Skip to content

Commit 3c7657b

Browse files
author
Volara
committed
Migrate validator to use TDX
1 parent a664b92 commit 3c7657b

File tree

6 files changed

+93
-283
lines changed

6 files changed

+93
-283
lines changed
+57-112
Original file line numberDiff line numberDiff line change
@@ -1,112 +1,57 @@
1-
name: Build and Release
2-
3-
on:
4-
push:
5-
branches: [main]
6-
pull_request:
7-
branches: [main]
8-
9-
permissions:
10-
contents: write
11-
12-
jobs:
13-
build-and-release:
14-
runs-on: ubuntu-latest
15-
steps:
16-
- uses: actions/checkout@v3
17-
18-
- name: Set up Python
19-
uses: actions/setup-python@v4
20-
with:
21-
python-version: "3.11"
22-
23-
- name: Set up Docker Buildx
24-
uses: docker/setup-buildx-action@v2
25-
26-
- name: Build Docker image
27-
uses: docker/build-push-action@v4
28-
with:
29-
context: .
30-
load: true
31-
tags: |
32-
volara-proof:${{ github.run_number }}
33-
volara-proof:latest
34-
cache-from: type=gha
35-
cache-to: type=gha,mode=max
36-
37-
- name: Clone and set up GSC
38-
run: |
39-
git clone https://github.com/gramineproject/gsc.git
40-
cd gsc
41-
python3 -m pip install --no-cache-dir 'docker>=7.1.0' 'jinja2>=3.1.4' 'tomli>=2.0.1' 'tomli-w>=1.0.0' 'pyyaml>=6.0.2'
42-
43-
- name: Create signing key
44-
run: |
45-
echo "${{ secrets.SIGNING_KEY }}" > signing_key.pem
46-
chmod 600 signing_key.pem
47-
48-
- name: Build GSC image
49-
run: |
50-
cd gsc
51-
./gsc build volara-proof ../volara-proof.manifest.template -c ../config.yaml
52-
53-
- name: Sign GSC image
54-
run: |
55-
cd gsc
56-
./gsc sign-image volara-proof ../signing_key.pem -c ../config.yaml
57-
58-
- name: Export GSC image to file
59-
run: |
60-
docker save gsc-volara-proof:latest | gzip > gsc-volara-proof-${{ github.run_number }}.tar.gz
61-
62-
- name: Generate verification data
63-
run: |
64-
cd gsc
65-
./gsc info-image gsc-volara-proof > ../sigstruct.txt
66-
67-
- name: Upload image
68-
uses: actions/upload-artifact@v3
69-
with:
70-
name: gsc-volara-proof-image
71-
path: gsc-volara-proof-${{ github.run_number }}.tar.gz
72-
73-
- name: Upload verification data
74-
uses: actions/upload-artifact@v3
75-
with:
76-
name: gsc-volara-proof-sigstruct
77-
path: sigstruct.txt
78-
79-
- name: Generate release body
80-
run: |
81-
echo "MRSIGNER: $(grep -oP 'mr_signer = "\K[^"]*' sigstruct.txt)" >> release_body.txt
82-
echo "MRENCLAVE: $(grep -oP 'mr_enclave = "\K[^"]*' sigstruct.txt)" >> release_body.txt
83-
echo "Image SHA256: $(sha256sum gsc-volara-proof-${{ github.run_number }}.tar.gz | cut -d' ' -f1)" >> release_body.txt
84-
85-
- name: Create Release and Upload Assets
86-
uses: softprops/action-gh-release@v1
87-
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
88-
env:
89-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90-
with:
91-
tag_name: v${{ github.run_number }}
92-
name: Release v${{ github.run_number }}
93-
body_path: release_body.txt
94-
draft: false
95-
prerelease: false
96-
files: |
97-
./gsc-volara-proof-${{ github.run_number }}.tar.gz
98-
./sigstruct.txt
99-
100-
- name: Cleanup signing key
101-
if: always()
102-
run: |
103-
rm -f signing_key.pem
104-
105-
- name: Log build result
106-
if: always()
107-
run: |
108-
if [ ${{ job.status }} == "success" ]; then
109-
echo "Build and release completed successfully"
110-
else
111-
echo "Build and release failed"
112-
fi
1+
build-and-release:
2+
runs-on: ubuntu-latest
3+
steps:
4+
- uses: actions/checkout@v3
5+
6+
- name: Set up Python
7+
uses: actions/setup-python@v4
8+
with:
9+
python-version: "3.11"
10+
11+
- name: Set up Docker Buildx
12+
uses: docker/setup-buildx-action@v2
13+
14+
- name: Build Docker image
15+
uses: docker/build-push-action@v4
16+
with:
17+
context: .
18+
load: true
19+
tags: |
20+
volara-proof:${{ github.run_number }}
21+
volara-proof:latest
22+
cache-from: type=gha
23+
cache-to: type=gha,mode=max
24+
25+
- name: Export image to file
26+
run: |
27+
docker save volara-proof:latest | gzip > volara-proof-${{ github.run_number }}.tar.gz
28+
- name: Generate release body
29+
run: |
30+
echo "Image SHA256: $(sha256sum volara-proof-${{ github.run_number }}.tar.gz | cut -d' ' -f1)" >> release_body.txt
31+
- name: Upload image
32+
uses: actions/upload-artifact@v3
33+
with:
34+
name: volara-proof-image
35+
path: volara-proof-${{ github.run_number }}.tar.gz
36+
37+
- name: Create Release and Upload Assets
38+
uses: softprops/action-gh-release@v1
39+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
with:
43+
tag_name: v${{ github.run_number }}
44+
name: Release v${{ github.run_number }}
45+
body_path: release_body.txt
46+
draft: false
47+
prerelease: false
48+
files: |
49+
./volara-proof-${{ github.run_number }}.tar.gz
50+
- name: Log build result
51+
if: always()
52+
run: |
53+
if [ ${{ job.status }} == "success" ]; then
54+
echo "Build and release completed successfully"
55+
else
56+
echo "Build and release failed"
57+
fi

