feat: attestation test on azure and default dcap

```
❯ docker run -i --rm --privileged  --device /dev/sgx_enclave --net host \
  matterlabsrobot/teepot-self-attestation-test-sgx-azure:latest \
  | base64 -d --ignore-garbage \
  | docker run -i --rm --net host matterlabsrobot/verify-attestation-sgx-azure:latest
```

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2024-03-07 15:43:47 +01:00
parent 96f53752f1
commit 97420df006
Signed by: harald
GPG key ID: F519A1143B3FBE32
15 changed files with 355 additions and 28 deletions

View file

@ -0,0 +1,49 @@
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) 2024 Matter Labs
{ pkgs
, vat
, nixsgx
, curl
, teepot
, bash
, coreutils
, openssl
}:
let manifest = ./tee-self-attestation-test.manifest.toml;
in pkgs.dockerTools.buildLayeredImage {
name = "teepot-self-attestation-test-sgx-dcap";
tag = "base";
config.Entrypoint = [ "/bin/sh" "-c" ];
contents = pkgs.buildEnv {
name = "image-root";
paths = with pkgs.dockerTools; with nixsgx;[
bash
coreutils
openssl.out
curl.out
teepot.teepot.tee_self_attestation_test
gramine
restart-aesmd
sgx-dcap.quote_verify
sgx-dcap.default_qpl
sgx-psw
usrBinEnv
binSh
caCertificates
fakeNss
];
pathsToLink = [ "/bin" "/lib" "/etc" "/share" "/app" ];
postBuild = ''
mkdir -p $out/{app,etc}
mkdir -p $out/app/{.dcap-qcnl,.az-dcap-client}
mkdir -p $out/var/run
mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
cp ${manifest} $out/app/tee-self-attestation-test.manifest.toml
printf "precedence ::ffff:0:0/96 100\n" > $out/etc/gai.conf
'';
};
}