ethernity-cloud-sdk-py 0.3.0__tar.gz → 0.3.2__tar.gz

{ethernity_cloud_sdk_py-0.3.0/ethernity_cloud_sdk_py.egg-info → ethernity_cloud_sdk_py-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethernity-cloud-sdk-py
-Version: 0.3.0
+Version: 0.3.2
 Summary: Ethernity Cloud SDK Python
 Home-page: https://github.com/ethernity-cloud/ethernity-cloud-sdk-py
 Author: Ethernity Cloud Team

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/Dockerfile.base.tpl

@@ -18,3 +18,4 @@ RUN pip3 install pyinstaller
 RUN pip3 install pyngrok
 RUN pip3 install flask
 RUN pip3 install flask_limiter
+RUN pip3 install ecdsa

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/Dockerfile.tpl

@@ -1,3 +1,9 @@
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers AS build-sgx-module
+
+COPY src/get_sgx_report.c /etny-securelock/
+
+RUN cd /etny-securelock/ && scone-gcc -shared -fPIC -O3 -o get_sgx_report.so get_sgx_report.c
+
 FROM etny-securelock-serverless AS release
 
 COPY ./src/serverless/requirements.txt /requirements.txt
@@ -11,12 +17,15 @@ ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
 ENV RPC_URL=__RPC_URL__
 ENV CHAIN_ID=__CHAIN_ID__
 ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
+ENV NETWORK_TYPE=__NETWORK_TYPE__
 
 RUN mkdir binary-fs-dir
 
 COPY ./src /etny-securelock/
 COPY ./scripts/* /etny-securelock/
 
+COPY --from=build-sgx-module  /etny-securelock/get_sgx_report.so /etny-securelock/get_sgx_report.so
+
 RUN /etny-securelock/binary-fs-build.sh
 
 FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers AS build
@@ -38,12 +47,13 @@ RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
 ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
 ENV SCONE_LOG=FATAL
+ENV SCONE_DEBUG=0
 ENV SCONE_STACK=4M
-ENV SCONE_ALLOW_DLOPEN=1
+ENV SCONE_ALLOW_DLOPEN=2
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
 
 # Disabled production mode for testnet
-# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/local/bin/python3
+__SCONE_SIGN__
 
 RUN rm -rf /enclave-key.pem
 

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/scripts/binary-fs-build.sh

@@ -11,6 +11,7 @@ sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.py.
 sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.py.tmp
 sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.py.tmp
 sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.py.tmp
+sed -i "s/__NETWORK_TYPE__/${NETWORK_TYPE}/g" securelock.py.tmp
 mv securelock.py.tmp securelock.py
 
 pyinstaller securelock.py

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/etny_crypto.py

@@ -13,6 +13,9 @@ from tinyec import ec
 from Crypto.PublicKey import ECC
 from nacl.public import Box, PrivateKey, PublicKey
 from base64 import a85encode
+from eth_account import  Account
+import ecdsa
+from ecdsa.util import sigencode_der, sigdecode_der
 
 
 class etny_crypto:
@@ -44,7 +47,7 @@ class etny_crypto:
         return (ciphertext, nonce, auth_tag, cipher_text_public_key)
 
     @staticmethod
-    def decrypt_ase_gcm(ciphertext, nonce, auth_tag, secret_key):
+    def decrypt_aes_gcm(ciphertext, nonce, auth_tag, secret_key):
         aes_cipher = AES.new(secret_key, AES.MODE_GCM, nonce)
         plaintext = aes_cipher.decrypt_and_verify(ciphertext, auth_tag)
         return plaintext
@@ -54,7 +57,7 @@ class etny_crypto:
         (ciphertext, nonce, authTag, ciphertextPubKey) = encrypted_msg
         shared_ecc_key = priv_key * ciphertextPubKey
         secret_key = etny_crypto.ecc_point_to_256_bit_key(shared_ecc_key)
-        plaintext = etny_crypto.decrypt_ase_gcm(ciphertext, nonce, authTag, secret_key)
+        plaintext = etny_crypto.decrypt_aes_gcm(ciphertext, nonce, authTag, secret_key)
         return plaintext
 
     @staticmethod
@@ -88,12 +91,8 @@ class etny_crypto:
         return private_key_data
 
