "Dockerfile.base.tpl"
     dest_file = build_dir / "securelock" / "Dockerfile.base.tpl"
     shutil.copy(src_file, dest_file)
 
-    
-    src_file = module_dir / "build" / "securelock" / "Dockerfile.tpl" 
+
+    src_file = module_dir / "build" / "securelock" / "Dockerfile.tpl"
     dest_file = build_dir / "securelock" / "Dockerfile.tpl"
     shutil.copy(src_file, dest_file)
 
@@ -148,14 +148,14 @@ def copy_from_module_to_build_dir(build_dir):
     dest_file = build_dir / "securelock" / "scripts" / "binary-fs-build.sh"
     shutil.copy(src_file, dest_file)
 
-    src_file = module_dir / "build" / "securelock" / "src" 
+    src_file = module_dir / "build" / "securelock" / "src"
     dest_file = build_dir / "securelock" / "src"
     # Remove dest if it exists (since copytree fails if dest exists)
 
     if dest_file.exists():
         shutil.rmtree(dest_file)
     shutil.copytree(src_file, dest_file)
-    
+
     return True
 
 def update_dockerfile():
@@ -326,7 +326,7 @@ def main():
     
     # Change directory to the build directory
     os.chdir(build_dir)
-    
+
     spinner.spin_till_done("Update dockerfile ", update_dockerfile)
 
     SECURELOCK_SESSION = config.read("SECURELOCK_SESSION")

{ethernity_cloud_sdk_py-0.2.45 → ethernity_cloud_sdk_py-0.3.0}/ethernity_cloud_sdk_py/commands/pynithy/ipfs_client.py

@@ -5,7 +5,7 @@ import json
 import functools
 import random
 from tqdm import tqdm
-from requests.exceptions import RequestException, SSLError 
+from requests.exceptions import RequestException, SSLError
 from requests_toolbelt.multipart.encoder import (
     MultipartEncoder,
     MultipartEncoderMonitor,
@@ -37,7 +37,7 @@ def retry_on_failure(max_attempts=RETRY_COUNT, initial_delay=10, backoff_factor=
             return None
         return wrapper
     return decorator_retry
-    
+
 
 class IPFSClient:
 

{ethernity_cloud_sdk_py-0.2.45 → ethernity_cloud_sdk_py-0.3.0}/ethernity_cloud_sdk_py/templates/src/ethernity_task.py

@@ -45,7 +45,7 @@ def execute_task(code) -> None:
             PASSWORD = getpass.getpass("Enter your private key password:")
             ENC_PRIVATE_KEY = os.getenv("ENC_PRIVATE_KEY")
             pkm = PrivateKeyManager(PASSWORD)
-            PRIVATE_KEY = pkm.decrypt_private_key(ENC_PRIVATE_KEY)
+            PRIVATE_KEY = '0x' + pkm.decrypt_private_key(ENC_PRIVATE_KEY)
             break
         except Exception as e:
             print("Incorrect password. Please try again.")

{ethernity_cloud_sdk_py-0.2.45 → ethernity_cloud_sdk_py-0.3.0/ethernity_cloud_sdk_py.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethernity-cloud-sdk-py
-Version: 0.2.45
+Version: 0.3.0
 Summary: Ethernity Cloud SDK Python
 Home-page: https://github.com/ethernity-cloud/ethernity-cloud-sdk-py
 Author: Ethernity Cloud Team

{ethernity_cloud_sdk_py-0.2.45 → ethernity_cloud_sdk_py-0.3.0}/setup.py

@@ -5,7 +5,7 @@ this_directory = Path(__file__).parent
 long_description = (this_directory / "README.md").read_text()
 setup(
     name="ethernity-cloud-sdk-py",
-    version="0.2.45",
+    version="0.3.0",
     url="https://github.com/ethernity-cloud/ethernity-cloud-sdk-py",
     author="Ethernity Cloud Team",
     author_email="contact@ethernity.cloud",

ethernity_cloud_sdk_py-0.2.45/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/securelock.py.tmpl

