chore: cleanup and nixify

* create containers with nix * updated README.md * added SPDX license headers Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
2025-07-21 15:13:56 +02:00 · 2024-02-27 12:04:31 +01:00 · 2024-02-27 12:04:31 +01:00 · 91f1612e0f
commit 91f1612e0f
parent c8082debc7
36 changed files with 900 additions and 659 deletions
--- a/packages/container-vault-admin-sgx-azure/Dockerfile
+++ b/packages/container-vault-admin-sgx-azure/Dockerfile
@ -0,0 +1,25 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+
+FROM teepot-vault-admin-sgx-azure:base
+
+WORKDIR /app
+
+COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
+
+RUN set -eux; \
+    gramine-manifest -Darch_libdir=/lib/x86_64-linux-gnu \
+      -Dentrypoint=$(readlink /bin/tee-vault-admin) \
+      -Dexecdir=/bin \
+      -Dlog_level=warning \
+      tee-vault-admin.manifest.toml tee-vault-admin.manifest; \
+    gramine-sgx-sign --manifest tee-vault-admin.manifest --output tee-vault-admin.manifest.sgx --key /tmp/test-enclave-key.pem; \
+    rm /tmp/test-enclave-key.pem
+
+VOLUME /opt/vault/tls
+
+EXPOSE 8443
+
+ENTRYPOINT ["/bin/sh", "-c"]
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+CMD [ "echo tee-vault-admin in SGX mode starting; restart-aesmd ; exec gramine-sgx tee-vault-admin" ]
--- a/packages/container-vault-admin-sgx-azure/default.nix
+++ b/packages/container-vault-admin-sgx-azure/default.nix
@ -0,0 +1,52 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+{ pkgs
+, vat
+, nixsgx
+, curl
+, teepot
+, bash
+, coreutils
+, openssl
+, vault
+}:
+let manifest = ./tee-vault-admin.manifest.toml;
+in pkgs.dockerTools.buildLayeredImage {
+  name = "teepot-vault-admin-sgx-azure";
+  tag = "base";
+
+  config.Entrypoint = [ "/bin/sh" "-c" ];
+
+  contents = pkgs.buildEnv {
+    name = "image-root";
+
+    paths = with pkgs.dockerTools; with nixsgx; with teepot;[
+      bash
+      coreutils
+      openssl
+      vault
+      azure-dcap-client
+      curl
+      teepot.teepot.tee_vault_admin
+      gramine
+      restart-aesmd
+      sgx-dcap.quote_verify
+      sgx-psw
+      usrBinEnv
+      binSh
+      caCertificates
+      fakeNss
+    ];
+    pathsToLink = [ "/bin" "/lib" "/etc" "/app" ];
+    postBuild = ''
+      mkdir -p $out/{app,etc}
+      cp ${manifest} $out/app/tee-vault-admin.manifest.toml
+      mkdir -p $out/var/run
+      mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
+      touch $out/etc/sgx_default_qcnl.conf
+      ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
+      ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
+      printf "precedence ::ffff:0:0/96  100\n" > $out/etc/gai.conf
+    '';
+  };
+}
--- a/packages/container-vault-admin-sgx-azure/tee-vault-admin.manifest.toml
+++ b/packages/container-vault-admin-sgx-azure/tee-vault-admin.manifest.toml
@ -0,0 +1,71 @@
+libos.entrypoint = "{{ entrypoint }}"
+
+[loader]
+argv = ["{{ entrypoint }}"]
+entrypoint = "file:{{ gramine.libos }}"
+
+[loader.env]
+### Admin Config ###
+PORT = { passthrough = true }
+
+### VAULT attestation ###
+VAULT_ADDR = { passthrough = true }
+VAULT_SGX_MRENCLAVE = { passthrough = true }
+VAULT_SGX_MRSIGNER = { passthrough = true }
+VAULT_SGX_ALLOWED_TCB_LEVELS = { passthrough = true }
+
