From 6794f5ba8ea30ab47a3e018acf461dc57b22e1a3 Mon Sep 17 00:00:00 2001 From: Kun Lai Date: Mon, 13 Jul 2026 15:25:50 +0800 Subject: [PATCH 1/2] docs(claude): forbid manually editing spec Version/Release and changelog Version/release bumps across the repo (Cargo.toml, Cargo.lock, buildspec.yml, pyproject.toml, and the RPM spec Version + changelog) are produced at a specific release stage by make bump-version-{major,minor,patch}, which regenerates the spec changelog from commit subjects since the last tag. Hand-editing the spec Version/Release or adding a version-stamped changelog entry carries a wrong release number and duplicates the auto-collected commits. Edit the spec only for packaging logic (BuildRequires/Requires, build flags); leave versioning to make bump-version-*. --- CLAUDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CLAUDE.md b/CLAUDE.md index 1bc2cf75..02b81124 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -24,6 +24,7 @@ When creating or amending commits: - **Always** use `--no-gpg-sign` to avoid GPG signing. - **Never commit plan or spec files** (e.g. `docs/*-plan.md`, `docs/*-design.md`, `docs/*-spec.md`, or anything under `docs/superpowers/`). These should be gitignored (already covered by `.gitignore`) and kept local only. - **Never commit any file that is already gitignored** — if a file matches `.gitignore`, it is intentionally local-only. +- **Never manually edit version information in `trusted-network-gateway.spec`** — do not touch the `Version:` or `Release:` fields, and do not add version-stamped `%changelog` entries by hand. Version/release bumps across the whole repo (`Cargo.toml`, `Cargo.lock`, `APPLICATION/tng/buildspec.yml`, `tng-python/pyproject.toml`, and the RPM spec `Version` + `%changelog`) are produced at a specific release stage by `make bump-version-{major,minor,patch}`. That target regenerates the spec changelog from commit subjects since the last tag, so a hand-written entry would both carry a wrong release number and duplicate the auto-collected commits. Edit the spec only for packaging logic (e.g. `BuildRequires`/`Requires`, `%build` flags); leave versioning to `make bump-version-*`. ## Bilingual Documentation Convention From 862c827efe02e6e0571e661ec6a342133045c100 Mon Sep 17 00:00:00 2001 From: Kun Lai Date: Mon, 13 Jul 2026 17:52:49 +0800 Subject: [PATCH 2/2] feat(tdx): replace FFI DCAP verifier with pure-Rust dcap-qvl backend Split the single `builtin-as-tdx` feature into two mutually-exclusive backends: - `builtin-as-tdx-ffi` -> attestation-service/tdx-verifier (legacy FFI backend, links Intel libtdx-attest / libsgx-dcap-quote-verify) - `builtin-as-tdx-rust` -> attestation-service/tdx-dcap-rust (pure Rust dcap-qvl, statically linkable, fetches TDX collateral from a PCCS over HTTPS, no Intel C library dependency) Switch all x86_64-Linux build artifacts (Dockerfiles, Makefile, RPM spec, go-sdk and build-python-sdk workflows) to `builtin-as-tdx-rust` and drop the Intel SGX/TDX repo setup plus libtdx-attest / libsgx-dcap-* packages from both build and runtime stages. Bump the trustee pin (fec2cf58 -> b3009fcd), which introduces the tdx-dcap-rust feature. --- .github/workflows/build-python-sdk.yml | 2 +- .github/workflows/go-sdk.yml | 2 +- Cargo.lock | 445 ++++++++++++++++++++----- Cargo.toml | 4 +- Dockerfile | 14 +- Dockerfile.ubuntu2404 | 30 +- Makefile | 4 +- rats-cert/Cargo.toml | 7 +- scripts/setup-vendor-config | 2 +- tng-wasm/Cargo.toml | 2 +- tng/Cargo.toml | 3 +- trusted-network-gateway.spec | 2 +- 12 files changed, 386 insertions(+), 131 deletions(-) diff --git a/.github/workflows/build-python-sdk.yml b/.github/workflows/build-python-sdk.yml index ebbfa426..5f9adabe 100644 --- a/.github/workflows/build-python-sdk.yml +++ b/.github/workflows/build-python-sdk.yml @@ -64,7 +64,7 @@ jobs: - name: Build tng binary (Linux) if: runner.os == 