@@ -1,429 +0,0 @@
-#!/usr/bin/python
-
-# update 29.12.2022
-import binascii
-import hashlib
-import os
-import re
-import string
-import random
-import io
-import time
-
-from etny_crypto import etny_crypto as crypto
-from web3 import Web3
-from eth_account import Account
-from web3.middleware import geth_poa_middleware
-from key_generation import get_wallet_address
-from etny_exec import execute_task_v3, TaskStatus
-from etny_exec_flask import execute_task_v4, execute_server_v4
-from models import *
-from swift_stream_service import SwiftStreamService
-from eth_account.messages import defunct_hash_message
-
-
-# todo: remove EtnyResultPoc.debug
-class EtnySecureLock:
-    debug = False
-
-    def __init__(self, swiftStreamClient):
-        self.swift_stream_service = swiftStreamClient
-        self.version = 'v3'
-        print(f'ETNY Pynithy [{self.version}]')
-        self.__set_initializers()
-        self.save_pub_cert()
-        self.__load_env()
-        # self.read_client_challenge()
-        # self.generate_challenge()
-        # self.generate_eth_compatible_wallet()
-        # print('wallet = ', self.publickey)
-        # print('private = ', self.privatekey)
-        self.read_contract_abi()
-        self.init_web3()
-        self.print_env()
-        # if not EtnySecureLock.debug:
-        #    self.reset_cert_file()
-
-    @staticmethod
-    def read_env(env_file):
-        with open(env_file, 'r') as f:
-            # Read each line of the file
-            for line in f:
-                # Split the line at the first '=' character
-                key, value = line.split('=', 1)
-                # Set the environment variable
-                os.environ[key] = value
-
-    @staticmethod
-    def read_env_str(env_str):
-        with io.StringIO(env_str) as f:
-            # Read each line of the string
-            for line in f:
-                # Split the line at the first '=' character
-                key, value = line.split('=', 1)
-                # Set the environment variable and remove new line
-                os.environ[key] = re.sub(r'\n', '', value)
-
-    def __extract_signer(self, checksum, signature):
-        signer = self.w3.eth.account.recoverHash(defunct_hash_message(text=checksum), signature=signature)
-
-        return signer
-
-    def __set_initializers(self):
-        self.is_valid_client_data = True
-        self.key_file = "/private/__SECURELOCK_SESSION__/key.pem"
-        self.cert_file = "/app/__SECURELOCK_SESSION__/cert.pem"
-        self.pub_cert_file = "/app/__SECURELOCK_SESSION__/enclave_pub_cert.pem"
-        self.payload = 'payload.etny.securelock'
-        self.input = 'input.txt.securelock'
-        self.result_file = '/app/result.txt'
-        self.transaction_file = '/app/transaction.txt'
-        self.smart_contract_address = '__SMART_CONTRACT_ADDRESS__'
-        self.image_registry_address = '__IMAGE_REGISTRY_ADDRESS__'
-        self.chain_id = __CHAIN_ID__
-        self.web3_provider = '__RPC_URL__'
-        self.etny_bucket = "__BUCKET_NAME__"
-        self.trusted_zone_public_key = ''
-        if EtnySecureLock.debug:
-            self.key_file = "./app/cert1-ca1-clean.key"
-            self.cert_file = "./app/cert1-ca1-clean.crt"
-            self.payload = 'payload.py'
-            self.input = 'input.txt'
-            self.result_file = './app/result.txt'
-            self.transaction_file = './app/transaction.txt'
-            self.pub_cert_file = "./app/enclave_pub_cert.pem"
-            # self.trustedzone_public_key = "./app/enclave_pub_cert.pem"
-
-    def validate_client_payload(self, payload_data, input_data):
-        self.get_do_request_metadata()
-        if self._metadata.payload_metadata_obj.checksum is not None:
-            #print('Computing payload checksum: ')
-            payload_checksum = self.compute_sha256_checksum(payload_data)
-            #print('payload checksum: ', payload_checksum)
-            # check the wallet address that signed payload checksum is the one from order metadata
-            if self._metadata.payload_metadata_obj.checksum.startswith('0x'):
-                checksum_signer = self.__extract_signer(payload_checksum, self._metadata.payload_metadata_obj.checksum)
-                transaction_checksum = payload_checksum
-            else:
-                checksum_signer  = self.order_metadata.do_owner
-                transaction_checksum = self._metadata.payload_metadata_obj.checksum
-                
-
-            if checksum_signer.lower() != self.order_metadata.do_owner.lower() and transaction_checksum != payload_checksum:
-                self.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR
-                self.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH'
-                self.is_valid_client_data = False
-                return
-
-        if self._metadata.input_metadata_obj.checksum is not None:
-            input_checksum = self.compute_sha256_checksum(input_data)
-            #print('input checksum: ', input_checksum)
-            # check the wallet address that signed input checksum is the one from order metadata
-            if self._metadata.input_metadata_obj.checksum.startswith('0x'):
-                checksum_signer = self.__extract_signer(input_checksum, self._metadata.input_metadata_obj.checksum)
-                transaction_checksum = input_checksum
-            else:
-                checksum_signer  = self.order_metadata.do_owner
-                transaction_checksum = self._metadata.input_metadata_obj.checksum
-
-            if checksum_signer.lower() != self.order_metadata.do_owner.lower() and transaction_checksum != input_checksum:
-                self.task_code = TaskStatus.INPUT_CHECKSUM_ERROR
-                self.task_result = 'INPUT CHECKSUM DOESN\'T MATCH'
-                self.is_valid_client_data = False
-                return
-
-    def wait_for_payload_and_input(self):
-        print('Waiting for payload and input')
-        self.wait_for_trustedzone(self.etny_bucket, self.payload)
-        self.wait_for_trustedzone(self.etny_bucket, self.input)
-
-    def wait_for_trustedzone(self, bucket_name, object_name, timeout=3600):
-        i = 0
-        print(f'Checking if object {object_name} exists in bucket {bucket_name}')
-        while True:
-            time.sleep(1)
-            i = i + 1
-            if i > timeout:
-                break
-            (status, result) = self.swift_stream_service.is_object_in_bucket(bucket_name, object_name)
-            if status:
-                break
-
-        print('secure lock finished the execution')
-
-    def get_do_request_metadata(self):
-        order = Order(self.etny.caller()._getOrder(self.order_id), self.order_id)
-        #print('order', order)
-        self._metadata = DOReqMetadata(self.etny.caller()._getDORequestMetadata(order.do_req), order.do_req)
-        self.order_metadata = order
-        #print('metadata', self._metadata)
-
-    def compute_sha256_checksum(self, file_data):
-        if type(file_data) is str:
-            file_data = file_data.encode('utf-8')
-
-        return hashlib.sha256(file_data).hexdigest()
-
-    # h = hashlib.sha256()
-    # file = io.BytesIO(file_data)
-    # while True:
-    # Reading is buffered, so we can read smaller chunks.
-    #     chunk = file.read(h.block_size)
-    #     if not chunk:
-    #        break
-    #    h.update(chunk)
-    #    return h.hexdigest()
-
-    def reset_cert_file(self):
-        #print('Resetting the cert file')
-        try:
-            with open(self.key_file, 'r+') as f:
-                f.truncate(0)
-        except Exception as e:
-            print('Error while removing the private key file content', e)
-
-        #with open(self.key_file, 'r') as f:
-        #    print('cert file content', f.read(), '##################')
-
-    def generate_eth_compatible_wallet(self):
-        decrypted_string = crypto.decrypt(
-            private_key_file=self.key_file,
-            encrypted_msg=self.encrypted_tuple
-        )
-        #print('decrypted_string = ', decrypted_string)
-        (public, private) = get_wallet_address(decrypted_string.decode(), self.enclave_challenge)
-        self.publickey = public
-        self.privatekey = private
-
-    def print_env(self):
-        print('chain id:', self.chain_id)
-        print('smart contract address:', self.smart_contract_address)
-        print('web3 provider:', self.web3_provider)
-        print('encrypted challenge:', self.client_challenge)
-        print('order id:', self.order_id)
-
-    def init_web3(self):
-        self.w3 = Web3(Web3.HTTPProvider(self.web3_provider))
-        self.w3.middleware_onion.inject(geth_poa_middleware, layer=0)
-
-        # self.acct = Account.privateKeyToAccount(self.privatekey)
-        self.etny = self.w3.eth.contract(address=self.w3.toChecksumAddress(self.smart_contract_address),
-                                         abi=self.contract_abi)
-        self.image_registry = self.w3.eth.contract(address=self.w3.toChecksumAddress(self.image_registry_address),
-                                                   abi=self.image_registry_abi)
-
-    def read_contract_abi(self):
-        self.contract_abi = self.__read_contract_abi('pox.abi')
-        self.image_registry_abi = self.__read_contract_abi('image_registry.abi')
-
