Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Random Key #266

Closed
wants to merge 81 commits into from
Closed

Random Key #266

wants to merge 81 commits into from

Conversation

piotrpalcz
Copy link
Contributor

This PR is related to image-rs PR confidential-containers/guest-components#385 and Shim/rune PR #256

Makes Runtime boot use key stored in file by image-rs/enclave agent.

After merging and fixes next step will be to seal/unseal the file with SGX

@piotrpalcz piotrpalcz requested a review from a team as a code owner October 30, 2023 15:24
@mythi mythi mentioned this pull request Oct 31, 2023
Closed
dcmiddle
dcmiddle reviewed Nov 7, 2023
View reviewed changes
Copy link
Member

@dcmiddle dcmiddle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for figuring out everything for this feature.
For commit messages I like the 7 rules here: https://cbea.ms/git-commit/
... add the why to the commit body and add a sign-off.

src/enclave-agent/Cargo.toml
@@ -13,7 +13,7 @@ clap = "2.33.3"
# logger module
env_logger = "0.10.0"

image-rs = { git = "https://github.com/confidential-containers/guest-components.git", default-features = false, rev = "fe8fb1a" }
image-rs = { git = "https://github.com/piotrpalcz/image-rs.git", default-features = false, branch = "random_key_2" }
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note for later reference that we want to update this after confidential-containers/guest-components#385 is merged

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to reflect that, I moved this PR to Draft.

src/runtime-boot/init/src/main.rs Outdated
)
.unwrap_or_else(|e| panic!("mount failed: {e}"));

let KEY_FILE: &str = "/mnt/key.txt";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Double check this path matches the path in confidential-containers/guest-components#385

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To boot/app enclave to run this need to match so if the e2e flow is working that means that the path is corresponding

@mythi mythi marked this pull request as draft November 8, 2023 06:51
@piotrpalcz
Copy link
Contributor Author

piotrpalcz commented Nov 9, 2023 •
edited
Loading

Thanks for figuring out everything for this feature. For commit messages I like the 7 rules here: https://cbea.ms/git-commit/ ... add the why to the commit body and add a sign-off.

Thanks, applied both of the suggestion - commit message is meaningful and signed-off

piotrpalcz and others added 18 commits December 19, 2023 14:12
@piotrpalcz
Runtime-boot container using stored key in enclave by image-rs
b41b675 
Signed-off-by: piotrpalcz <[email protected]>
@piotrpalcz
Merging conflicts
d960dee 
Signed-off-by: piotrpalcz <[email protected]>
@dependabot @piotrpalcz
build(deps): bump github.com/containerd/continuity in /src/shim
9f66e67 
Bumps [github.com/containerd/continuity](https://github.com/containerd/continuity) from 0.4.1 to 0.4.2.
- [Release notes](https://github.com/containerd/continuity/releases)
- [Commits](containerd/continuity@v0.4.1...v0.4.2)

---
updated-dependencies:
- dependency-name: github.com/containerd/continuity
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
enclave-agent: update image-rs dependency
f15261c 
the latest version makes devicemapper dependency as optional
so we get to drop it from the builds.

Signed-off-by: Mikko Ylinen <[email protected]>
@dependabot @piotrpalcz
build(deps): bump golang.org/x/sys from 0.11.0 to 0.12.0 in /src/shim
6b2066c 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.11.0 to 0.12.0.
- [Commits](golang/sys@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump actions/checkout from 3 to 4
1e751b6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump google.golang.org/grpc in /src/shim
8363ed7 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.57.0 to 1.58.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.57.0...v1.58.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
dependabot: check enclave-agent dependencies
a069ee6 
Signed-off-by: Mikko Ylinen <[email protected]>
@dependabot @piotrpalcz
build(deps): bump smallvec from 1.10.0 to 1.11.0 in /src/enclave-agent
b01ecf7 
Bumps [smallvec](https://github.com/servo/rust-smallvec) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/servo/rust-smallvec/releases)
- [Commits](servo/rust-smallvec@v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: smallvec
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump schannel from 0.1.21 to 0.1.22 in /src/enclave-agent
21818b8 
Bumps [schannel](https://github.com/steffengy/schannel-rs) from 0.1.21 to 0.1.22.
- [Release notes](https://github.com/steffengy/schannel-rs/releases)
- [Commits](steffengy/schannel-rs@v0.1.21...v0.1.22)

---
updated-dependencies:
- dependency-name: schannel
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump docker/login-action from 2 to 3
c9b7847 
Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v2...v3)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
build: move to pkgs.k8s.io APT repo
49e6713 
Signed-off-by: Mikko Ylinen <[email protected]>
@dependabot @piotrpalcz
build(deps): bump form_urlencoded in /src/enclave-agent
86d29aa 
Bumps [form_urlencoded](https://github.com/servo/rust-url) from 1.1.0 to 1.2.0.
- [Release notes](https://github.com/servo/rust-url/releases)
- [Commits](https://github.com/servo/rust-url/commits/v1.2.0)