'Linux' && matrix.target != 'x86_64-pc-windows-gnu' run: | - cargo zigbuild -p tng --release --target ${{ matrix.target }} + cargo zigbuild -p tng --release --target ${{ matrix.target }} --features 'builtin-as-tdx-rust' mkdir -p tng-python/bin/scripts cp target/${{ matrix.target }}/release/tng tng-python/bin/scripts/tng chmod +x tng-python/bin/scripts/tng diff --git a/.github/workflows/go-sdk.yml b/.github/workflows/go-sdk.yml index 2a19ce64..69897e45 100644 --- a/.github/workflows/go-sdk.yml +++ b/.github/workflows/go-sdk.yml @@ -53,7 +53,7 @@ jobs: go-version: "1.21" - name: Build TNG binary - run: cargo build --release -p tng + run: cargo build --release -p tng --features 'builtin-as-tdx-rust' - name: Run Go unit tests run: cd tng-go && go test -v ./... diff --git a/Cargo.lock b/Cargo.lock index 58a439b1..01b69d43 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -265,9 +265,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.98" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487" +checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "arbitrary" @@ -284,6 +284,12 @@ version = "1.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457" +[[package]] +name = "arrayvec" +version = "0.7.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56" + [[package]] name = "as-any" version = "0.3.2" @@ -329,6 +335,12 @@ dependencies = [ "syn 1.0.109", ] +[[package]] +name = "asn1_der" +version = "0.7.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4858a9d740c5007a9069007c3b4e91152d0506f13c1b31dd49051fd537656156" + [[package]] name = "assert-json-diff" version = "2.0.2" @@ -506,9 +518,9 @@ checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de" [[package]] name = "async-trait" -version = "0.1.88" +version = "0.1.89" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5" +checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" dependencies = [ "proc-macro2", "quote", @@ -565,7 +577,7 @@ checksum = "41e67cd8309bbd06cd603a9e693a784ac2e5d1e955f11286e355089fcab3047c" [[package]] name = "attestation-service" version = "0.1.0" -source = "git+https://github.com/openanolis/trustee/?rev=fec2cf58104006012901690d5a38166fb7e06ef6#fec2cf58104006012901690d5a38166fb7e06ef6" +source = "git+https://github.com/openanolis/trustee/?rev=b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e#b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e" dependencies = [ "aes-gcm", "aes-kw", @@ -922,6 +934,18 @@ dependencies = [ "serde_core", ] +[[package]] +name = "bitvec" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837" +dependencies = [ + "funty", + "radium", + "tap", + "wyz", +] + [[package]] name = "block-buffer" version = "0.10.4" @@ -964,13 +988,28 @@ dependencies = [ [[package]] name = "borsh" -version = "1.5.7" +version = "1.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ad8646f98db542e39fc66e68a20b2144f6a732636df7c2354e74645faaa433ce" +checksum = "2f3f6da4992df95bbcd9af42a6c7dcb994498fc9048230405f3b36ff7cd3f145" dependencies = [ + "borsh-derive", + "bytes", "cfg_aliases", ] +[[package]] +name = "borsh-derive" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ae8fb4fb5740e4b2c4884ff95f5f32f5e8479db1e8fd8eb49ddbe09eb09bb7c" +dependencies = [ + "once_cell", + "proc-macro-crate 3.5.0", + "proc-macro2", + "quote", + "syn 2.0.98", +] + [[package]] name = "brotli" version = "8.0.1" @@ -998,6 +1037,12 @@ version = "3.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf" +[[package]] +name = "byte-slice-cast" +version = "1.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7575182f7272186991736b70173b0ea045398f984bf5ebbb3804736ce1330c9d" + [[package]] name = "bytecheck" version = "0.8.2" @@ -1047,6 +1092,12 @@ dependencies = [ "thiserror 2.0.17", ] +[[package]] +name = "cast" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5" + [[package]] name = "cbc" version = "0.1.2" @@ -1176,9 +1227,9 @@ dependencies = [ [[package]] name = "chrono" -version = "0.4.42" +version = "0.4.