-    def __read_contract_abi(self, contract_name):
-        f = open(os.path.dirname(os.path.realpath(__file__)) + f'/{contract_name}')
-        contract_abi = f.read()
-        f.close()
-        return contract_abi
-
-    def __load_env(self):
-        if os.getenv('ETNY_CHAIN_ID') is not None:
-            self.chain_id = int(os.getenv('ETNY_CHAIN_ID'))
-
-        if os.getenv('ETNY_SMART_CONTRACT_ADDRESS') is not None:
-            self.smart_contract_address = os.getenv('ETNY_SMART_CONTRACT_ADDRESS').rstrip()
-
-        if os.getenv('ETNY_WEB3_PROVIDER') is not None:
-            self.web3_provider = os.getenv('ETNY_WEB3_PROVIDER').rstrip()
-
-        self.client_challenge = os.getenv('ETNY_CLIENT_CHALLENGE')
-        self.order_id = int(os.getenv('ETNY_ORDER_ID'))
-
-    def read_client_challenge(self):
-        self.encrypted_tuple = crypto.encrypted_data_from_base64_json(self.client_challenge)
-
-    def generate_challenge(self, length=20):
-        lowercase_only = ''.join(
-            random.choice(string.ascii_lowercase) for _ in range(length)
-        )
-        #print('random challenge:', lowercase_only)
-        self.enclave_challenge = lowercase_only
-        return self.enclave_challenge
-
-    def build_result(self):
-        self.result = (f'{self.version}:{self.task_code}:{self.task_result_checksum}:{self.enclave_challenge}:')
-
-    def addResult(self):
-        self.build_result()
-        print(f'adding result to order {self.order_id}')
-        nonce = self.w3.eth.getTransactionCount(self.publickey)
-        unicorn_txn = self.etny.functions._addResultToOrder(
-            self.order_id, self.result
-        ).buildTransaction({
-            'gas': 1000000,
-            'chainId': self.chain_id,
-            'nonce': nonce,
-            'gasPrice': self.w3.toWei("1", "mwei"),
-        })
-
-        signed_txn = self.w3.eth.account.sign_transaction(unicorn_txn, private_key=self.acct.key)
-        self.w3.eth.sendRawTransaction(signed_txn.rawTransaction)
-        # self.transaction = unicorn_tx signed
-        hash = self.w3.toHex(self.w3.sha3(signed_txn.rawTransaction))
-
-        try:
-            receipt = self.w3.eth.waitForTransactionReceipt(hash)
-        except Exception as e:
-            print(f'An error occurred while sending transaction result {self.order_id}: ', e)
-            raise
-
-        #print('transaction status: ', receipt.status)
-        #print('transaction receipt: ', receipt)
-        if receipt.status == 1:
-            print("Result transaction was successful!")
-        else:
-            print("Result transaction was UNSUCCESSFUL!")
-
-        #print("Result payload: %s" % self.result)
-        #print("TX Raw: %s" % signed_txn.rawTransaction)
-        #print("TX Hash: %s" % hash)
-
-    def build_transaction(self):
-        self.build_result()
-        print(f'adding result to order {self.order_id}')
-        nonce = self.w3.eth.getTransactionCount(self.publickey)
-        unicorn_txn = self.etny.functions._addResultToOrder(
-            self.order_id, self.result
-        ).buildTransaction({
-            'gas': 1000000,
-            'chainId': self.chain_id,
-            'nonce': nonce,
-            'gasPrice': self.w3.toWei("1", "mwei"),
-        })
-
-        signed_txn = self.w3.eth.account.sign_transaction(unicorn_txn, private_key=self.acct.key)
-        signed_tx_as_bytes = binascii.hexlify(signed_txn.rawTransaction)
-        self.signed_tx_as_bytes = signed_tx_as_bytes
-
-    def get_result_checksum(self):
-        self.task_result_checksum = hashlib.sha256(self.task_result.encode("utf-8")).hexdigest()
-
-    def save_result(self):
-        self.__get_latest_trusted_zone_public_key()
-        self.encrypt_file_and_push_to_swifstream(str(self.task_result), "result.txt")
-        self.encrypt_file_and_push_to_swifstream(str(self.task_code), "result_code.txt")
-
-    def save_pub_cert(self):
-        self.swift_stream_service.create_bucket(self.etny_bucket)
-        self.swift_stream_service.put_file_content(self.etny_bucket,
-                                                   "cert.pem",
-                                                   self.cert_file)
-
-    def save_transaction(self):
-        self.swift_stream_service.create_bucket(self.etny_bucket)
-        transaction = io.BytesIO(self.signed_tx_as_bytes)
-        self.swift_stream_service.put_file_content(self.etny_bucket,
-                                                   "transaction.txt",
-                                                   self.transaction_file,
-                                                   transaction)
-
-    def execute(self):