+### DEBUG ###
+RUST_BACKTRACE = "1"
+RUST_LOG = "info,tee_vault_admin=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug"
+
+### Enclave security ###
+ALLOWED_TCB_LEVELS = "SwHardeningNeeded"
+
+### Fixed values ###
+LD_LIBRARY_PATH = "/lib"
+SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
+PATH = "/bin"
+HOME = "/app"
+
+MALLOC_ARENA_MAX = "1"
+AZDCAP_DEBUG_LOG_LEVEL = "ignore"
+AZDCAP_COLLATERAL_VERSION = "v4"
+
+[fs]
+root.uri = "file:/"
+start_dir = "/app"
+mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
+  { type = "tmpfs", path = "/var/tmp" },
+  { type = "tmpfs", path = "/tmp" },
+  { type = "tmpfs", path = "/app/.dcap-qcnl" },
+  { type = "tmpfs", path = "/app/.az-dcap-client" },
+]
+
+[sgx]
+trusted_files = [
+  "file:/app/",
+  "file:/bin/",
+  "file:/etc/gai.conf",
+  "file:/etc/sgx_default_qcnl.conf",
+  "file:/etc/ssl/certs/ca-bundle.crt",
+  "file:/lib/",
+  "file:/lib/libdcap_quoteprov.so",
+  "file:/nix/",
+  "file:{{ gramine.libos }}",
+  "file:{{ gramine.runtimedir() }}/",
+]
+remote_attestation = "dcap"
+max_threads = 64
+edmm_enable = false
+## max enclave size
+enclave_size = "2G"
+
+[sys]
+enable_extra_runtime_domain_names_conf = true
+enable_sigterm_injection = true
+
+# possible tweak option, if problems with mio
+# currently mio is compiled with `mio_unsupported_force_waker_pipe`
+# insecure__allow_eventfd = true
--- a/packages/container-vault-sgx-azure/Dockerfile
+++ b/packages/container-vault-sgx-azure/Dockerfile
@ -0,0 +1,25 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+
+FROM teepot-vault-sgx-azure:base
+
+WORKDIR /opt/vault
+
+COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
+RUN set -eux; \
+    gramine-manifest \
+      -Dtee_ratls_preexec=$(readlink /bin/tee-ratls-preexec) \
+      -Dvault_exec=$(readlink /bin/vault) \
+      -Darch_libdir=/lib/x86_64-linux-gnu \
+      -Dexecdir=/bin \
+      -Dlog_level=warning \
+      vault.manifest.toml vault.manifest; \
+    gramine-sgx-sign --manifest vault.manifest --output vault.manifest.sgx --key /tmp/test-enclave-key.pem; \
+    rm /tmp/test-enclave-key.pem
+
+VOLUME /opt/vault/tls
+VOLUME /opt/vault/data
+
+ENTRYPOINT ["/bin/sh", "-c"]
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+CMD [ "echo vault in SGX mode starting; restart-aesmd ; exec gramine-sgx vault" ]
--- a/packages/container-vault-sgx-azure/default.nix
+++ b/packages/container-vault-sgx-azure/default.nix
@ -0,0 +1,53 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+{ pkgs
+, vat
+, nixsgx
+, curl
+, teepot
+, bash
+, coreutils
+, openssl
+, vault
+}:
+let manifest = ./vault.manifest.toml;
+in pkgs.dockerTools.buildLayeredImage {
+  name = "teepot-vault-sgx-azure";
+  tag = "base";
+
+  config.Entrypoint = [ "/bin/sh" "-c" ];
+
+  contents = pkgs.buildEnv {
+    name = "image-root";
+
+    paths = with pkgs.dockerTools; with nixsgx;[
+      bash
+      coreutils
+      teepot.teepot.tee_ratls_preexec
+      vault
+      azure-dcap-client
+      curl
+      vat.vault-auth-tee
+      gramine
+      restart-aesmd
+      sgx-dcap.quote_verify
+      sgx-psw
+      usrBinEnv
+      binSh
+      caCertificates
+      fakeNss
+      teepot.container-vault-start-config
+    ];
+    pathsToLink = [ "/bin" "/lib" "/etc" "/opt/vault" ];