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2" +checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327" dependencies = [ "iana-time-zone", "js-sys", @@ -1499,9 +1550,9 @@ checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6" [[package]] name = "convert_case" -version = "0.7.1" +version = "0.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb402b8d4c85569410425650ce3eddc7d698ed96d39a73f941b08fb63082f1e7" +checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9" dependencies = [ "unicode-segmentation", ] @@ -1746,6 +1797,7 @@ dependencies = [ "cfg-if", "cpufeatures 0.2.17", "curve25519-dalek-derive", + "digest", "fiat-crypto", "rustc_version", "subtle", @@ -1838,6 +1890,57 @@ version = "2.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476" +[[package]] +name = "dcap-qvl" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "934fdb759919b15d82a2ae4cd019fc0dd5ae8e6ad27841ffe00bf6c9de90d9a1" +dependencies = [ + "anyhow", + "asn1_der", + "base64 0.22.1", + "borsh", + "byteorder", + "chrono", + "const-oid", + "dcap-qvl-webpki", + "der", + "derive_more 2.1.1", + "hex", + "log", + "p256", + "parity-scale-codec", + "pem", + "rustls-pki-types", + "scale-info", + "serde", + "serde-human-bytes", + "serde_json", + "sha2", + "signature", + "urlencoding", + "wasm-bindgen-futures", + "x509-cert", +] + +[[package]] +name = "dcap-qvl-webpki" +version = "0.103.4+dcap.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0af040afe66c4f26ca05f308482d98bd75a35a80a227d877c2e28c9947a9fa6" +dependencies = [ + "ecdsa", + "ed25519-dalek", + "p256", + "p384", + "ring", + "rsa", + "rustls-pki-types", + "sha2", + "signature", + "untrusted", +] + [[package]] name = "deadpool" version = "0.12.3" @@ -1858,9 +1961,9 @@ checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b" [[package]] name = "der" -version = "0.7.9" +version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0" +checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" dependencies = [ "const-oid", "der_derive", @@ -1970,22 +2073,43 @@ dependencies = [ [[package]] name = "derive_more" -version = "2.0.1" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678" +checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05" dependencies = [ - "derive_more-impl", + "derive_more-impl 1.0.0", +] + +[[package]] +name = "derive_more" +version = "2.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134" +dependencies = [ + "derive_more-impl 2.1.1", ] [[package]] name = "derive_more-impl" -version = "2.0.1" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.98", +] + +[[package]] +name = "derive_more-impl" +version = "2.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3" +checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb" dependencies = [ "convert_case", "proc-macro2", "quote", + "rustc_version", "syn 2.0.98", "unicode-xid", ] @@ -2140,6 +2264,27 @@ dependencies = [ "spki", ] +[[package]] +name = "ed25519" +version = "2.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" +dependencies = [ + "signature", +] + +[[package]] +name = "ed25519-dalek" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" +dependencies = [ + "curve25519-dalek", + "ed25519", + "sha2", + "subtle", +] + [[package]] name = "either" version = "1.15.0" @@ -2289,7 +2434,7 @@ dependencies = [ [[package]] name = "eventlog" version = "0.1.0" -source = "git+https://github.com/openanolis/trustee/?rev=fec2cf58104006012901690d5a38166fb7e06ef6#fec2cf58104006012901690d5a38166fb7e06ef6" +source = "git+https://github.com/openanolis/trustee/?rev=b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e#b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e" dependencies = [ "anyhow", "base64 0.21.7", @@ -2507,6 +2652,12 @@ dependencies = [ "libc", ] +[[package]] +name = "funty" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c" + [[package]] name = "futures" version = "0.3.31" @@ -3206,7 +3357,7 @@ checksum = "ebe8aa9b4b2bc5eec2c0c3c1a2be03c73b6e3bf2236286e72541e0c98ca0d52d" dependencies = [ "bytes", "cheap-clone", - "derive_more", + "derive_more 2.1.1", "either", "idna", "memchr", @@ -3681,6 +3832,17 @@ dependencies = [ "icu_properties", ] +[[package]] +name = "impl-trait-for-tuples" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.98", +] + [[package]] name = "indexmap" version = "1.9.3" @@ -3900,11 +4062,12 @@ dependencies = [ [[package]] name = "js-sys" -version = "0.3.77" +version = "0.3.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f" +checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102" dependencies = [ - "once_cell", + "cfg-if", + "futures-util", "wasm-bindgen", ] @@ -4117,9 +4280,9 @@ dependencies = [ [[package]] name = "log" -version = "0.4.26" +version = "0.4.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "30bde2b3dc3671ae49d8e2e9f044c7c005836e7a023ee57cffa25ab82764bb9e" +checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" [[package]] name = "loom" @@ -4223,7 +4386,7 @@ dependencies = [ "byteorder", "bytes", "cbc 0.1.2", - "derive_more", + "derive_more 2.1.1", "either", "futures", "getrandom 0.4.2", @@ -4297,7 +4460,7 @@ dependencies = [ "bytes", "cbc 0.2.0", "cfg-if", - "derive_more", + "derive_more 2.1.1", "either", "futures-channel", "futures-util", @@ -4400,9 +4563,9 @@ dependencies = [ [[package]] name = "minicov" -version = "0.3.7" +version = "0.3.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f27fe9f1cc3c22e1687f9446c2083c4c5fc7f0bcf1c7a86bdbded14985895b4b" +checksum = "4869b6a491569605d66d3952bcdf03df789e5b536e5f0cf7758a7f08a55ae24d" dependencies = [ "cc", "walkdir", @@ -4693,9 +4856,9 @@ dependencies = [ [[package]] name = "num-bigint" -version = "0.4.6" +version = "0.4.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9" +checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367" dependencies = [ "num-integer", "num-traits", @@ -4852,6 +5015,12 @@ dependencies = [ "portable-atomic", ] +[[package]] +name = "oorandom" +version = "11.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e" + [[package]] name = "opaque-debug" version = "0.3.1" @@ -5031,6 +5200,46 @@ dependencies = [ "sha2", ] +[[package]] +name = "p384" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" +dependencies = [ + "ecdsa", + "elliptic-curve", + "primeorder", + "sha2", +] + +[[package]] +name = "parity-scale-codec" +version = "3.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "799781ae679d79a948e13d4824a40970bfa500058d245760dd857301059810fa" +dependencies = [ + "arrayvec", + "bitvec", + "byte-slice-cast", + "const_format", + "impl-trait-for-tuples", + "parity-scale-codec-derive", + "rustversion", + "serde", +] + +[[package]] +name = "parity-scale-codec-derive" +version = "3.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34b4653168b563151153c9e4c08ebed57fb8262bebfa79711552fa983c623e7a" +dependencies = [ + "proc-macro-crate 3.5.0", + "proc-macro2", + "quote", + "syn 2.0.98", +] + [[package]] name = "parking" version = "2.2.1" @@ -5567,9 +5776,9 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.93" +version = "1.0.106" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99" +checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" dependencies = [ "unicode-ident", ] @@ -5896,9 +6105,9 @@ dependencies = [ [[package]] name = "quote" -version = "1.0.38" +version = "1.0.