26 commits

Author	SHA1	Message	Date
Harald Hoyer	cd108a5d9f	chore: debug vault with gramine trace ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-08-06 15:12:12 +02:00
Harald Hoyer	840730d598	chore: debug vault with gramine warning ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-08-06 12:57:48 +02:00
Patryk Bęza	51c1e72a03	Use Docker's entrypoint instead of command	2024-07-11 17:49:37 +02:00
Patryk Bęza	78447ea307	Unify verify-attestation-sgx and verify-attestation ... Rationale: too much copy-paste	2024-07-11 17:13:11 +02:00
Patryk Bęza	f90088be76	SGX attestation & batch signature verification tool	2024-07-10 14:47:07 +02:00
otani	ace415a43e	fix: dns for vault nodes	2024-07-09 16:39:04 +03:00
Harald Hoyer	ae01290bcc	chore: change dns names for the vault cluster ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-07-09 11:11:10 +02:00
Harald Hoyer	fd6fe49be7	fix(container-vault-unseal-sgx-azure): correct VAULT_AUTH_TEE_SHA256_FILE ... use the correct environment variable name... sigh Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-07-03 12:08:49 +02:00
Harald Hoyer	f1b8a48a6a	fix: update the common cacert and include it in the unseal container ... The previous cacert expired. A new one was created and also included in the unseal container. The path to access the cacert was fixed in the unseal app and made configurable via an environment variable.	2024-07-03 11:26:29 +02:00
Harald Hoyer	160d133383	fix: hardcode VAULT_AUTH_TEE_VERSION in vault manifest ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-07-03 09:21:25 +02:00
Harald Hoyer	fc3fe37f81	fix: sgx.nonpie_binary option is deprecated ... see https://github.com/gramineproject/gramine/pull/1187 Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-07-02 13:14:38 +02:00
Harald Hoyer	943ef8c878	feat: use nixsgxLib.mkSGXContainer ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-07-01 17:25:00 +02:00
Harald Hoyer	43a7931a40	fix(container-vault-unseal): remove azure config ... Not needed anymore. Stuff can be gathered via the default qpl Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-06-12 13:32:51 +02:00
Harald Hoyer	9c01b0a281	feat: add container-vault-admin ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-06-12 13:32:34 +02:00
Harald Hoyer	de06acbef9	fix: don't tag the nix produced container with latest ... leave it to the github workflow on push to main Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-06-12 13:21:44 +02:00
Harald Hoyer	d0c5950c0e	feat: use nixsgx nix function to create containers ... It refactors the way the SGX containers are built. This removes all `Dockerfile` and gramine manifest files. It also enables a single recipe for azure and non-azure variants. Additionally the `teepot-crate.nix` is now the inherited recipe to build the rust `teepot` crate. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-06-10 16:32:02 +02:00
Harald Hoyer	284393bf76	fix: only restart aesmd if aesm.socket is not readable ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-05-21 13:41:08 +02:00
Harald Hoyer	5fd8df4c2e	fix(deps): use craneLib.removeReferencesToVendoredSources ... to reduce the dependencies pulled in. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-04-09 09:08:07 +02:00
Harald Hoyer	ee7c4ee177	feat: add fmt nix package ... ```shell $ nix run .#fmt ``` does all the automatic formatting the CI checks for. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-03-11 12:39:02 +01:00
Harald Hoyer	0654bacdb5	ci: use crane flake to build with nix ... This enables to add cargo `fmt`, `clippy` and `deny` to nix, using cached results. Move the `teepot` crate to the `crates` subdir to make the life easier for the `crane` flake. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-03-11 10:01:59 +01:00
Harald Hoyer	9680e32e82	fix: cleanup the nix packages ... `curl` and `openssl` have to be specified with `.out` Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-03-08 14:19:31 +01:00
Harald Hoyer	97420df006	feat: attestation test on azure and default dcap ... ``` ❯ docker run -i --rm --privileged --device /dev/sgx_enclave --net host \ matterlabsrobot/teepot-self-attestation-test-sgx-azure:latest \ | base64 -d --ignore-garbage \ | docker run -i --rm --net host matterlabsrobot/verify-attestation-sgx-azure:latest ``` Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-03-07 16:05:27 +01:00
Harald Hoyer	91f1612e0f	chore: cleanup and nixify ... * create containers with nix * updated README.md * added SPDX license headers Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-02-28 11:09:34 +01:00
Harald Hoyer	bf2e4a1b8e	chore(nix): replace nix-filter with lib.fileset ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-02-15 11:23:22 +01:00
Harald Hoyer	d8110f3720	feat: build and push container-verify-attestation ... Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-02-14 16:01:59 +01:00
Harald Hoyer	30539e068f	feat: use snowfall flake for nix ... to make packages reusable by other flakes Signed-off-by: Harald Hoyer <harald@matterlabs.dev>	2024-02-14 11:39:39 +01:00