Dockerfile

-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ FROM python:3.12-slim
33
# Install any Python dependencies your application needs, e.g.:
44
RUN pip install --no-cache-dir requests
55

6-
RUN mkdir /sealed && chmod 777 /sealed
7-
86
WORKDIR /app
97

108
COPY . /app

README.md

+35-78
Original file line numberDiff line numberDiff line change
@@ -28,110 +28,64 @@ This template provides a basic structure for building proof tasks that:
2828
}
2929
```
3030

31-
The project is designed to work with [Gramine](https://gramine.readthedocs.io/en/latest/), a lightweight library OS that enables running unmodified applications in secure enclaves, such as Intel SGX (Software Guard Extensions). This allows the code to run in a trusted execution environment, ensuring confidentiality and integrity of the computation.
31+
The project is designed to work with Intel TDX (Trust Domain Extensions), providing hardware-level isolation and security guarantees for confidential computing workloads.
3232

3333
## Project Structure
3434

35-
- `volara_proof/`: Contains the main proof logic
35+
- `my_proof/`: Contains the main proof logic
3636
- `proof.py`: Implements the proof generation logic
3737
- `__main__.py`: Entry point for the proof execution
38+
- `models/`: Data models for the proof system
3839
- `demo/`: Contains sample input and output for testing
39-
- `.github/workflows/`: CI/CD pipeline for building and releasing
4040
- `Dockerfile`: Defines the container image for the proof task
41-
- `volara-proof.manifest.template`: Gramine manifest template for running securely in an Intel SGX enclave
42-
- `config.yaml`: Configuration file for Gramine Shielded Containers (GSC)
41+
- `requirements.txt`: Python package dependencies
4342

4443
## Getting Started
4544

4645
To use this template:
4746

4847
1. Fork this repository
49-
2. Modify the `volara_proof/proof.py` file to implement your specific proof logic
50-
3. Update the `volara-proof.manifest.template` if you need to add any additional files or change the configuration
48+
2. Modify the `my_proof/proof.py` file to implement your specific proof logic
49+
3. Update the project dependencies in `requirements.txt` if needed
5150
4. Commit your changes and push to your repository
5251

5352
## Customizing the Proof Logic
5453

55-
The main proof logic is implemented in `volara_proof/proof.py`. To customize it, update the `Proof.generate()` function to change how input files are processed.
54+
The main proof logic is implemented in `my_proof/proof.py`. To customize it, update the `Proof.generate()` function to change how input files are processed.
5655

57-
The proof can be configured using environment variables. When running in an enclave, the environment variables must be defined in the `volara-proof.manifest.template` file as well. The following environment variables are used for this demo proof:
56+
The proof can be configured using environment variables:
5857

59-
- `COOKIES`: The cookies for the data contributor
58+
- `USER_EMAIL`: The email address of the data contributor, to verify data ownership
59+
60+
If you want to use a language other than Python, you can modify the Dockerfile to install the necessary dependencies and build the proof task in the desired language.
6061

6162
## Local Development
6263

63-
To run the proof locally, without Gramine, you can use Docker:
64+
To run the proof locally for testing, you can use Docker:
6465

65-
```
66-
docker build -t volara-proof .
66+
```bash
67+
docker build -t my-proof .
6768
docker run \
68-
--rm \
69-
--volume $(pwd)/demo/sealed:/sealed \
70-
--volume $(pwd)/demo/input:/input \
71-
--volume $(pwd)/demo/output:/output \
72-
--env USER_EMAIL=user123@gmail.com \
73-
volara-proof
69+
--rm \
70+
--volume $(pwd)/input:/input \
71+
--volume $(pwd)/output:/output \
72+
--env USER_EMAIL=user123@gmail.com \
73+
my-proof
7474
```
7575

