harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 07:03:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
454 commits 22 branches 61 tags 2.2 MiB
Commit graph

454 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lucille L. Blumire
2ff169da9f
refactor: improve type ergonomics 2025-04-17 16:52:56 +01:00
Lucille L. Blumire
0768b0ad67
refactor: prefer conversion methods to infallable casts 2025-04-17 16:52:54 +01:00
Lucille L. Blumire
2dea589c0e
refactor: prefer inline format args 2025-04-17 16:52:53 +01:00
Lucille L. Blumire
71a04ad4e2
refactor: bring items to top level of files 2025-04-17 16:52:49 +01:00
Harald Hoyer
b8398ad15f
Merge pull request #303 from matter-labs/ld_library_path 
refactor(shells): simplify environment variable declarations
 2025-04-14 18:02:07 +02:00
Harald Hoyer
8903c1dc62
Merge branch 'main' into ld_library_path 2025-04-14 17:52:44 +02:00
Harald Hoyer
2d9a7bd384
Merge pull request #304 from matter-labs/intel-dcap-api-descriptionj 
feat: add description to intel-dcap-api package
 2025-04-14 17:52:21 +02:00
Harald Hoyer
d03ed96bb8
feat: add description to intel-dcap-api package 
- Added a description field to the Cargo.toml for the intel-dcap-api crate.
 2025-04-14 17:26:21 +02:00
Harald Hoyer
7b1c386e14
refactor(shells): simplify environment variable declarations 
Refactored the environment variable setup by consolidating into a single `env` map for better clarity.
- Removed `TEE_LD_LIBRARY_PATH` and inlined its logic directly within `LD_LIBRARY_PATH`.
- Improved structure and readability of configuration-specific variables like `QCNL_CONF_PATH`.

Let us run directly on x86_64:
```
❯ cargo run --bin verify-era-proof-attestation -- \
            --rpc https://mainnet.era.zksync.io \
            --continuous 493220 \
            --attestation-policy-file bin/verify-era-proof-attestation/examples/attestation_policy.yaml \
            --tee-types sgx \
            --log-level info
```
 2025-04-14 17:07:35 +02:00
Harald Hoyer
9b9acfc0c6
Merge pull request #302 from matter-labs/intel-dcap-api 
feat(api): add Intel DCAP API client module
 2025-04-11 20:12:31 +02:00
Harald Hoyer
1a392e800a
fixup! refactor(intel-dcap-api): split client.rs into smaller files 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-11 12:34:09 +02:00
Harald Hoyer
4501b3421c
fixup! refactor(intel-dcap-api): split client.rs into smaller files 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-11 12:23:53 +02:00
Harald Hoyer
0e69105a43
refactor(intel-dcap-api): split client.rs into smaller files 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-11 11:06:13 +02:00
Harald Hoyer
ed84a424db
feat(api): add Intel DCAP API client module 
Introduced a new `intel-dcap-api` crate for interacting with Intel's DCAP APIs.
- Implemented various API client functionalities for SGX/TDX attestation services.
- Added support for registration, certification, enclave identity, and FMSPC retrieval.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-10 14:51:51 +02:00
Harald Hoyer
93c35dad38
Merge pull request #300 from matter-labs/darwin 
feat: compat code for non `x86_64-linux`
 2025-04-10 13:25:33 +02:00
Harald Hoyer
0b8f1d54c7
feat: bump rust version to 1.86 
fixes the hardcoded `/usr/bin/strip` issue on macos

see https://github.com/rust-lang/rust/issues/131206

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-10 11:57:47 +02:00
Harald Hoyer
eb39705ff1
feat: compat code for non x86_64-linux 
- do not build packages, which require `x86_64-linux`
- use Phala `dcap-qvl` crate for remote attestation, if possible
- nix: exclude `nixsgx` on non `x86_64-linux` platforms

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-10 11:57:46 +02:00
Harald Hoyer
ed808efd03
Merge pull request #296 from matter-labs/verify-era-proof-attestation-tdx 
refactor(verify-era-proof-attestation): modularize and restructure proof verification logic
 2025-04-07 10:13:52 +02:00
Harald Hoyer
95b6a2d70a
refactor(verify-era-proof-attestation): replace watch channel with CancellationToken 
Refactored stop signal handling in all components to use `tokio_util::sync::CancellationToken` instead of `tokio::sync::watch`.