+    postBuild = ''
+      mkdir -p $out/var/run
+      mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
+      mkdir -p $out/opt/vault/data $out/opt/vault/.cache $out/opt/vault/tls
+      ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
+      ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
+      mkdir -p $out/opt/vault/plugins
+      ln -s ${vat.vault-auth-tee}/bin/vault-auth-tee $out/opt/vault/plugins
+      cp ${manifest} $out/opt/vault/vault.manifest.toml
+    '';
+  };
+}
--- a/packages/container-vault-sgx-azure/test-enclave-key.pem
+++ b/packages/container-vault-sgx-azure/test-enclave-key.pem
@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAwDrEJDyGnIGv/xWF4/MQtVEshpft/xGECSdjuHOU87nwCWon
+hirmOyggPPU772tobmaqRhAMHn0NwvRyFCQcSwTIjd0e/cfwH/QtEd/fp4yaw/z7
+FZmesTm+wjaobnRfPwrNHAfM8U2EQPXp1yYyjUqPVEXb/7ivdR+u7qnb0o6oNfzA
+ibRF6H+Fozj5FwepfbQ1DTauTEwdjywD+/21W+Ru5qF7SQVHYwf9OuyD4yZBm9os
+0Aqnk1nO6ZUSJfrL1gd10LoblnPUjNxwQtWhxIPyeKRYwmVpoaYL45U+6iNOkBiL
+PyGJDC+lq+AS8YtwzPOt3pUUpFh/XZyxSHla3Q8qPAikjcv1DvTiK+NVEVXoFrbs
+/uG6Ii9BSRbZ3NQH1bOLtdkW7W6GPGCMr/KuXEvIQaOpDb27/DEtvCh3T/9vrKsO
+etpTI0an6NZ1oshZ3X2TxZ9nNxh9zMvPswXBdy9O9/WybAN6a1PvIb3v66bxJW6T
+Pu87/q0DKzeMM20pAgEDAoIBgQCAJy1tfa8TAR//Y66X92B44MhZup6qC61bb5fQ
+TQ330Uqw8W+ux0QncBV9+NKfnPBJmcbZYAgUU16B+EwNbWgyAzBek2n+hUq/+B4L
+6pUaXbyCqKdju78g0SnWzxr0TZTUsd4Sr932M62Ao/E6GXcI3F+Ng+f/0HT4v8n0
+cT03CcV5UysGeC6a/65s0KYPWnD+eCNeJHQy3WkKHVf9U849QvSZwPzbWNpCBVN8
+na1CGYESkXM1XG+3kTSbuLbD/Ia8KvGsaOeVORvhXr04kD9qW2ioaisSAcXELHY7
+qFcktM1cYnDJn1/LcCH6tUlnJdGIKWYlbBcmJvhT2FqpULg5IPldNiu9ybh5yQY9
+HB0pnzg6Ldcb/aunyjdwXgcaPgdkOOpnqRYGq6yrmWk6WsnNMK/QFmgxadbfOU0i
+xjSrSYVItugHwOrH2eH842jBP2wbe1UJCOrKNytzZ3mBcb0RJbbFYjV0QzdPeVTN
+Y9ermQTt29tJVrd+Emzo8CK4+gMCgcEA4sXchskGNcoChkDpAqie0W2YLm2XDyPY
+CoiA+OVLc5lDd995Vqe2kCIC8VMMGIHhxG3NIqxrfxpH5LvqDczphyH6dlWl/O2M
+CrS/67NjCTm6935ADeR0qndYdMm5XyfYEjl5qESoq4oNq4Pg/0/P1Q/mhN8GQiKb
+qYAIHE/28dw1tsF6Kl7oqALpBXLQ/iRuFqJmrSPgQ32c5bEQUBD3F7HZq8T7V+O2
+7/jH8A1A2XddnddIe6fTqboFsghcPAHrAoHBANkBLsdTugDUKDSNa2tUo9ONPU2X
+gRg+6PDa2ZEzcL961w2laLoKwsrlb8J9GL5Q1LxHx4PGhmwDwvscPzyzXQA7ubnh
+vPQv1E2SmOSFxkmtWMfz6kcAw/wIlavAFdZPJK0ksnIWzTfi9Y92jdkar9Ny2gSj
+BoF8XgPbMeuvMV008gjXOETaCk986+gOh4LEyZ2iLYruJsRIH7n/iSDKLsXE4yQd
+ZuW68IQlJ/2a65DKDCLNgdVFVRfXWhvG++H0OwKBwQCXLpMEhgQj3AGu1fCscGng
+87rJnmS0wpAHBatQmNz3u4JP6lDkb88KwVdLjLK7AUEtnojByEeqEYVDJ/FeiJuv
+a/xO48P987KxzdVHzOyw0SdPqYAJQvhxpOWjMSY/b+Vhe6ZwLcXHsV5yV+tU39/j
+X+8DP1mBbGfGVVq9iqShPXkkgPwcP0XFV0YDoeCpbZ65wZnIwpWCU73udgrgC09l
+ITvH2KeP7SSf+y/1Xis7pOkT5Nr9Go0b0VkhWugoAUcCgcEAkKt0hOJ8AI1wIwjy
+R43CjQjTiQ+rZX9F9ec7tiJLKlHks8ObJrHXMe5Kgai7KYs4fYUvrS8ESAKB/L1/
+fczoqtJ70UEoosqNiQxl7a6EMR47L/fxhKstUrBjx9Vj5DTDHhh29rneJUH5Ck8J
+O2cf4kyRWGyvAP2UApIhR8og6M32sI962JFcNP3ymrRaVy3bvmweXJ7Egtq/0VUG
+FdwfLoNCGBOZ7nygWBjFU7ydCzFdbIkBONjjZTo8EoSn6/gnAoHBAJ/XSbhoVzkI
+CgW7gXSp+qKMhtbR2QawL3006KfQbK/sdcJ0Cyd4IfHXswrFQKV4BrL4tOxay1PT
+HoQZW5+pLTbZjz3d0tDU9WpSd6FNovoxB6lUA3ymD4ay8Zysy3FflNqOSO6XkwKq
+0GApQ6pIiDTst+LpnfgvQBDAnJXK3Hik2wDgXThXEofUoMDcGNsQ+NbdackR7/yL
+8ep5ZLAhczGi4XE471ut48CHtxKq0eGde/lHx0Origk9PPbsNoH2XA==
+-----END RSA PRIVATE KEY-----
--- a/packages/container-vault-sgx-azure/vault.manifest.toml
+++ b/packages/container-vault-sgx-azure/vault.manifest.toml