76-
## Building and Releasing
77-
78-
This template includes a GitHub Actions workflow that automatically:
79-
80-
1. Builds a Docker image with your code
81-
2. Creates a Gramine-shielded container (GSC) image
82-
3. Publishes the GSC image as a GitHub release
83-
84-
**Important:** To use this workflow, you must generate a signing key and add it to your GitHub secrets. Follow these steps:
85-
86-
1. Generate a signing key (see instructions below)
87-
2. Add the key as a GitHub secret named `SIGNING_KEY`
88-
3. Push your changes to the `main` branch or create a pull request
89-
90-
### Generating the Gramine Signing Key (Required)
91-
92-
Before building and signing your graminized Docker image, you must generate a signing key. This key is crucial for creating secure SGX enclaves. Here's how to generate it:
93-
94-
1. If you have Gramine installed:
95-
96-
```
97-
gramine-sgx-gen-private-key enclave-key.pem
98-
```
99-
100-
2. If you don't have Gramine, use OpenSSL:
101-
102-
```
103-
openssl genrsa -3 -out enclave-key.pem 3072
104-
```
76+
## Running with Intel TDX
10577

106-
After generating the key:
78+
Intel TDX (Trust Domain Extensions) provides hardware-based memory encryption and integrity protection for virtual machines. To run this container in a TDX-enabled environment, follow your infrastructure provider's specific instructions for deploying confidential containers.
10779

108-
1. Keep this key secure, as it will be used to sign your enclaves.
109-
2. Add the contents of `enclave-key.pem` as a GitHub secret named `SIGNING_KEY`.
80+
Common volume mounts and environment variables:
11081

111-
This key is essential for the `gsc sign-image` step in the GSC workflow.
112-
113-
## Running with SGX
114-
115-
Intel SGX (Software Guard Extensions) is a set of security-related instruction codes built into modern Intel CPUs. It allows parts of a program to be executed in a secure enclave, isolated from the rest of the system.
116-
117-
To load a released image with docker, copy the URL from the release and run:
118-
119-
```
120-
curl -L https://address/of/gsc-volara-proof.tar.gz | docker load
121-
```
122-
123-
To run the image:
124-
125-
```
82+
```bash
12683
docker run \
127-
--rm \
128-
--volume /gsc-volara-proof/input:/input \
129-
--volume /gsc-volara-proof/output:/output \
130-
--device /dev/sgx_enclave:/dev/sgx_enclave \
131-
--volume /var/run/aesmd:/var/run/aesmd \
132-
--volume /mnt/gsc-volara-proof/sealed:/sealed \
133-
--env USER_EMAIL=user123@gmail.com \
134-
gsc-volara-proof
84+
--rm \
85+
--volume /path/to/input:/input \
86+
--volume /path/to/output:/output \
87+
--env USER_EMAIL=user123@gmail.com \
88+
my-proof
13589
```
13690

13791
Remember to populate the `/input` directory with the files you want to process.
@@ -140,10 +94,13 @@ Remember to populate the `/input` directory with the files you want to process.
14094

14195
This template leverages several security features:
14296

143-
1. **Secure Enclaves**: The proof runs inside an SGX enclave, isolating it from the rest of the system.
144-
2. **Encrypted Storage**: The `/sealed` directory is automatically encrypted/decrypted by Gramine, providing secure storage for sensitive data.
145-
3. **Input/Output Isolation**: Input and output directories are mounted separately, ensuring clear data flow boundaries.
146-
4. **Minimal Attack Surface**: The Gramine manifest limits the files and resources accessible to the enclave, reducing potential vulnerabilities.
97+
1. **Hardware-based Isolation**: The proof runs inside a TDX-protected environment, isolating it from the rest of the system
98+
2. **Input/Output Isolation**: Input and output directories are mounted separately, ensuring clear data flow boundaries
99+
3. **Minimal Container**: Uses a minimal Python base image to reduce attack surface
100+
101+
## Customization
102+
103+
Feel free to modify any part of this template to fit your specific needs. The goal is to provide a starting point that can be easily adapted to various proof tasks.
147104

148105
## Contributing
149106

config.yaml

-55
This file was deleted.

0 commit comments

Comments
 (0)