mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 07:03:56 +02:00
4fcaaa7398
This PR introduces TEE Prover continuous mode with attestation policies.
Attestation policies are a set of criteria that determine whether an SGX
attestation should be considered valid or invalid. In practice, this
means checking against a specified set of mrsigners, mrenclaves, and TCB
levels. If the attestation’s mrenclave/mrsigner/TCB levels matches those
in the provided --sgx-mrenclaves/--sgx-mrsigners/--sgx-allowed-tcb-levels,
we treat the attestation as successfully verified. Otherwise, the
attestation is considered invalid.
The --continuous mode for the TEE Prover allows it to run continuously,
verifying new batches exposed by the node's RPC API in real-time.
To try it out, run the following commands:
$ nix build -L .#container-verify-era-proof-attestation-sgx
$ export IMAGE_TAG=$(docker load -i result | grep -Po 'Loaded image.*: \K.*')
$ docker run -i --init --rm $IMAGE_TAG --continuous 11505 --rpc https://sepolia.era.zksync.dev --sgx-allowed-tcb-levels Ok,SwHardeningNeeded --log-level debug
$ docker run -i --init --rm $IMAGE_TAG --batch 11509 --rpc https://sepolia.era.zksync.dev --sgx-allowed-tcb-levels Ok,SwHardeningNeeded --log-level debug
72 lines
2.7 KiB
TOML
72 lines
2.7 KiB
TOML
[workspace]
|
|
members = ["crates/*", "bin/*"]
|
|
resolver = "2"
|
|
|
|
[profile.release]
|
|
strip = true
|
|
|
|
[workspace.package]
|
|
version = "0.1.2-alpha.1"
|
|
edition = "2021"
|
|
authors = ["Harald Hoyer <hh@matterlabs.dev>"]
|
|
# rest of the workspace, if not specified in the package section
|
|
# has the standard Apache-2.0 OR MIT license
|
|
license = "Apache-2.0 OR MIT"
|
|
repository = "https://github.com/matter-labs/teepot"
|
|
homepage = "https://github.com/matter-labs/teepot"
|
|
|
|
[workspace.dependencies]
|
|
actix-http = "3"
|
|
actix-tls = "3"
|
|
actix-web = { version = "4.5", features = ["rustls-0_22"] }
|
|
anyhow = "1.0.82"
|
|
ctrlc = "3.4"
|
|
awc = { version = "3.4", features = ["rustls-0_22-webpki-roots"] }
|
|
base64 = "0.22.0"
|
|
bitflags = "2.5"
|
|
bytemuck = { version = "1.15.0", features = ["derive", "min_const_generics", "extern_crate_std"] }
|
|
bytes = "1"
|
|
clap = { version = "4.5", features = ["std", "derive", "env", "error-context", "help", "usage", "wrap_help"], default-features = false }
|
|
const-oid = { version = "0.9", default-features = false }
|
|
der = "0.7.9"
|
|
enumset = { version = "1.1", features = ["serde"] }
|
|
futures-core = { version = "0.3.30", features = ["alloc"], default-features = false }
|
|
getrandom = "0.2.14"
|
|
hex = { version = "0.4.3", features = ["std"], default-features = false }
|
|
intel-tee-quote-verification-rs = { package = "teepot-tee-quote-verification-rs", path = "crates/teepot-tee-quote-verification-rs", version = "0.2.3-alpha.1" }
|
|
intel-tee-quote-verification-sys = { version = "0.2.1" }
|
|
jsonrpsee-types = { version = "0.23", default-features = false }
|
|
secp256k1 = { version = "0.29", features = ["rand-std", "global-context"] }
|
|
log = "0.4"
|
|
num-integer = "0.1.46"
|
|
num-traits = "0.2.18"
|
|
pgp = "0.13"
|
|
p256 = "0.13.2"
|
|
pkcs8 = { version = "0.10" }
|
|
rand = "0.8"
|
|
reqwest = { version = "0.12", features = ["json"] }
|
|
ring = { version = "0.17.8", features = ["std"], default-features = false }
|
|
rsa = { version = "0.9.6", features = ["sha2", "pem"] }
|
|
rustls = { version = "0.22" }
|
|
rustls-pemfile = "2"
|
|
sec1 = { version = "0.7.3", features = ["der"], default-features = false }
|
|
serde = { version = "1", features = ["derive", "rc"] }
|
|
serde_json = "1"
|
|
serde_with = { version = "3.8", features = ["base64", "hex"] }
|
|
sha2 = "0.10.8"
|
|
signature = "2.2.0"
|
|
teepot = { path = "crates/teepot" }
|
|
testaso = "0.1.0"
|
|
thiserror = "1.0.59"
|
|
tokio = { version = "1", features = ["sync", "macros", "rt-multi-thread", "fs", "time"] }
|
|
tracing = "0.1"
|
|
tracing-actix-web = "0.7"
|
|
tracing-log = "0.2"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
url = "2.5.2"
|
|
x509-cert = { version = "0.2", features = ["builder", "signature"] }
|
|
zeroize = { version = "1.7.0", features = ["serde"] }
|
|
webpki-roots = "0.26.1"
|
|
zksync_basic_types = "=0.1.0"
|
|
zksync_web3_decl = "=0.1.0"
|
|
zksync_types = "=0.1.0"
|