@ -0,0 +1,77 @@
+libos.entrypoint = "{{ tee_ratls_preexec }}"
+
+[loader]
+entrypoint = "file:{{ gramine.libos }}"
+argv = [
+  "{{ tee_ratls_preexec }}",
+  "--",
+  "{{ vault_exec }}",
+  "server",
+  "-config=/opt/vault/config.hcl",
+  "-log-level=trace",
+]
+# set a log level for gramine
+log_level = "{{ log_level }}"
+
+[loader.env]
+LD_LIBRARY_PATH = "/lib"
+SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
+PATH = "{{ execdir }}"
+HOME = "/opt/vault"
+
+VAULT_CLUSTER_ADDR.passthrough = true
+VAULT_API_ADDR.passthrough = true
+VAULT_RAFT_NODE_ID.passthrough = true
+
+DNS_NAMES = "vault-1,vault-2,vault-3"
+
+# otherwise vault will lock a lot of unused EPC memory
+VAULT_RAFT_INITIAL_MMAP_SIZE = "0"
+
+# possible tweak option, if problems with raft
+# VAULT_RAFT_DISABLE_MAP_POPULATE = "true"
+
+[fs]
+root.uri = "file:/"
+start_dir = "/opt/vault"
+mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
+  { type = "tmpfs", path = "/var/tmp" },
+  { type = "tmpfs", path = "/tmp" },
+  { type = "tmpfs", path = "/opt/vault/tls" },
+  { type = "tmpfs", path = "/opt/vault/.dcap-qcnl" },
+  { type = "tmpfs", path = "/opt/vault/.az-dcap-client" },
+  { type = "encrypted", path = "/opt/vault/.cache", uri = "file:/opt/vault/.cache", key_name = "_sgx_mrsigner" },
+  { type = "encrypted", path = "/opt/vault/data", uri = "file:/opt/vault/data", key_name = "_sgx_mrsigner" },
+]
+
+[sgx]
+debug = false
+edmm_enable = false
+enclave_size = "8G"
+max_threads = 64
+nonpie_binary = true
+remote_attestation = "dcap"
+
+trusted_files = [
+  "file:/bin/",
+  "file:/etc/gai.conf",
+  "file:/etc/ssl/certs/ca-bundle.crt",
+  "file:/lib/",
+  "file:/nix/",
+  "file:/opt/vault/plugins/",
+  "file:/opt/vault/config.hcl",
+  "file:/opt/vault/cacert.pem",
+  "file:/opt/vault/cakey.pem",
+  "file:{{ gramine.libos }}",
+  "file:{{ gramine.runtimedir() }}/",
+]
+
+[sys]
+stack.size = "1M"
+enable_extra_runtime_domain_names_conf = true
+enable_sigterm_injection = true
+
+# vault needs flock
+experimental__enable_flock = true
--- a/packages/container-vault-start-config/cacert.pem
+++ b/packages/container-vault-start-config/cacert.pem
@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFSDCCAzCgAwIBAgIUDjUfoOY4o+E38mka8ViQOPpHBhgwDQYJKoZIhvcNAQEL
+BQAwLTEZMBcGA1UECgwQVGVzdCBDQSwgTGltaXRlZDEQMA4GA1UEAwwHVGVzdCBD
+QTAeFw0yMzA2MDYwNzU4MTNaFw0yNDA2MDUwNzU4MTNaMC0xGTAXBgNVBAoMEFRl
+c3QgQ0EsIExpbWl0ZWQxEDAOBgNVBAMMB1Rlc3QgQ0EwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQD4hjplzpqaXoWL/8bex/zBStuYmBuOGvIELS5aiHfw
+XfGnOwIViIMf+ikuxASYj3AmEmPOCXXbUsARe/0cHn438rVbeFK6cJl/kXlwGMOy
+SpXbKDqrmM+U2lUyrcmHRapHvwBaKU5LKumsshurP62DlpcZ6Imasmtlm9t+NJfP
+esTEKAhzuRGwcEaOXkvksK7QXEwl3q4da4ST/+qjfnYq/gA6PFgHHWRo8qXPa62H
+pPcYkCiCfd4oYSSqH6kEeym2upDVVjtAo6y7ytQU0DNs51vR+ePL9qd3WVWnzm9z
+66V9ZUCqfU1LY4dAMEN8UH2QiXPVyFG/Y2lb7gtltI7D2D4C63vgCS657cRcOMg/
+xbiYXaVh0BQvJkznyv+IOkU8a42Uth/CX7Tv9N2n4X5accV82oUHtW3BbeYxW4Wb
+dTfsMir/q50io/l3nbPlzA28GwlZ3owdi22/Tdc+yg7NxOHPpJ6ZULK6d9n1glV5
+PDkO9J8Ad1MZwkKKMh+tPdccNarUkdBj0K8tpZqBmjhMWQddwAd5MZGWS0VBKBZb
+b5Z9ivqZ70oQSx8HKE3EGWSfT6ZJVhQ4XDAdMpw+wQcZQ+6twIpAQU3k6imJ4yGz
+ZYIOF2izn8Z4vBE4I/vKrpFci3mBDIJl59x49uAi5KpTBeeY/lLMnFLRa5sDUtLn