---
updated-dependencies:
- dependency-name: form_urlencoded
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@surajssd @piotrpalcz
dependencies: Update image-rs to 914251a
1ace522 
Signed-off-by: Suraj Deshmukh <[email protected]>
@dependabot @piotrpalcz
build(deps): bump google.golang.org/grpc in /src/shim
9726eb6 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.0 to 1.58.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.58.0...v1.58.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump iana-time-zone in /src/enclave-agent
6605708 
Bumps [iana-time-zone](https://github.com/strawlab/iana-time-zone) from 0.1.53 to 0.1.57.
- [Changelog](https://github.com/strawlab/iana-time-zone/blob/main/CHANGELOG.md)
- [Commits](strawlab/iana-time-zone@v0.1.53...v0.1.57)

---
updated-dependencies:
- dependency-name: iana-time-zone
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump io-lifetimes in /src/enclave-agent
ac0070c 
Bumps [io-lifetimes](https://github.com/sunfishcode/io-lifetimes) from 1.0.6 to 1.0.11.
- [Commits](sunfishcode/io-lifetimes@v1.0.6...v1.0.11)

---
updated-dependencies:
- dependency-name: io-lifetimes
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dcmiddle @piotrpalcz
Update cilium ebpf for upstream license fix
0e54dc7 
Newer version of ebpf removes unnecessary GPL licensed tool
cilium/ebpf@0f74f86

Signed-off-by: Dan Middleton <[email protected]>
dependabot bot and others added 27 commits December 19, 2023 14:40
@dependabot @piotrpalcz
build(deps): bump chrono from 0.4.24 to 0.4.31 in /src/enclave-agent
611f790 
Bumps [chrono](https://github.com/chronotope/chrono) from 0.4.24 to 0.4.31.
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.24...v0.4.31)

---
updated-dependencies:
- dependency-name: chrono
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump regex from 1.7.1 to 1.10.2 in /src/enclave-agent
4d757c3 
Bumps [regex](https://github.com/rust-lang/regex) from 1.7.1 to 1.10.2.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.7.1...1.10.2)

---
updated-dependencies:
- dependency-name: regex
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
build: update to Occlum 0.30.0
e8ee133 
Signed-off-by: Mikko Ylinen <[email protected]>
@dependabot @piotrpalcz
build(deps): bump h2 from 0.3.16 to 0.3.21 in /src/enclave-agent
32a0177 
Bumps [h2](https://github.com/hyperium/h2) from 0.3.16 to 0.3.21.
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/master/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.16...v0.3.21)

---
updated-dependencies:
- dependency-name: h2
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump rustix from 0.36.9 to 0.36.17 in /src/enclave-agent
7815052 
Bumps [rustix](https://github.com/bytecodealliance/rustix) from 0.36.9 to 0.36.17.
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Commits](bytecodealliance/rustix@v0.36.9...v0.36.17)

---
updated-dependencies:
- dependency-name: rustix
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
build: move to Go 1.21.x
102ba80 
Signed-off-by: Mikko Ylinen <[email protected]>
@mythi @piotrpalcz
shim: fix linter errors
90beca9 
Signed-off-by: Mikko Ylinen <[email protected]>
@dependabot @piotrpalcz
build(deps): bump zeroize_derive in /src/enclave-agent
267b145 
Bumps [zeroize_derive](https://github.com/RustCrypto/utils) from 1.3.3 to 1.4.2.
- [Changelog](https://github.com/RustCrypto/utils/blob/master/zeroize/CHANGELOG.md)
- [Commits](RustCrypto/utils@zeroize_derive-v1.3.3...zeroize_derive-v1.4.2)

---
updated-dependencies:
- dependency-name: zeroize_derive
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump iana-time-zone-haiku in /src/enclave-agent
1395505 
Bumps [iana-time-zone-haiku](https://github.com/strawlab/iana-time-zone) from 0.1.1 to 0.1.2.
- [Changelog](https://github.com/strawlab/iana-time-zone/blob/main/CHANGELOG.md)
- [Commits](strawlab/iana-time-zone@0.1.1...0.1.2)

---
updated-dependencies:
- dependency-name: iana-time-zone-haiku
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump wasm-bindgen in /src/enclave-agent
91abad0 
Bumps [wasm-bindgen](https://github.com/rustwasm/wasm-bindgen) from 0.2.87 to 0.2.88.
- [Release notes](https://github.com/rustwasm/wasm-bindgen/releases)
- [Changelog](https://github.com/rustwasm/wasm-bindgen/blob/main/CHANGELOG.md)
- [Commits](rustwasm/wasm-bindgen@0.2.87...0.2.88)

---
updated-dependencies:
- dependency-name: wasm-bindgen
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump tokio-util from 0.7.7 to 0.7.10 in /src/enclave-agent
b339099 
Bumps [tokio-util](https://github.com/tokio-rs/tokio) from 0.7.7 to 0.7.10.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/commits)

