Skip to content

Commit c093c64

Browse files
circle-github-action-botcircle-github-action-bot
committed
🔄 synced local './' with remote './'
1 parent a9e9fdb commit c093c64

163 files changed

Lines changed: 14667 additions & 2097 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
coverage/
77
test_results/
88
logs/
9+
bin/
910
artifacts/
1011
!artifacts/nitro-enclave-image/
1112
deploy/

‎.github/actions/cloudsmith-login/action.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Cloudsmith Docker Login
2+
description: Exchange GitHub OIDC token for Cloudsmith credentials and log in to the Docker registry.
3+
4+
inputs:
5+
registry:
6+
description: Cloudsmith Docker registry hostname
7+
required: true
8+
org:
9+
description: Cloudsmith organization
10+
required: false
11+
default: circle
12+
service-slug:
13+
description: Cloudsmith OIDC service account slug
14+
required: false
15+
default: arc-publisher-gha-service
16+
17+
runs:
18+
using: composite
19+
steps:
20+
- name: Get Cloudsmith token
21+
id: get-token
22+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
23+
env:
24+
CLOUDSMITH_ORG: ${{ inputs.org }}
25+
CLOUDSMITH_SERVICE_SLUG: ${{ inputs.service-slug }}
26+
with:
27+
script: |-
28+
let oidc_token;
29+
try {
30+
oidc_token = await core.getIDToken();
31+
core.setSecret(oidc_token);
32+
} catch (error) {
33+
core.setFailed(`Failed to get OIDC token: ${error}`);
34+
return;
35+
}
36+
try {
37+
const response = await fetch(`https://api.cloudsmith.io/openid/${process.env.CLOUDSMITH_ORG}/`, {
38+
method: 'POST',
39+
headers: {
40+
'Content-Type': 'application/json',
41+
},
42+
body: JSON.stringify({
43+
oidc_token: oidc_token,
44+
service_slug: process.env.CLOUDSMITH_SERVICE_SLUG
45+
}),
46+
signal: AbortSignal.timeout(30000),
47+
});
48+
if (!response.ok) {
49+
core.setFailed(`Cloudsmith OIDC exchange failed: ${response.status} ${response.statusText}`);
50+
return;
51+
}
52+
const data = await response.json();
53+
core.setSecret(data.token);
54+
core.setOutput('cloudsmith_user', process.env.CLOUDSMITH_SERVICE_SLUG);
55+
core.setOutput('cloudsmith_token', data.token);
56+
} catch (error) {
57+
core.setFailed(`Failed to login to Cloudsmith: ${error}`);
58+
return;
59+
}
60+
61+
- name: Login to Cloudsmith
62+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
63+
with:
64+
registry: ${{ inputs.registry }}
65+
username: ${{ steps.get-token.outputs.cloudsmith_user }}
66+
password: ${{ steps.get-token.outputs.cloudsmith_token }}

‎.github/workflows/build-docker.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Build Docker
2+
3+
on:
4+
pull_request:
5+
types: [labeled, synchronize]
6+
branches:
7+
- main
8+
- release/*
9+
push:
10+
tags:
11+
- "v*"
12+
13+
concurrency:
14+
group: docker-${{ github.ref }}
15+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
16+
17+
jobs:
18+
enclave:
19+
if: >-
20+
github.event_name == 'push' ||
21+
contains(github.event.pull_request.labels.*.name, 'build-docker')
22+
uses: ./.github/workflows/nitro-enclave-build.yaml
23+
24+
docker:
25+
needs: [enclave]
26+
uses: ./.github/workflows/build-enclave-image.yaml
27+
with:
28+
push: ${{ github.event_name == 'push' }}
29+
version: ${{ github.ref_name }}
30+
enclave_artifact_name: ${{ needs.enclave.outputs.image_artifact_name }}
31+
enclave_file: ${{ needs.enclave.outputs.output_file }}
32+
enclave_pcr0: ${{ needs.enclave.outputs.pcr0 }}
33+
enclave_pcr1: ${{ needs.enclave.outputs.pcr1 }}
34+
enclave_pcr2: ${{ needs.enclave.outputs.pcr2 }}