+kwIDAQABo2AwXjAdBgNVHQ4EFgQU4ZHyVkjYaunC0Rk9PtDsk8nALhcwHwYDVR0j
+BBgwFoAU4ZHyVkjYaunC0Rk9PtDsk8nALhcwDwYDVR0TAQH/BAUwAwEB/zALBgNV
+HQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAIGigs3CZO1DdnaxZwUghMm95NAX
+D7vKYFAmoNtbVBv1NAfpv23XOhAzccEFGg20XEa1t2z0Nfct9NDXxZ2VCgU+9vws
+d96EBkufgnKrc/hLxRnVsExQxy5FKYz/d5LePeYd1OFS0bw+DRpzEnFZm34vpToj
+mku845LtHbeZEzaVdzaSu9m7YcoENGgGuOlsgvp/qB6MlxI0fHG5M2M5aLnIEyIv
+QAMmX42eJ09jhaLr8dl2zLImyIYO0dMO0NNl5gU01cpJ5REHJ3e3oUDUJ5ZZCL51
+/VYSd/btHYRCdH/w6FSUOGGwU38LhhbeD94103gkKS5bfIui77sY0F3jRIluVQci
+PnKzRNsfl5uL8KICDJtT6uNwkhSG4ucYNAb21eo6idzyMe4qdJz1poPjmph19rnU
+oAE/0+jqOyVErBZuRAL9wbQg1Prqx1WBsOIUyi5Y7qAUt+AuDt0uf4mdRnE1yDvw
+o0CIz3XLD1YoHXqJ/Nu1By1fI2zA0Y7osSX4SzfbD0EUXqjUyy80KrvKmJaV8lMd
+1/jGHuApNQjZFwbY+RN0OTtDk7zPAETaGz/15BEmVDpq0OAVqe0XrXpQfaYwHzzq
+TsOvVYZSj2gsDbKzM8tmCkLoS+Yh5ubxaoIE2qCjvFNXZwFzqQtDgBKQhjuE54+K
+lweZ5hgUkLPf5EW0
+-----END CERTIFICATE-----
--- a/packages/container-vault-start-config/cakey.pem
+++ b/packages/container-vault-start-config/cakey.pem
@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQD4hjplzpqaXoWL
+/8bex/zBStuYmBuOGvIELS5aiHfwXfGnOwIViIMf+ikuxASYj3AmEmPOCXXbUsAR
+e/0cHn438rVbeFK6cJl/kXlwGMOySpXbKDqrmM+U2lUyrcmHRapHvwBaKU5LKums
+shurP62DlpcZ6Imasmtlm9t+NJfPesTEKAhzuRGwcEaOXkvksK7QXEwl3q4da4ST
+/+qjfnYq/gA6PFgHHWRo8qXPa62HpPcYkCiCfd4oYSSqH6kEeym2upDVVjtAo6y7
+ytQU0DNs51vR+ePL9qd3WVWnzm9z66V9ZUCqfU1LY4dAMEN8UH2QiXPVyFG/Y2lb
+7gtltI7D2D4C63vgCS657cRcOMg/xbiYXaVh0BQvJkznyv+IOkU8a42Uth/CX7Tv
+9N2n4X5accV82oUHtW3BbeYxW4WbdTfsMir/q50io/l3nbPlzA28GwlZ3owdi22/
+Tdc+yg7NxOHPpJ6ZULK6d9n1glV5PDkO9J8Ad1MZwkKKMh+tPdccNarUkdBj0K8t
+pZqBmjhMWQddwAd5MZGWS0VBKBZbb5Z9ivqZ70oQSx8HKE3EGWSfT6ZJVhQ4XDAd
+Mpw+wQcZQ+6twIpAQU3k6imJ4yGzZYIOF2izn8Z4vBE4I/vKrpFci3mBDIJl59x4
+9uAi5KpTBeeY/lLMnFLRa5sDUtLnkwIDAQABAoICABokGFFsHXP+XELBGTyGwa3d
+P2L6IO/eIrXQwM7yCtekMg56lPoJ3W0IJbvPD4Kyl8PRbGEYOqbiueQ86/9Ar9sX
+sv7XlbAZtvOlrCXf3PnMgZ3HSgCRtsf7/Tky8X9Ckyovy4wwSxV6ApFRPLrTHF+6
+f9NQU+ULPmO2NKy+QHeo/Lh7U4REo7kw3iMMhSQdd43gH3xeQ2dBz3S31wjyfOCB
+zilR/ppk+5JUb591PpAFiJ4zT6eGMM+DhFVGtkML53PahPCDvQDMFpe8Onmj+rzK
+Syy3gcALBkt2AJ4Bh1SkpUge1eH5Ax/abLgSO48Acmy5II+MnhipDsSGMfm1N8zp
+yjzitqay1B/8VHu8FJ7up4XbLvvhjG3uKLchARJ9pGjJ8JYdFNcxv+ZBD2H111J5
+b5XHHII1W/6wgpcB6SesasjoTe/jJhPPosvUT+QuT3IG46TDE4ct8+20kSP3vmm4
+FtgfyMFNqh7/GR42UMDjMcx+zCUPpQj9KTH1KUHnW/tQqqb0+lCwTw9vuMBxxysD
+KjG5qxaLqY9uIQ3h+hSuTGtPOIFt3uMrZMp6R1pMmWr+imPED7NAildbOqsCxI00
+1icPp43vOVdFYIlVX3FZLGUg5c9SkTv5O628HUoHQM+TPqG6bysA+w/pL2d9ByPX
+5N3LfbqPTr9PYYd6owNBAoIBAQD89s1MDFY1E6cuP8ut2avrwJzqm0u7FzCxbXC9
+PUgzUKdcVZ7ilQxEM8GRijq0HegefycPwR5oYF8OtpXsuXJ81q69jW1hYHWTSER2
+VrjWhF5TiKoaiLW1YfSX3IQRZ2zpLKRKC1IvsOzd115Yl0gjHBXlK875z3t2d61q
+grCG/QjfXer+5pJsOjxROS+lob6pDohHJLIaRYheLRVstiG+o0pk6LCVo1UPqdQN
+rZ6pUoBZjaX56alP1xexMguN1/2GRTgkk1BUdOJ/wfpQv6VW7EpdwwkVJxZ+c77P
+6zy6FkELtSCuEYt8ETmCnYzUBJs58ZSKqar4+BFD4b4w1nRTAoIBAQD7gckhaW7G
+gHZsiaGfgsnf7kVJmeBJ5WnCTAXRDUQRK+/KEz+4uyVFoeX0czIoviYOWOn6Sg4I
+qHIUkYkIG/aOCo0z5HnxoXwAA5HY/3ZLzMGlM2sqoQpPCFUQE//a5eYfSyyOVFQO
+LoJpJyPIWppYPPo6AMy/OTXl9R6I/kN98cya8scWfwakNfgA8jhnii0ezEr1WwR8
+nrK2SBhO9Rl2FcUSNXbOtk8BmcimW5IoDiATssLyReEqoQhrCgt8It90OtozT1GQ
+qjL7ZG786s02YuBddU5t27qbqFGn4XXQk3ArCFsOUqUf8Lj5U6mZ75sNRrU1O8NB
+J4Q7E+geT1fBAoIBAEmuVXPuL/n7xHlLKbd0rIfZrZsEKtXO1mcHuovUWsBfoK/b