     @staticmethod
-    def decrypt(private_key_file, encrypted_msg):
-        # Reading and calculating Private Key from PEM
-        with open(private_key_file) as f:
-            private_key_data = str.encode(f.read())
-
-        private_key_data = etny_crypto.clean_private_key(private_key_data)
+    def decrypt(private_key_pem, encrypted_msg):
+        private_key_data = etny_crypto.clean_private_key(private_key_pem)
         # decode der with asn1 library
         # - get the octet string (field-2) containing the raw key
         asn1_object, _ = decoder.decode(private_key_data)
@@ -159,9 +158,51 @@ class etny_crypto:
         result = bytes(emph_key.public_key) + ciphertext
         return result.hex()
 
+    @staticmethod
+    def get_private_key_int(private_key_pem: bytes) -> int:
+        """
+        Extracts the raw private key integer from a PEM-encoded private key via ASN.1 decoding.
+        Args:
+            private_key_pem (bytes): PEM-encoded private key.
+        Returns:
+            int: The private key scalar.
+        """
+        private_key = etny_crypto.clean_private_key(private_key_pem)
+        asn1_object, _ = decoder.decode(private_key)
+        raw_keys = asn1_object.getComponentByName('field-2').asOctets()
+        asn1_object, _ = decoder.decode(raw_keys)
+        private_key_bytes = asn1_object.getComponentByName('field-1').asOctets()
+        return int.from_bytes(private_key_bytes, byteorder="big")
 
-if __name__ == '__main__':
-    encrypted_msg_ = etny_crypto.encrypt('./app/cert1-ca1-clean.crt', b'test')
-    #print(encrypted_msg_)
-    # etny_crypto.decrypt('./certs/cert1-ca1-clean.key', encrypted_msg_)
-    #print(etny_crypto.encrypted_data_to_base64_json(encrypted_msg_))
+    @staticmethod
+    def sign_data(private_key_pem: bytes, data: bytes) -> bytes:
+        """
+        Signs data using the private key with ECDSA (secp384r1, SHA-256) and returns DER-encoded signature.
+        Args:
+            private_key_pem (bytes): PEM-encoded private key.
+            data (bytes): Data to sign.
+        Returns:
+            bytes: DER-encoded signature.
+        """
+        priv_int = etny_crypto.get_private_key_int(private_key_pem)
+        sk = ecdsa.SigningKey.from_secret_exponent(priv_int, curve=ecdsa.curves.NIST384p, hashfunc=hashlib.sha256)
+        sig_der = sk.sign_deterministic(data, hashfunc=hashlib.sha256, sigencode=sigencode_der)
+        return sig_der
+
+    @staticmethod
+    def verify_signature(public_key_hex: str, data: bytes, sig_der: bytes) -> bool:
+        if public_key_hex.startswith('0x'):
+            public_key_hex = public_key_hex[2:]
+        pub_bytes = bytes.fromhex(public_key_hex)
+        curve = ecdsa.curves.NIST384p
+        try:
+            vk = ecdsa.VerifyingKey.from_string(
+                pub_bytes,
+                curve=curve,
+                hashfunc=hashlib.sha256,
+                valid_encodings={"raw", "compressed", "uncompressed", "hybrid"}  # Add 'raw' here
+            )
+            assert vk.verify(sig_der, data, hashfunc=hashlib.sha256, sigdecode=sigdecode_der)
+            return True
+        except:
+            return False

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/etny_exec.py

@@ -33,14 +33,12 @@ class TaskStatus:
     INPUT_CHECKSUM_ERROR = 7
     EXECVE = 8
 
-
 def execute_task_v3(payload_data, input_data, extra_globals=None):
     base_globals = {"___etny_result___": ___etny_result___, **sdkFunctions}
     if extra_globals:
         base_globals.update(extra_globals)
     return Exec(payload_data, input_data, globals=base_globals)
 
-
 def Exec(payload_data, input_data, globals=None, locals=None):
     try:
         if globals is None:

ethernity_cloud_sdk_py-0.3.2/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/get_sgx_report.c