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc" +checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368" dependencies = [ "proc-macro2", ] @@ -5909,6 +6118,12 @@ version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" +[[package]] +name = "radium" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09" + [[package]] name = "rancor" version = "0.1.1" @@ -6183,7 +6398,7 @@ dependencies = [ [[package]] name = "reference-value-provider-service" version = "0.1.0" -source = "git+https://github.com/openanolis/trustee/?rev=fec2cf58104006012901690d5a38166fb7e06ef6#fec2cf58104006012901690d5a38166fb7e06ef6" +source = "git+https://github.com/openanolis/trustee/?rev=b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e#b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e" dependencies = [ "anyhow", "async-trait", @@ -6378,9 +6593,9 @@ dependencies = [ [[package]] name = "ring" -version = "0.17.11" +version = "0.17.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da5349ae27d3887ca812fb375b45a4fbb36d8d12d2df394968cd86e35683fe73" +checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7" dependencies = [ "cc", "cfg-if", @@ -6611,11 +6826,12 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.11.0" +version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c" +checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046" dependencies = [ "web-time", + "zeroize", ] [[package]] @@ -6650,6 +6866,31 @@ dependencies = [ "winapi-util", ] +[[package]] +name = "scale-info" +version = "2.11.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "346a3b32eba2640d17a9cb5927056b08f3de90f65b72fe09402c2ad07d684d0b" +dependencies = [ + "bitvec", + "cfg-if", + "derive_more 1.0.0", + "parity-scale-codec", + "scale-info-derive", +] + +[[package]] +name = "scale-info-derive" +version = "2.11.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c6630024bf739e2179b91fb424b28898baf819414262c5d376677dbff1fe7ebf" +dependencies = [ + "proc-macro-crate 3.5.0", + "proc-macro2", + "quote", + "syn 2.0.98", +] + [[package]] name = "scc" version = "2.3.4" @@ -6826,6 +7067,17 @@ dependencies = [ "serde", ] +[[package]] +name = "serde-human-bytes" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3aff481ca1fe108deba0f217b45d9f1d494e7e7f906bcc7366d8a5648c5a1e65" +dependencies = [ + "base64 0.13.1", + "hex", + "serde", +] + [[package]] name = "serde-wasm-bindgen" version = "0.6.5" @@ -6868,15 +7120,16 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.140" +version = "1.0.150" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373" +checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9" dependencies = [ "indexmap 2.13.0", "itoa", "memchr", - "ryu", "serde", + "serde_core", + "zmij", ] [[package]] @@ -6984,7 +7237,7 @@ dependencies = [ "bitflags 2.11.0", "byteorder", "crossbeam-queue", - "derive_more", + "derive_more 2.1.1", "either", "futures", "humantime-serde", @@ -7497,6 +7750,12 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417" +[[package]] +name = "tap" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369" + [[package]] name = "target-lexicon" version = "0.12.16" @@ -8721,6 +8980,12 @@ dependencies = [ "serde", ] +[[package]] +name = "urlencoding" +version = "2.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" + [[package]] name = "utf-8" version = "0.7.6" @@ -8783,7 +9048,7 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" [[package]] name = "verifier" version = "0.1.0" -source = "git+https://github.com/openanolis/trustee/?rev=fec2cf58104006012901690d5a38166fb7e06ef6#fec2cf58104006012901690d5a38166fb7e06ef6" +source = "git+https://github.com/openanolis/trustee/?rev=b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e#b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e" dependencies = [ "anyhow", "asn1-rs", @@ -8796,6 +9061,7 @@ dependencies = [ "chrono", "codicon", "csv-rs", + "dcap-qvl", "eventlog", "eventlog-rs", "futures", @@ -8822,6 +9088,7 @@ dependencies = [ "tokio", "tonic-build 0.12.3", "tss-esapi", + "urlencoding", "uuid", "x509-parser", ] @@ -8906,48 +9173,32 @@ dependencies = [ [[package]] name = "wasm-bindgen" -version = "0.2.100" +version = "0.2.126" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5" +checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4" dependencies = [ "cfg-if", "once_cell", "rustversion", "wasm-bindgen-macro", -] - -[[package]] -name = "wasm-bindgen-backend" -version = "0.2.100" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6" -dependencies = [ - "bumpalo", - "log", - "proc-macro2", - "quote", - "syn 2.0.98", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-futures" -version = "0.4.50" +version = "0.4.