+XJEg2tbOwHX07k5iW6buYGFNXd8HGwj9E8RE690C5xjdJdv0Lar9pLtXXTVWjucD
+6pAZ+9teMdE98NXk6ysrzpqmm4S6ovOm9JsXTXK0jogW742B6rNB/qgEcwiOkVQG
+Vhly7XlKqSD7aC51Y0R4sCcQwDO4xxSvSwtELaYKh/PGdxDO50rNq69kP8+P8USk
+ZpDZh3By9TqumgDxxa2jYcv9gKto9EREKvX0LGOaJbsTwQSBQyMH8a88FI8bRkzz
+sBYjlB5KIhcybr+eq9v/ysVs0Bj+oIDGMxCklnMCggEAcT+hl1/oN43ExV673h2A
+VUru/BNDwUKB+rFMtTNqAOlt0eoU+VOblt0ttILihSIJ9M/om4EZDKD8rXJS58nf
+nVn29vTcTAdQ1JjG5ZUyaTNLxt1+VfWptKil1NWMkb6PfmvVJkmmh7Q9mKe9Hwxd
+D3p1mgSeLUTPljpng3wqW92zKdpD90c/cFW01Ig9CbJYWtPWtOBFBvBWvGl+OJ94
+1Yk78dUNKEtDDA95IB9/knW5z+Tgj0MT/qQALGKbhUwWnjmZ4xzGN4PL7RLuPwhj
+Wyfuq2aU6DbWshx6mEOXT1H0YgwjJDHmlJlKUUpwxhX0FWhPVCcS5pWqnwd5r5w+
+gQKCAQAG6FIn1Gh0kqlMZBp0g/NXXaC+ZqKu/GzDk5o0inGaZXjlE0XlgjAHZBCn
+DlxQsZiA1rXTOZu9oIvaVD5Kqr9PmCiRc0a17CNVK6dfBHBI4+vscVaZev10BjAD
+tIvZ+E9SqP7MRWYmNeOhSVPtty9VWCwAcKFP4zhAqfykyl9EzFvLFuoYNWy36Ggm
+EpSWHzD3ju/t/31FcAWyQ3ZzN9Z6zAd909S3YvTfBRY2HLiXzKSRKT+4BzKr5UkG
+y1aXeDQQlykdxehMU7EFu9pzFR+P3iTTh93qbcSgrWIDVUjBGhnLI03wxlLN2XPA
+ddNNT9BMXrut8KdPM9+L+8v5a57L
+-----END PRIVATE KEY-----
--- a/packages/container-vault-start-config/config.hcl
+++ b/packages/container-vault-start-config/config.hcl
@ -0,0 +1,55 @@
+# Parameter needed because of slow plugin loading
+# may be relaxed for faster machines
+#http_read_header_timeout = 0
+#http_read_timeout = 300
+
+disable_mlock = true
+ui            = false
+
+listener "tcp" {
+  address            = "0.0.0.0:8210"
+  cluster_address    = "0.0.0.0:8211"
+  tls_disable        = false
+  tls_cert_file      = "/opt/vault/tls/tls.crt"
+  tls_key_file       = "/opt/vault/tls/tls.key"
+  tls_client_ca_file = "/opt/vault/cacert.pem"
+}
+
+storage "raft" {
+  path    = "/opt/vault/data/"
+  # override vial env var VAULT_RAFT_NODE_ID
+  node_id = "vault-1"
+
+  # Parameter needed because of slow plugin loading
+  # may be relaxed for faster machines
+  # performance_multiplier = 200
+  #autopilot_reconcile_interval = "120s"
+  #autopilot_update_interval = "60s"
+
+  retry_join {
+    leader_api_addr         = "https://vault-1:8210"
+    leader_ca_cert_file     = "/opt/vault/cacert.pem"
+    leader_client_cert_file = "/opt/vault/tls/tls.crt"
+    leader_client_key_file  = "/opt/vault/tls/tls.key"
+  }
+  retry_join {
+    leader_api_addr         = "https://vault-2:8210"
+    leader_ca_cert_file     = "/opt/vault/cacert.pem"
+    leader_client_cert_file = "/opt/vault/tls/tls.crt"
+    leader_client_key_file  = "/opt/vault/tls/tls.key"
+  }
+  retry_join {
+    leader_api_addr         = "https://vault-3:8210"
+    leader_ca_cert_file     = "/opt/vault/cacert.pem"
+    leader_client_cert_file = "/opt/vault/tls/tls.crt"
+    leader_client_key_file  = "/opt/vault/tls/tls.key"
+  }
+}
+
+# path of plugin binaries
+plugin_directory = "/opt/vault/plugins"
+
+# override via env var VAULT_API_ADDR
+api_addr     = "https://vault:8210"
+# override via env var VAULT_CLUSTER_ADDR
+cluster_addr = "https://vault:8211"
--- a/packages/container-vault-start-config/default.nix
+++ b/packages/container-vault-start-config/default.nix
@ -0,0 +1,29 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+
+# TODO: This derivation is a temporary workaround for
+# creating a self-signed certificate for Vault and the unseal TEE.