-        payload_data = self.__get_file_content_and_decrypt(self.payload)
-        input_data = self.__get_file_content_and_decrypt(self.input)
-        print('Validate client payload and input')
-        self.validate_client_payload(payload_data, input_data)
-        if app.is_valid_client_data:
-            print('Client payload and input are valid')
-        else:
-            print('Client payload and input are NOT valid')
-            return
-
-        if self._metadata._payload_metadata_obj._version == 'v3':
-            task_result = execute_task_v3(payload_data, input_data)
-        else:
-            task_result = execute_server_v4(payload_data, input_data)
-
-        self.task_code = str(task_result[0])
-        self.task_result = task_result[1]
-
-    def __get_file_content_and_decrypt(self, object_name):
-        status, encrypted_base64 = self.swift_stream_service.get_file_content(self.etny_bucket, object_name)
-        if not status:
-            print(f'Failed to get {object_name} file')
-            raise Exception(f'Failed to get {object_name} file')
-
-        encrypted_tuple = crypto.encrypted_data_from_base64_json(encrypted_base64.encode('utf-8'))
-        decrypted_result = crypto.decrypt(self.key_file, encrypted_tuple)
-        return decrypted_result.decode('utf-8')
-
-    def encrypt_file_and_push_to_swifstream(self, file_data, file_name):
-        encrypted_input = crypto.encrypt_with_pub_key(self.trusted_zone_public_key, file_data.encode('utf-8'))
-        encrypted_input_base64 = crypto.encrypted_data_to_base64_json(encrypted_input)
-
-        # file name should end with secure lock '.securelock' extension
-        file_name = file_name + '.securelock'
-        self.swift_stream_service.create_bucket(self.etny_bucket)
-        data = io.BytesIO(encrypted_input_base64)
-        status, _ = self.swift_stream_service.put_file_content(self.etny_bucket,
-                                                               file_name,
-                                                               "",
-                                                               data)
-        if status:
-            print(f'File {file_name} encrypted and saved to swift stream successfully')
-
-    def __get_trusted_zone_public_key(self):
-        print('getting the public key of the trusted zone enclave')
-        image_hash = self._metadata.image_hash
-        if EtnySecureLock.debug:
-            image_hash = 'v3-hash-1'
-        self.trusted_zone_public_key = self.image_registry.caller().getTrustedZoneImageCertPublicKey(
-            image_hash)
-
-    def __get_latest_trusted_zone_public_key(self):
-        print('getting latest public key of the trusted zone enclave')
-        self.trusted_zone_public_key = self.image_registry.caller().getLatestTrustedZoneImageCertPublicKey(
-            '__TRUSTED_ZONE_IMAGE__', 'v3')[1]
-
-
-if __name__ == '__main__':
-    print('[SecureLock] Loading env variables..')
-    try:
-        if EtnySecureLock.debug:
-            swiftStreamClient = SwiftStreamService("localhost:9000",
-                                                   "swiftstreamadmin",
-                                                   "swiftstreamadmin")
-        else:
-            swiftStreamClient = SwiftStreamService("etny-swift-stream:9000",
-                                                   "swiftstreamadmin",
-                                                   "swiftstreamadmin")
-
-        status, env_content = swiftStreamClient.get_file_content("__BUCKET_NAME__", ".env")
-        if not status:
-            print("Failed to get .env file")
-            raise Exception("Failed to get .env file")
-        EtnySecureLock.read_env_str(env_content)
-    except:
-        cert_file = "/app/__SECURELOCK_SESSION__/cert.pem"
-        with open(cert_file, 'r') as f:
-            print("PUBLIC_CERT:", f.read())
-        exit(1)
-
-    #if not EtnySecureLock.debug:
-    #    with open("/app/__SECURELOCK_SESSION__/cert.pem", 'r') as f:
-    #        print("PUBLIC_CERT:", f.read())
-
-    print('Initializing..')
-    app = EtnySecureLock(swiftStreamClient)
-    print('Validate client payload and input')
-    app.wait_for_payload_and_input()
-
-    if app.is_valid_client_data:
-        print('Executing client code..')
-        app.execute()
-    else:
-        print('Failed client payload and input validation')
-    # print('Generating task result checksum..')
-    # app.get_result_checksum()
-    # print('Building transaction..')
-    # app.build_transaction()
-    # print('Saving transaction...')
-    # app.save_transaction()
-    # print('Saving the result..')
-    app.save_result()
-    print('Finished the execution')