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61" +checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d" dependencies = [ - "cfg-if", "js-sys", - "once_cell", "wasm-bindgen", - "web-sys", ] [[package]] name = "wasm-bindgen-macro" -version = "0.2.100" +version = "0.2.126" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407" +checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -8955,50 +9206,65 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.100" +version = "0.2.126" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de" +checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e" dependencies = [ + "bumpalo", "proc-macro2", "quote", "syn 2.0.98", - "wasm-bindgen-backend", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-shared" -version = "0.2.100" +version = "0.2.126" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d" +checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24" dependencies = [ "unicode-ident", ] [[package]] name = "wasm-bindgen-test" -version = "0.3.50" +version = "0.3.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "66c8d5e33ca3b6d9fa3b4676d774c5778031d27a578c2b007f905acf816152c3" +checksum = "2a0d555ca874445df8d314f94f5c948a4e74e5418f332c89f660a3d8310a96f4" dependencies = [ + "async-trait", + "cast", "js-sys", + "libm", "minicov", + "nu-ansi-term", + "num-traits", + "oorandom", + "serde", + "serde_json", "wasm-bindgen", "wasm-bindgen-futures", "wasm-bindgen-test-macro", + "wasm-bindgen-test-shared", ] [[package]] name = "wasm-bindgen-test-macro" -version = "0.3.50" +version = "0.3.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "17d5042cc5fa009658f9a7333ef24291b1291a25b6382dd68862a7f3b969f69b" +checksum = "94eb68555b95bcea5e8cf4abe280b529049479fa995bfc23734af96a6aedc120" dependencies = [ "proc-macro2", "quote", "syn 2.0.98", ] +[[package]] +name = "wasm-bindgen-test-shared" +version = "0.2.126" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c31d56021e873866c968588ed85ccdf56db5c426e44afdb4618c39895104b920" + [[package]] name = "wasm-encoder" version = "0.244.0" @@ -9077,9 +9343,9 @@ dependencies = [ [[package]] name = "web-sys" -version = "0.3.77" +version = "0.3.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2" +checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141" dependencies = [ "js-sys", "wasm-bindgen", @@ -9646,6 +9912,15 @@ dependencies = [ "web-sys", ] +[[package]] +name = "wyz" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed" +dependencies = [ + "tap", +] + [[package]] name = "x25519-dalek" version = "2.0.1" @@ -9803,18 +10078,18 @@ dependencies = [ [[package]] name = "zeroize" -version = "1.8.1" +version = "1.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde" +checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" dependencies = [ "zeroize_derive", ] [[package]] name = "zeroize_derive" -version = "1.4.2" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69" +checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328" dependencies = [ "proc-macro2", "quote", @@ -9881,6 +10156,12 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2f06ae92f42f5e5c42443fd094f245eb656abf56dd7cce9b8b263236565e00f2" +[[package]] +name = "zmij" +version = "1.0.