@@ -0,0 +1,142 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+// Define sgx_status_t as uint32_t (from public SGX docs)
+typedef uint32_t sgx_status_t;
+#define SGX_SUCCESS 0x0000
+#define SGX_ERROR_UNEXPECTED 0x0001 // Add other error codes as needed
+// Function to generate report using inline assembly (invokes ENCLU[EREPORT])
+sgx_status_t generate_sgx_report(const void* target_info, const void* report_data, void* report) {
+    sgx_status_t status;
+    __asm__ volatile (
+        "movl $0, %%eax;\n\t"  // Set EAX = 0 (EREPORT leaf)
+        "enclu;\n\t"
+        : "=a" (status) // Output: status from RAX (EAX for 32-bit)
+        : "b" (target_info), // RBX = address of target_info
+          "c" (report_data), // RCX = address of report_data
+          "d" (report) // RDX = address of report (output)
+        : "memory", "cc" // Clobbers: memory and condition codes (if affected)
+    );
+    return status;
+}
+// Function to convert byte array to hex string (uses static buffer to avoid malloc)
+const char* bytes_to_hex(const uint8_t* buf, size_t len) {
+    static char hex_buffer[65]; // 32 bytes -> 64 chars + null
+    if (len != 32) return NULL;
+    for (size_t i = 0; i < len; ++i) {
+        sprintf(hex_buffer + 2 * i, "%02x", buf[i]);
+    }
+    hex_buffer[64] = '\0';
+    return hex_buffer;
+}
+const char* get_mr_enclave() {
+    // Stack allocation with required alignments
+    uint8_t target_info[512] __attribute__((aligned(512)));
+    uint8_t report_data[64] __attribute__((aligned(128)));
+    uint8_t report[432] __attribute__((aligned(512)));
+    // Zero-initialize for a simple self-report (target_info all zeros means report for current enclave)
+    memset(target_info, 0, sizeof(target_info));
+    memset(report_data, 0, sizeof(report_data));
+    memset(report, 0, sizeof(report));
+    // Generate the report
+    sgx_status_t status = generate_sgx_report(target_info, report_data, report);
+    if (status == SGX_SUCCESS) {
+        // Extract mr_enclave from correct offset (bytes 64-96 in sgx_report_t)
+        return bytes_to_hex(report + 64, 32);
+    }
+    return NULL;
+}
+// Helper function for left rotation of uint8_t
+static inline uint8_t rotl(uint8_t x, uint8_t n) {
+    return (x << n) | (x >> (8 - n));
+}
+// Obfuscated function to generate a deterministic 32-byte string based on MR_ENCLAVE
+void generate_obfuscated_string(const uint8_t* mr_enclave, uint8_t* output) {
+    uint8_t temp[32];
+    memcpy(temp, mr_enclave, 32);
+    // Initial bogus mix to alter even indices (different constant for variety)
+    for (int j = 0; j < 32; j += 2) {
+        temp[j] ^= 0xA7;  // Arbitrary XOR, changed from original
+    }
+    // PRNG state for deterministic pseudo-random mixing (LCG parameters from PCG for good period)
+    uint64_t prng_state = 0x853C49E6748FBA28ULL;  // Arbitrary fixed seed
+    const uint64_t multiplier = 6364136223846793005ULL;
+    const uint64_t increment = 1442695040888963407ULL;
+    // High iteration count for debugger tedium (increased from original)
+    const int max_iter = 1024;
+    uint8_t mix_var = 0;
+    for (int iter = 0; iter < max_iter; iter++) {
+        // Opaque predicate (always false for integer iter >=0, as discriminant isn't perfect square)
+        // Checked more frequently than original for added conditional branching tedium
+        if (iter % 3 == 0) {
+            if ((5 * iter * iter + 2) == (iter * 4)) {
+                // Dead path: never executed, but confuses control flow analysis
+                memset(temp, 0xFF, 32);
+                iter = max_iter;  // Bogus exit
+            }
+        }
+        // Advance PRNG and get mix type (0-3)
+        prng_state = prng_state * multiplier + increment;
+        uint8_t mix_type = (prng_state >> 59) % 4;  // Use higher bits for better distribution
+        // Advance and get three indices (0-31)
+        prng_state = prng_state * multiplier + increment;
+        uint8_t idx1 = (prng_state >> 59) % 32;
+        prng_state = prng_state * multiplier + increment;
+        uint8_t idx2 = (prng_state >> 59) % 32;
+        prng_state = prng_state * multiplier + increment;
+        uint8_t idx3 = (prng_state >> 59) % 32;
+        // Variable mixing operations based on type (different from original mixes)
+        switch (mix_type) {
+            case 0:  // Addition with wrap, then XOR (uses three indices)
+                mix_var = (temp[idx1] + temp[idx2] + temp[idx3]) & 0xFF;
+                temp[idx1] ^= mix_var;
+                break;
+            case 1: {  // Dynamic rotation left, then subtract
+                uint8_t shift = (temp[idx3] % 8) + 1;  // Avoid zero shift
+                temp[idx1] = rotl(temp[idx1], shift);
+                temp[idx1] = (temp[idx1] - temp[idx2]) & 0xFF;
+                break;
+            }
+            case 2:  // XOR chain across indices
+                temp[idx1] ^= temp[idx2];
+                temp[idx2] ^= temp[idx3];
+                temp[idx3] ^= temp[idx1];
+                break;
+            case 3: {  // Multiply-like (shift-add) with wrap, then rotate right
+                uint8_t rshift = temp[idx2] % 8;
+                mix_var = ((temp[idx1] << 1) + temp[idx2]) & 0xFF;
+                temp[idx1] = mix_var ^ temp[idx3];
+                temp[idx1] = (temp[idx1] >> rshift) | (temp[idx1] << (8 - rshift));
+                break;
+            }
+        }
+        // Additional bogus conditional (always true, nested for extra stepping)
+        if ((iter * iter % 2) != 1) {  // Always true for even/odd pattern, but simple
+            // No-op path, but adds branch
+        } else {
+            // Dead, never hit
+            temp[0] = 0;
+        }
+    }
+    memcpy(output, temp, 32);
+}
+const char* get_mr_signer() {
+    // Stack allocation with required alignments
+    uint8_t target_info[512] __attribute__((aligned(512)));
+    uint8_t report_data[64] __attribute__((aligned(128)));
+    uint8_t report[432] __attribute__((aligned(512)));
+    // Zero-initialize for a simple self-report (target_info all zeros means report for current enclave)
+    memset(target_info, 0, sizeof(target_info));
+    memset(report_data, 0, sizeof(report_data));
+    memset(report, 0, sizeof(report));
+    // Generate the report
+    sgx_status_t status = generate_sgx_report(target_info, report_data, report);
+    if (status == SGX_SUCCESS) {
+        // Extract mr_enclave from correct offset (bytes 64-96 in sgx_report_t) for obfuscation
+        uint8_t output[32];
+        generate_obfuscated_string(report + 64, output);
+        return bytes_to_hex(output, 32);
+    }
+    return NULL;
+}