---
updated-dependencies:
- dependency-name: tokio-util
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump regex-syntax in /src/enclave-agent
c778d80 
Bumps [regex-syntax](https://github.com/rust-lang/regex) from 0.6.28 to 0.6.29.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@regex-syntax-0.6.28...regex-syntax-0.6.29)

---
updated-dependencies:
- dependency-name: regex-syntax
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump tracing from 0.1.37 to 0.1.40 in /src/enclave-agent
3da0463 
Bumps [tracing](https://github.com/tokio-rs/tracing) from 0.1.37 to 0.1.40.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-0.1.37...tracing-0.1.40)

---
updated-dependencies:
- dependency-name: tracing
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump openssl-src in /src/enclave-agent
dffb872 
Bumps [openssl-src](https://github.com/alexcrichton/openssl-src-rs) from 300.1.5+3.1.3 to 300.1.6+3.1.4.
- [Release notes](https://github.com/alexcrichton/openssl-src-rs/releases)
- [Commits](https://github.com/alexcrichton/openssl-src-rs/commits)

---
updated-dependencies:
- dependency-name: openssl-src
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump libc from 0.2.147 to 0.2.150 in /src/enclave-agent
452f3a3 
Bumps [libc](https://github.com/rust-lang/libc) from 0.2.147 to 0.2.150.
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Commits](rust-lang/libc@0.2.147...0.2.150)

---
updated-dependencies:
- dependency-name: libc
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump golang.org/x/sys from 0.13.0 to 0.15.0 in /src/shim
0b3d568 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.13.0 to 0.15.0.
- [Commits](golang/sys@v0.13.0...v0.15.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump ipnet from 2.8.0 to 2.9.0 in /src/enclave-agent
72de360 
Bumps [ipnet](https://github.com/krisprice/ipnet) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/krisprice/ipnet/releases)
- [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md)
- [Commits](krisprice/ipnet@2.8.0...2.9.0)

---
updated-dependencies:
- dependency-name: ipnet
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump gimli from 0.28.0 to 0.28.1 in /src/enclave-agent
4b3e12a 
Bumps [gimli](https://github.com/gimli-rs/gimli) from 0.28.0 to 0.28.1.
- [Changelog](https://github.com/gimli-rs/gimli/blob/master/CHANGELOG.md)
- [Commits](gimli-rs/gimli@0.28.0...0.28.1)

---
updated-dependencies:
- dependency-name: gimli
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump crossbeam-utils in /src/enclave-agent
5da3d05 
Bumps [crossbeam-utils](https://github.com/crossbeam-rs/crossbeam) from 0.8.15 to 0.8.16.
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md)
- [Commits](crossbeam-rs/crossbeam@crossbeam-utils-0.8.15...crossbeam-utils-0.8.16)

---
updated-dependencies:
- dependency-name: crossbeam-utils
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump actions/setup-go from 4 to 5
71fdfbc 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump filetime from 0.2.20 to 0.2.23 in /src/enclave-agent
ca04399 
Bumps [filetime](https://github.com/alexcrichton/filetime) from 0.2.20 to 0.2.23.
- [Commits](alexcrichton/filetime@0.2.20...0.2.23)

---
updated-dependencies:
- dependency-name: filetime
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump openssl-sys in /src/enclave-agent
47cfc7e 
Bumps [openssl-sys](https://github.com/sfackler/rust-openssl) from 0.9.93 to 0.9.97.
- [Release notes](https://github.com/sfackler/rust-openssl/releases)
- [Commits](sfackler/rust-openssl@openssl-sys-v0.9.93...openssl-sys-v0.9.97)

---
updated-dependencies:
- dependency-name: openssl-sys
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump google.golang.org/grpc in /src/shim
8718e4d 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.59.0 to 1.60.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.59.0...v1.60.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @piotrpalcz
build(deps): bump anstyle-wincon in /src/enclave-agent
73ab1ec 
Bumps [anstyle-wincon](https://github.com/rust-cli/anstyle) from 3.0.1 to 3.0.2.
- [Commits](rust-cli/anstyle@anstyle-wincon-v3.0.1...anstyle-wincon-v3.0.2)

---
updated-dependencies:
- dependency-name: anstyle-wincon
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@mythi @piotrpalcz
build: create unified libOS bundle
2c314d5 
Signed-off-by: Mikko Ylinen <[email protected]>
@piotrpalcz
Post rebase cleanup
40a66ce 
Signed-off-by: piotrpalcz <[email protected]>
@piotrpalcz
Merge branch 'random_key_3' of github.com:piotrpalcz/enclave-cc into …
5425d62 
…random_key_3

Signed-off-by: piotrpalcz <[email protected]>
@piotrpalcz piotrpalcz mentioned this pull request Dec 19, 2023
Merged
@piotrpalcz
Copy link
Contributor Author

Closing, this PR, replacing with #312

@piotrpalcz piotrpalcz closed this Dec 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mythi mythi mythi left review comments

@dcmiddle dcmiddle dcmiddle approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@piotrpalcz @mythi @dcmiddle @surajssd @fitzthum @Xynnn007 @portersrc