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" + [[package]] name = "zopfli" version = "0.8.2" diff --git a/Cargo.toml b/Cargo.toml index 0c57993f..5ace6c6f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -26,7 +26,7 @@ as-any = "0.3.2" async-http-proxy = {version = "1.2.5", features = ["runtime-tokio"]} async-stream = "0.3.6" async-trait = "0.1.88" -attestation-service = {git = "https://github.com/openanolis/trustee/", rev = "fec2cf58104006012901690d5a38166fb7e06ef6", default-features = false} +attestation-service = {git = "https://github.com/openanolis/trustee/", rev = "b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e", default-features = false} atty = "0.2.14" auto_enums = {version = "0.8", features = ["std", "tokio1"]} axum = {version = "0.8.4", default-features = false} @@ -96,7 +96,7 @@ rand = "0.9.1" rand_chacha = "0.9.0" rayon = "1.10.0" rcgen = "0.13.2" -reference-value-provider-service = {git = "https://github.com/openanolis/trustee/", rev = "fec2cf58104006012901690d5a38166fb7e06ef6", default-features = false} +reference-value-provider-service = {git = "https://github.com/openanolis/trustee/", rev = "b3009fcd8e7c1c21d8ab34b2522db49e7378bf9e", default-features = false} regex = "1.11.1" reqwest = {version = "=0.12.9", default-features = false, features = ["json", "http2", "rustls-tls-webpki-roots", "brotli", "gzip", "zstd"]}# select 0.12.9 version since we have to align to the hyper-util=0.1.7 version used by hyper-util-wasm # Override quinn to use aws-lc-rs instead of ring for QUIC crypto (default is rustls-ring) diff --git a/Dockerfile b/Dockerfile index 62be1da9..e2c364a9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,10 +6,8 @@ RUN sed -i -E 's|https?://mirrors.cloud.aliyuncs.com/|https://mirrors.aliyun.com # install build dependencies RUN yum install -y git protobuf-devel gcc -# install intel tdx dcap dependencies -RUN yum install -y yum-utils -RUN yum-config-manager --add-repo https://enclave-cn-beijing.oss-cn-beijing.aliyuncs.com/repo/alinux/enclave-expr.repo -RUN yum install -y curl clang perl openssl-devel tpm2-tss tpm2-tss-devel libtdx-attest-devel libsgx-dcap-quote-verify-devel +# install remaining build dependencies +RUN yum install -y curl clang perl openssl-devel tpm2-tss tpm2-tss-devel RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \ sh -s -- -y --no-modify-path --default-toolchain none @@ -23,7 +21,7 @@ RUN . "$HOME/.cargo/env" && rustup show COPY . . -RUN . "$HOME/.cargo/env" && env RUSTFLAGS="--cfg tokio_unstable" cargo install --locked --features 'builtin-as-tdx' --path ./tng/ --root /usr/local/cargo/ +RUN . "$HOME/.cargo/env" && env RUSTFLAGS="--cfg tokio_unstable" cargo install --locked --features 'builtin-as-tdx-rust' --path ./tng/ --root /usr/local/cargo/ # Build libtng_hook.so (LD_PRELOAD hook for tng exec) RUN . "$HOME/.cargo/env" && cargo build --release -p tng-hook-cdylib @@ -35,10 +33,8 @@ FROM alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3: RUN sed -i -E 's|https?://mirrors.cloud.aliyuncs.com/|https://mirrors.aliyun.com/|g' /etc/yum.repos.d/*.repo RUN yum install -y curl iptables iproute && yum clean all -# install intel tdx dcap dependencies -RUN yum install -y yum-utils -RUN yum-config-manager --add-repo https://enclave-cn-beijing.oss-cn-beijing.aliyuncs.com/repo/alinux/enclave-expr.repo -RUN yum install -y tpm2-tss tpm2-tss-devel curl openssl libsgx-dcap-default-qpl libsgx-dcap-quote-verify +# install remaining runtime dependencies +RUN yum install -y tpm2-tss tpm2-tss-devel curl openssl RUN yum reinstall -y ca-certificates COPY --from=builder /usr/local/cargo/bin/tng /usr/local/bin/tng diff --git a/Dockerfile.ubuntu2404 b/Dockerfile.ubuntu2404 index 4691771b..c7fa6d7a 100644 --- a/Dockerfile.ubuntu2404 +++ b/Dockerfile.ubuntu2404 @@ -17,20 +17,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates \ && rm -rf /var/lib/apt/lists/* -# install intel tdx dcap dependencies via Intel SGX repo -RUN mkdir -p /etc/apt/keyrings && \ - curl -fsSLO https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key && \ - mv intel-sgx-deb.key /etc/apt/keyrings/intel-sgx-keyring.asc && \ - tee /etc/apt/sources.list.d/intel-sgx.list > /dev/null < /dev/null <> Building tng binary for current platform..." - cargo build --release -p tng + cargo build --release -p tng --features 'builtin-as-tdx-rust' @echo ">> Copying tng binary to tng-python/bin/scripts/" mkdir -p tng-python/bin/scripts cp target/release/tng tng-python/bin/scripts/tng diff --git a/rats-cert/Cargo.toml b/rats-cert/Cargo.toml index 671904d5..190f70a7 100644 --- a/rats-cert/Cargo.toml +++ b/rats-cert/Cargo.toml @@ -114,7 +114,12 @@ __builtin-as = ["dep:attestation-service", "dep:reference-value-provider-service builtin-as-all = ["__builtin-as", "attestation-service/all-verifier"] builtin-as-sgx = ["__builtin-as", "attestation-service/sgx-verifier"] builtin-as-snp = ["__builtin-as", "attestation-service/snp-verifier"] -builtin-as-tdx = ["__builtin-as", "attestation-service/tdx-verifier"] +builtin-as-tdx-ffi = ["__builtin-as", "attestation-service/tdx-verifier"] +# Pure-Rust dcap-qvl backend (no libtdx-verify/libsgx_dcap_quoteverify link). +# Statically linkable; fetches TDX collateral from a PCCS over HTTPS. +# Mutually exclusive with builtin-as-tdx-ffi (which selects the FFI backend) — +# never enable both in a single build (a compile error is the backstop). +builtin-as-tdx-rust = ["__builtin-as", "attestation-service/tdx-dcap-rust"] default = ["crypto-rustcrypto", "attester-coco", "verifier-coco", "attester-ita", "verifier-ita", "__builtin-as"] diff --git a/scripts/setup-vendor-config b/scripts/setup-vendor-config index 186167b7..aaec994a 100755 --- a/scripts/setup-vendor-config +++ b/scripts/setup-vendor-config @@ -3,7 +3,7 @@ # setup-vendor-config — Configure vendor-specific PCCS settings for TNG builtin AS mode. # # When using TNG's builtin attestation service (e.g., the Docker image built with -# the builtin-as-tdx feature), local quote verification requires a correctly +# the builtin-as-tdx-ffi feature), local quote verification requires a correctly # configured PCCS (Provisioning Certificate Caching Service). If the PCCS_URL in # /etc/sgx_default_qcnl.conf does not point to your cloud provider's service, # quote verification will fail with: diff --git a/tng-wasm/Cargo.toml b/tng-wasm/Cargo.toml index 259194c7..a07e40ba 100644 --- a/tng-wasm/Cargo.toml +++ b/tng-wasm/Cargo.toml @@ -52,8 +52,8 @@ tokio_with_wasm = {workspace = true} tokio_with_wasm_proc = {workspace = true} [dev-dependencies] -wasm-bindgen-test = "=0.3.50" reqwest = {workspace = true} +wasm-bindgen-test = "0.3.76" # https://github.com/rustwasm/wasm-pack/issues/1351#issuecomment-2100231587 [package.metadata.wasm-pack.profile.dev.wasm-bindgen] diff --git a/tng/Cargo.toml b/tng/Cargo.toml index 67407288..e9dc9287 100644 --- a/tng/Cargo.toml +++ b/tng/Cargo.toml @@ -194,4 +194,5 @@ __builtin-as = ["rats-cert/__builtin-as"] builtin-as-all = ["__builtin-as", "rats-cert/builtin-as-all"] builtin-as-sgx = ["__builtin-as", "rats-cert/builtin-as-sgx"] builtin-as-snp = ["__builtin-as", "rats-cert/builtin-as-snp"] -builtin-as-tdx = ["__builtin-as", "rats-cert/builtin-as-tdx"] +builtin-as-tdx-ffi = ["__builtin-as", "rats-cert/builtin-as-tdx-ffi"] +builtin-as-tdx-rust = ["__builtin-as", "rats-cert/builtin-as-tdx-rust"] diff --git a/trusted-network-gateway.spec b/trusted-network-gateway.spec index b2893f8e..a6424282 100644 --- a/trusted-network-gateway.spec +++ b/trusted-network-gateway.spec @@ -53,7 +53,7 @@ A tool for establishing secure communication tunnels in confidential computing. %build # Build tng pushd src/ -RUSTFLAGS="--cfg tokio_unstable" cargo install --locked --path ./tng/ --root %{_builddir}/%{name}-%{version}/install/tng/ +RUSTFLAGS="--cfg tokio_unstable" cargo install --locked --path ./tng/ --features 'builtin-as-tdx-rust' --root %{_builddir}/%{name}-%{version}/install/tng/ # Build libtng_hook.so (LD_PRELOAD hook for transparent TNG tunneling) cargo build -p tng-hook-cdylib --release popd