+# It will be replaced with real RA-TLS.
+{ lib
+, stdenv
+}:
+stdenv.mkDerivation rec {
+  name = "container-vault-start-config";
+  src = with lib.fileset; toSource {
+    root = ./.;
+    fileset = unions [
+      ./cacert.pem
+      ./cakey.pem
+      ./config.hcl
+    ];
+  };
+
+  phases = "installPhase";
+  postInstall = ''
+    mkdir -p $out/opt/vault
+    cp -r $src/* $out/opt/vault
+
+    mkdir -p $out/etc
+    printf "precedence ::ffff:0:0/96  100\n" > $out/etc/gai.conf
+  '';
+}
--- a/packages/container-vault-unseal-sgx-azure/Dockerfile
+++ b/packages/container-vault-unseal-sgx-azure/Dockerfile
@ -0,0 +1,25 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+
+FROM teepot-vault-unseal-sgx-azure:base
+
+WORKDIR /app
+
+COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
+
+RUN set -eux; \
+    gramine-manifest -Darch_libdir=/lib/x86_64-linux-gnu \
+      -Dentrypoint=$(readlink /bin/tee-vault-unseal) \
+      -Dvault_auth_tee_sha=1505ffe3ef0994de63206ccce1dec6715d55e72955960cb7314e4571811c4422 \
+      -Dvault_auth_tee_version=0.1.0+dev \
+      -Dexecdir=/bin \
+      -Dlog_level=warning \
+      tee-vault-unseal.manifest.toml tee-vault-unseal.manifest; \
+    gramine-sgx-sign --manifest tee-vault-unseal.manifest --output tee-vault-unseal.manifest.sgx --key /tmp/test-enclave-key.pem; \
+    rm /tmp/test-enclave-key.pem
+
+EXPOSE 8443
+
+ENTRYPOINT ["/bin/sh", "-c"]
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+CMD [ "echo tee-vault-unseal in SGX mode starting; restart-aesmd ; exec gramine-sgx tee-vault-unseal" ]
--- a/packages/container-vault-unseal-sgx-azure/default.nix
+++ b/packages/container-vault-unseal-sgx-azure/default.nix
@ -0,0 +1,54 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+{ pkgs
+, vat
+, nixsgx
+, curl
+, teepot
+, bash
+, coreutils
+, openssl
+, vault
+}:
+let manifest = ./tee-vault-unseal.manifest.toml;
+in pkgs.dockerTools.buildLayeredImage {
+  name = "teepot-vault-unseal-sgx-azure";
+  tag = "base";
+
+  config.Entrypoint = [ "/bin/sh" "-c" ];
+
+  contents = pkgs.buildEnv {
+    name = "image-root";
+
+    paths = with pkgs.dockerTools; with nixsgx; with teepot;[
+      bash
+      coreutils
+      openssl
+      vault
+      azure-dcap-client
+      curl
+      vat.vault-auth-tee.sha
+      teepot.teepot.tee_vault_unseal
+      gramine
+      restart-aesmd
+      sgx-dcap.quote_verify
+      sgx-psw
+      usrBinEnv
+      binSh
+      caCertificates
+      fakeNss
+    ];
+    pathsToLink = [ "/bin" "/lib" "/etc" "/share" "/app" ];
+    postBuild = ''
+      mkdir -p $out/{app,etc}
+      cp ${manifest} $out/app/tee-vault-unseal.manifest.toml
+      mkdir -p $out/var/run
+      mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
+      touch $out/etc/sgx_default_qcnl.conf
+      mkdir -p $out/opt/vault/.cache $out/opt/vault/tls
+      ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
+      ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
+      printf "precedence ::ffff:0:0/96  100\n" > $out/etc/gai.conf
+    '';
+  };
+}
--- a/packages/container-vault-unseal-sgx-azure/tee-vault-unseal.manifest.toml
+++ b/packages/container-vault-unseal-sgx-azure/tee-vault-unseal.manifest.toml
@ -0,0 +1,74 @@
+libos.entrypoint = "{{ entrypoint }}"
+
+[loader]
+argv = ["{{ entrypoint }}"]
+entrypoint = "file:{{ gramine.libos }}"
+
+[loader.env]
+### Admin Config ###
+PORT = { passthrough = true }
+
+### VAULT attestation ###
+VAULT_ADDR = { passthrough = true }