- Improved cancellation logic by leveraging `CancellationToken` for cleaner and more efficient handling.
- Updated corresponding dependency to `tokio-util` version `0.7.14`.
 2025-04-07 08:54:00 +02:00
Harald Hoyer
2605e2ae3a
refactor(verify-era-proof-attestation): modularize and restructure proof verification logic 
- Split `verify-era-proof-attestation` into modular subcomponents for maintainability.
- Moved client, proof handling, and core types into dedicated modules.
 2025-04-04 17:05:30 +02:00
Harald Hoyer
1e853f653a
refactor(quote): move TCB level logic to a dedicated module 
- Extracted `TcbLevel` functionality from `sgx` module to `quote::tcblevel`.
- Updated all references to import `TcbLevel` and related utilities from `quote::tcblevel`.
- Updated copyright headers to reflect the new year range.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-04 17:05:23 +02:00
Harald Hoyer
2ba5c45d31
Merge pull request #299 from matter-labs/leftover 
fix(teepot-vault): remove leftover `tdx` module
 2025-04-04 16:04:09 +02:00
Harald Hoyer
8596e0dc6a
fix(teepot-vault): remove leftover tdx module 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-04 14:40:43 +02:00
Harald Hoyer
fdad63e4b1
Merge pull request #298 from matter-labs/yaml 
feat(ci): switch to GitHub Container Registry for images
 2025-04-02 17:28:06 +02:00
Harald Hoyer
3257f316b5
feat(ci): switch to GitHub Container Registry for images 
Updated the workflow to push container images to GitHub Container Registry instead of Docker Hub. Added a login step for GHCR and updated image tagging and pushing commands accordingly.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-02 17:10:20 +02:00
Harald Hoyer
542e3a9fcc
Merge pull request #297 from matter-labs/pre-exec-context 
fix(tee-key-preexec): add context to file write operations
 2025-04-02 16:43:25 +02:00
Harald Hoyer
e27b5da856
fix(tee-key-preexec): add context to file write operations 
- Add context to `std::fs::write` calls to improve error tracing.
- Ensures better debugging by attaching filenames to potential errors.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-04-02 16:18:27 +02:00
Harald Hoyer
9114c47b90
Merge pull request #292 from matter-labs/teepot_vault 
chore: split-out vault code from `teepot` in `teepot-vault`
 2025-04-02 15:18:01 +02:00
Harald Hoyer
f03a8ba643
Merge branch 'main' into teepot_vault 2025-03-28 14:13:14 +01:00
Harald Hoyer
49568c66a7
Merge pull request #295 from matter-labs/sha384-extend 
feat(bin): enhance SHA384 extend utility with padding and tests
 2025-03-28 13:57:21 +01:00
Harald Hoyer
fa2ecee4bd
feat(sha384-extend): enhance SHA384 extend utility with padding and tests 
- Refactor `sha384-extend` to include digest padding and validation.
- Add `extend_sha384` function for hex-string-based digest extension.
- Introduce comprehensive test coverage for edge cases and errors.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-28 12:55:13 +01:00
Harald Hoyer
7258452b79
Merge pull request #294 from matter-labs/proper_otlp_http_logging 
feat(config): update OTLP endpoint and protocol handling
 2025-03-26 16:21:07 +01:00
Harald Hoyer
982fcc363b
Merge branch 'main' into teepot_vault 2025-03-25 13:40:50 +01:00
Harald Hoyer
e62aff3511
feat(config): update OTLP endpoint and protocol handling 
- Change default OTLP endpoint to match the HTTP/JSON spec.
- Add dynamic protocol-based exporter configuration.
- Support both gRPC and HTTP/JSON transports for logging.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-25 11:49:57 +01:00
Harald Hoyer
6c3bd96617
Merge pull request #293 from matter-labs/tdx_wait_for_vector 
feat(tdx_google): add iproute2 and vector initialization wait
 2025-03-21 13:26:34 +01:00
Harald Hoyer
3f90e4f80b
feat(tdx_google): add iproute2 and vector initialization wait 
- Include iproute2 in the container path for required networking tools.
- Add a script to wait for vector to initialize before proceeding.
 2025-03-21 13:11:23 +01:00
Harald Hoyer
f8bd9e6a08
chore: split-out vault code from teepot in teepot-vault 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-06 09:47:51 +01:00
Harald Hoyer
63c16b1177
Merge pull request #291 from matter-labs/no_quote 
fix(verify-attestation): bail out, if no quote provided
 2025-03-06 09:44:32 +01:00
Harald Hoyer
7cb3af4b65
Merge branch 'main' into no_quote 2025-03-06 09:30:33 +01:00
Harald Hoyer
51dc68b12f
Merge pull request #290 from matter-labs/self-attestation-readme-podman 
docs(tee-self-attestation-test): add podman example
 2025-03-06 09:30:17 +01:00
Harald Hoyer
55ea2a6069
fix(verify-attestation): bail out, if no quote provided 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-06 09:07:31 +01:00
Harald Hoyer
98ed802b75
docs(tee-self-attestation-test): add podman example 
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-06 08:57:55 +01:00
Harald Hoyer
89145514b0
Merge pull request #285 from matter-labs/missing_recoverid_two 
fix(verify-era-proof-attestation): handle missing RecoveryId signatures
 2025-03-03 10:47:59 +01:00
Harald Hoyer
bece17f7bf
Merge branch 'main' into missing_recoverid_two 2025-03-03 08:52:32 +01:00
Harald Hoyer
bce991f77c
Merge pull request #283 from matter-labs/rustls_ring_provider 
fix(teepot-vault): use `ring` as `CryptoProvider` for `rustls`
 2025-03-01 09:36:27 +01:00
Harald Hoyer
589e375d47
Merge branch 'main' into rustls_ring_provider 2025-03-01 09:11:21 +01:00
Harald Hoyer
a6ea98a096
fix(verify-era-proof-attestation): handle missing RecoveryId signatures 
- add `RecoveryId::Two` and `RecoveryId::Three`

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-03-01 09:07:29 +01:00
Harald Hoyer
736fe10200
Merge pull request #284 from matter-labs/missing_recoverid 
fix(verify-era-proof-attestation): handle missing RecoveryId signatures
 2025-02-28 19:31:49 +01:00
Harald Hoyer
c26b3db290
fix(verify-era-proof-attestation): handle missing RecoveryId signatures 
- Add fallback for missing RecoveryId in 64-byte signatures.
- Improve error context for invalid signature length.
- Add debug and trace logs for better diagnosis during verification.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-02-28 17:31:59 +01:00
Harald Hoyer
d6061c35a8
fix(teepot-vault): use ring as CryptoProvider for rustls 
New `rustls` needs global install of default `CryptoProvider`.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
 2025-02-28 14:14:57 +01:00