{ethernity_cloud_sdk_py-0.3.0 → ethernity_cloud_sdk_py-0.3.2}/ethernity_cloud_sdk_py/commands/pynithy/build/securelock/src/models.py

@@ -1,3 +1,20 @@
+"""
+Module: models.py
+
+This module defines data models and factories for handling orders and metadata in a blockchain-based task processing system. It includes classes for orders, base metadata, versioned payload and input metadata (V0 and V3), and factories to create metadata objects based on version strings. Additionally, it provides a class for DO (Data Owner?) request metadata, parsing and exposing properties like image hash, public key, and node address. The models support versioning, with V3 including checksums (potentially signed) for integrity verification.
+
+Key Features:
+- Order model: Represents blockchain orders with attributes like owner, processor, requests, and status.
+- Metadata base and subclasses: Abstract base for metadata with version, IPFS hash, and optional checksum; V0 is hash-only, V3 includes checksum.
+- Factories: Dynamically create versioned metadata objects from strings (e.g., "v3:hash:checksum").
+- DOReqMetadata: Parses request metadata into accessible properties, integrating with factories for payload/input objects.
+- No external dependencies beyond standard Python.
+
+Usage Context: Used in trustedzone.py to fetch and parse order/request metadata from smart contracts, enabling validation and processing in secure environments like Ethernity/Etny.
+
+Potential Security Notes: Checksums in V3 can be signed (0x-prefixed), but validation logic is external (e.g., in trustedzone.py). Assumes metadata strings are trusted from blockchain; malformed inputs could raise ValueError.
+"""
+
 class Order:
     def __init__(self, req, order_id):
         self.id = order_id
@@ -141,6 +158,10 @@ class DOReqMetadata:
     def image_hash(self):
         return self.image_metadata.split(':')[1]
 
+    @property
+    def trustedzone_image_name(self):
+        return self.image_metadata.split(':')[2]
+
     @property
     def payload_metadata(self):
         return self._metadata2
@@ -161,17 +182,3 @@ class DOReqMetadata:
     def node_address(self):
         return self._metadata4
 
-
-# add_do_req(..., 'v3:image_:....:...:', 'v3:payload_hash:checksum', 'v3::0', 'node_address')
-'''
-input + payload
-v0: 'ipfs_hash'
-v3: 'v3:file_ipfs_hash:file_checksum'
-
-image
-v0: 'ipfs_hash:image_name'
-v3: 'v3:image_ipfs_hash:image_name:docker_Compose_ipfs_hash:client_challenge_ipfs_hash:client_public_cert'
-'''
-if __name__ == '__main__':
-    obj = PayloadFactory.create_payload_metadata('v3:some_img_hash:fucker')
-    obj2 = PayloadFactory.create_payload_metadata('must not!')