You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+35-78
Original file line number
Diff line number
Diff line change
@@ -28,110 +28,64 @@ This template provides a basic structure for building proof tasks that:
28
28
}
29
29
```
30
30
31
-
The project is designed to work with [Gramine](https://gramine.readthedocs.io/en/latest/), a lightweight library OS that enables running unmodified applications in secure enclaves, such as Intel SGX (Software Guard Extensions). This allows the code to run in a trusted execution environment, ensuring confidentiality and integrity of the computation.
31
+
The project is designed to work with Intel TDX (Trust Domain Extensions), providing hardware-level isolation and security guarantees for confidential computing workloads.
32
32
33
33
## Project Structure
34
34
35
-
-`volara_proof/`: Contains the main proof logic
35
+
-`my_proof/`: Contains the main proof logic
36
36
-`proof.py`: Implements the proof generation logic
37
37
-`__main__.py`: Entry point for the proof execution
38
+
-`models/`: Data models for the proof system
38
39
-`demo/`: Contains sample input and output for testing
39
-
-`.github/workflows/`: CI/CD pipeline for building and releasing
40
40
-`Dockerfile`: Defines the container image for the proof task
41
-
-`volara-proof.manifest.template`: Gramine manifest template for running securely in an Intel SGX enclave
42
-
-`config.yaml`: Configuration file for Gramine Shielded Containers (GSC)
41
+
-`requirements.txt`: Python package dependencies
43
42
44
43
## Getting Started
45
44
46
45
To use this template:
47
46
48
47
1. Fork this repository
49
-
2. Modify the `volara_proof/proof.py` file to implement your specific proof logic
50
-
3. Update the `volara-proof.manifest.template` if you need to add any additional files or change the configuration
48
+
2. Modify the `my_proof/proof.py` file to implement your specific proof logic
49
+
3. Update the project dependencies in `requirements.txt` if needed
51
50
4. Commit your changes and push to your repository
52
51
53
52
## Customizing the Proof Logic
54
53
55
-
The main proof logic is implemented in `volara_proof/proof.py`. To customize it, update the `Proof.generate()` function to change how input files are processed.
54
+
The main proof logic is implemented in `my_proof/proof.py`. To customize it, update the `Proof.generate()` function to change how input files are processed.
56
55
57
-
The proof can be configured using environment variables. When running in an enclave, the environment variables must be defined in the `volara-proof.manifest.template` file as well. The following environment variables are used for this demo proof:
56
+
The proof can be configured using environment variables:
58
57
59
-
-`COOKIES`: The cookies for the data contributor
58
+
-`USER_EMAIL`: The email address of the data contributor, to verify data ownership
59
+
60
+
If you want to use a language other than Python, you can modify the Dockerfile to install the necessary dependencies and build the proof task in the desired language.
60
61
61
62
## Local Development
62
63
63
-
To run the proof locally, without Gramine, you can use Docker:
64
+
To run the proof locally for testing, you can use Docker:
64
65
65
-
```
66
-
docker build -t volara-proof .
66
+
```bash
67
+
docker build -t my-proof .
67
68
docker run \
68
-
--rm \
69
-
--volume $(pwd)/demo/sealed:/sealed \
70
-
--volume $(pwd)/demo/input:/input \
71
-
--volume $(pwd)/demo/output:/output \
72
-
--env USER_EMAIL=user123@gmail.com \
73
-
volara-proof
69
+
--rm \
70
+
--volume $(pwd)/input:/input \
71
+
--volume $(pwd)/output:/output \
72
+
--env USER_EMAIL=user123@gmail.com \
73
+
my-proof
74
74
```
75
75
76
-
## Building and Releasing
77
-
78
-
This template includes a GitHub Actions workflow that automatically:
79
-
80
-
1. Builds a Docker image with your code
81
-
2. Creates a Gramine-shielded container (GSC) image
82
-
3. Publishes the GSC image as a GitHub release
83
-
84
-
**Important:** To use this workflow, you must generate a signing key and add it to your GitHub secrets. Follow these steps:
85
-
86
-
1. Generate a signing key (see instructions below)
87
-
2. Add the key as a GitHub secret named `SIGNING_KEY`
88
-
3. Push your changes to the `main` branch or create a pull request
89
-
90
-
### Generating the Gramine Signing Key (Required)
91
-
92
-
Before building and signing your graminized Docker image, you must generate a signing key. This key is crucial for creating secure SGX enclaves. Here's how to generate it:
93
-
94
-
1. If you have Gramine installed:
95
-
96
-
```
97
-
gramine-sgx-gen-private-key enclave-key.pem
98
-
```
99
-
100
-
2. If you don't have Gramine, use OpenSSL:
101
-
102
-
```
103
-
openssl genrsa -3 -out enclave-key.pem 3072
104
-
```
76
+
## Running with Intel TDX
105
77
106
-
After generating the key:
78
+
Intel TDX (Trust Domain Extensions) provides hardware-based memory encryption and integrity protection for virtual machines. To run this container in a TDX-enabled environment, follow your infrastructure provider's specific instructions for deploying confidential containers.
107
79
108
-
1. Keep this key secure, as it will be used to sign your enclaves.
109
-
2. Add the contents of `enclave-key.pem` as a GitHub secret named `SIGNING_KEY`.
80
+
Common volume mounts and environment variables:
110
81
111
-
This key is essential for the `gsc sign-image` step in the GSC workflow.
112
-
113
-
## Running with SGX
114
-
115
-
Intel SGX (Software Guard Extensions) is a set of security-related instruction codes built into modern Intel CPUs. It allows parts of a program to be executed in a secure enclave, isolated from the rest of the system.
116
-
117
-
To load a released image with docker, copy the URL from the release and run:
Remember to populate the `/input` directory with the files you want to process.
@@ -140,10 +94,13 @@ Remember to populate the `/input` directory with the files you want to process.
140
94
141
95
This template leverages several security features:
142
96
143
-
1.**Secure Enclaves**: The proof runs inside an SGX enclave, isolating it from the rest of the system.
144
-
2.**Encrypted Storage**: The `/sealed` directory is automatically encrypted/decrypted by Gramine, providing secure storage for sensitive data.
145
-
3.**Input/Output Isolation**: Input and output directories are mounted separately, ensuring clear data flow boundaries.
146
-
4.**Minimal Attack Surface**: The Gramine manifest limits the files and resources accessible to the enclave, reducing potential vulnerabilities.
97
+
1.**Hardware-based Isolation**: The proof runs inside a TDX-protected environment, isolating it from the rest of the system
98
+
2.**Input/Output Isolation**: Input and output directories are mounted separately, ensuring clear data flow boundaries
99
+
3.**Minimal Container**: Uses a minimal Python base image to reduce attack surface
100
+
101
+
## Customization
102
+
103
+
Feel free to modify any part of this template to fit your specific needs. The goal is to provide a starting point that can be easily adapted to various proof tasks.
0 commit comments