+VAULT_SGX_MRENCLAVE = { passthrough = true }
+VAULT_SGX_MRSIGNER = { passthrough = true }
+VAULT_SGX_ALLOWED_TCB_LEVELS = { passthrough = true }
+
+### DEBUG ###
+RUST_BACKTRACE = "1"
+RUST_LOG = "info,tee_vault_unseal=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug"
+
+### Enclave security ###
+ALLOWED_TCB_LEVELS = "SwHardeningNeeded"
+
+### Fixed values ###
+LD_LIBRARY_PATH = "/lib"
+SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
+PATH = "/bin"
+HOME = "/app"
+
+MALLOC_ARENA_MAX = "1"
+AZDCAP_DEBUG_LOG_LEVEL = "ignore"
+AZDCAP_COLLATERAL_VERSION = "v4"
+
+VAULT_AUTH_TEE_SHA256 = "{{ vault_auth_tee_sha }}"
+VAULT_AUTH_TEE_VERSION = "{{ vault_auth_tee_version }}"
+
+[fs]
+root.uri = "file:/"
+start_dir = "/app"
+mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
+  { type = "tmpfs", path = "/var/tmp" },
+  { type = "tmpfs", path = "/tmp" },
+  { type = "tmpfs", path = "/app/.dcap-qcnl" },
+  { type = "tmpfs", path = "/app/.az-dcap-client" },
+]
+
+[sgx]
+trusted_files = [
+  "file:/app/",
+  "file:/bin/",
+  "file:/etc/gai.conf",
+  "file:/etc/sgx_default_qcnl.conf",
+  "file:/etc/ssl/certs/ca-bundle.crt",
+  "file:/lib/",
+  "file:/lib/libdcap_quoteprov.so",
+  "file:/nix/",
+  "file:{{ gramine.libos }}",
+  "file:{{ gramine.runtimedir() }}/",
+]
+remote_attestation = "dcap"
+max_threads = 64
+edmm_enable = false
+## max enclave size
+enclave_size = "2G"
+
+[sys]
+enable_extra_runtime_domain_names_conf = true
+enable_sigterm_injection = true
+
+# possible tweak option, if problems with mio
+# currently mio is compiled with `mio_unsupported_force_waker_pipe`
+# insecure__allow_eventfd = true
--- a/packages/container-vault-unseal/default.nix
+++ b/packages/container-vault-unseal/default.nix
@ -0,0 +1,31 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+{ lib
+, dockerTools
+, nixsgx
+, teepot
+, buildEnv
+, curl
+, ...
+}:
+dockerTools.buildLayeredImage {
+  name = "vault-unseal";
+  tag = "latest";
+
+  config.Entrypoint = [ "${teepot.teepot.vault_unseal}/bin/vault-unseal" ];
+
+  contents = buildEnv {
+    name = "image-root";
+    paths = with dockerTools; with nixsgx;[
+      azure-dcap-client
+      curl
+      sgx-dcap.quote_verify
+      usrBinEnv
+      binSh
+      caCertificates
+      fakeNss
+      teepot.teepot.vault_unseal
+    ];
+    pathsToLink = [ "/bin" "/lib" "/etc" ];
+  };
+}
--- a/packages/container-verify-attestation/default.nix
+++ b/packages/container-verify-attestation/default.nix
@ -1,3 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
 { lib
 , dockerTools
 , teepot
@ -5,6 +7,8 @@
 }:
 dockerTools.buildImage {
  name = "verify-attestation";
+  tag = "latest";
+
  copyToRoot = [
    teepot.teepot.verify_attestation
  ];
--- a/packages/teepot/default.nix
+++ b/packages/teepot/default.nix
@ -1,3 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
 { lib
 , gccStdenv
 , makeRustPlatform
@ -34,7 +36,6 @@ rustPlatform.buildRustPackage {
    fileset = unions [
      ../../Cargo.lock
      ../../Cargo.toml
-      ../../assets
      ../../bin
      ../../crates
      ../../rust-toolchain.toml
@ -42,6 +43,7 @@ rustPlatform.buildRustPackage {
      ../../tests
    ];
  };
+
  RUSTFLAGS = "--cfg mio_unsupported_force_waker_pipe";
  cargoBuildFlags = "--all";
  checkType = "debug";
@ -52,6 +54,7 @@ rustPlatform.buildRustPackage {
  outputs = [
    "out"
    "tee_key_preexec"
+    "tee_ratls_preexec"
    "tee_self_attestation_test"
    "tee_stress_client"
    "tee_vault_admin"