‎.github/workflows/build-enclave-image.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Build Docker
2+
3+
on:
4+
workflow_call:
5+
outputs:
6+
docker_archive_artifact_name:
7+
description: Docker archive artifact name for the built signer-with-enclave image
8+
value: ${{ jobs.build.outputs.docker_archive_artifact_name }}
9+
inputs:
10+
runner:
11+
type: string
12+
default: ubuntu-latest
13+
docker_archive_artifact_name:
14+
description: Artifact name for an optional signer-with-enclave docker archive upload
15+
type: string
16+
default: ""
17+
enclave_artifact_name:
18+
type: string
19+
required: true
20+
enclave_file:
21+
type: string
22+
required: true
23+
enclave_pcr0:
24+
type: string
25+
required: true
26+
enclave_pcr1:
27+
type: string
28+
required: true
29+
enclave_pcr2:
30+
type: string
31+
required: true
32+
33+
jobs:
34+
build:
35+
name: Build signer-with-enclave
36+
permissions:
37+
contents: read
38+
runs-on: ${{ inputs.runner }}
39+
outputs:
40+
docker_archive_artifact_name: ${{ steps.archive_meta.outputs.name }}
41+
steps:
42+
- name: Checkout
43+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
44+
45+
- name: Download EIF artifact
46+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
47+
with:
48+
name: ${{ inputs.enclave_artifact_name }}
49+
path: artifacts/${{ inputs.enclave_artifact_name }}
50+
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
53+
54+
- name: Build image
55+
id: build
56+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
57+
with:
58+
source: .
59+
files: docker-bake.hcl
60+
targets: signer-with-enclave
61+
set: |
62+
signer-with-enclave.platform=linux/amd64
63+
signer-with-enclave.tags=
64+
signer-with-enclave.output=type=oci,tar=false,dest=./oci-image
65+
env:
66+
BUILDX_NO_DEFAULT_ATTESTATIONS: 1
67+
CI: true
68+
ENCLAVE_EIF: artifacts/${{ inputs.enclave_artifact_name }}/${{ inputs.enclave_file }}
69+
ENCLAVE_PCR0: ${{ inputs.enclave_pcr0 }}
70+
ENCLAVE_PCR1: ${{ inputs.enclave_pcr1 }}
71+
ENCLAVE_PCR2: ${{ inputs.enclave_pcr2 }}
72+
73+
- name: Trivy vulnerability scan
74+
env:
75+
TRIVY_IMAGE: aquasec/trivy:0.71.2@sha256:f5d0e600ecda7449e2a9b272805aef698631d3bb3f3a739a750de2c6819acdc9
76+
run: |
77+
docker run --rm \
78+
-v "${GITHUB_WORKSPACE}:/workspace" \
79+
"${TRIVY_IMAGE}" image \
80+
--input /workspace/oci-image \
81+
--format sarif \
82+
--output /workspace/trivy-results.sarif \
83+
--severity CRITICAL \
84+
--ignore-unfixed \
85+
--exit-code 1
86+
87+
- name: Upload Trivy scan results
88+
if: always()
89+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
90+
with:
91+
name: trivy-signer-with-enclave
92+
path: trivy-results.sarif
93+
94+
- name: Record docker archive artifact name
95+
id: archive_meta
96+
run: echo "name=${ARTIFACT_NAME}" >> "$GITHUB_OUTPUT"
97+
env:
98+
ARTIFACT_NAME: ${{ inputs.docker_archive_artifact_name }}
99+
100+
- name: Export docker archive for smoke validation
101+
if: ${{ inputs.docker_archive_artifact_name != '' }}
102+
run: |
103+
skopeo copy \
104+
"oci:./oci-image" \
105+
"docker-archive:./signer-with-enclave.tar:nitro-enclave-signer/signer-with-enclave:smoke"
106+
107+
- name: Upload docker archive artifact
108+
if: ${{ inputs.docker_archive_artifact_name != '' }}
109+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
110+
with:
111+
name: ${{ inputs.docker_archive_artifact_name }}
112+
path: signer-with-enclave.tar
113+
compression-level: 0
114+
retention-days: 1

‎.github/workflows/nitro-enclave-build.yaml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: Nitro Enclave Build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
runner:
7+
description: "Runner label for the build job."
8+
type: string
9+
default: "ubuntu-latest"
10+
artifact_name:
11+
description: "Name for the uploaded EIF artifact."
12+
type: string
13+
default: "nitro-enclave-image"
14+
retention_days:
15+
description: "Artifact retention in days."
16+
type: number
17+
default: 1
18+
cli_commit:
19+
description: >-
20+
Commit SHA of aws-nitro-enclaves-cli to build from.
21+
WARNING: changing this value can alter PCR0 and PCR2 measurements
22+
because nitro-cli controls the kernel and init ramdisk bundled
23+
into the EIF. Coordinate with downstream attestation policies.
24+
type: string
25+
default: "18a5f6f35f110c0f235f193ae3caff9434d64ee1" # v1.4.5
26+
outputs:
27+
image_artifact_name:
28+
description: "Name of the artifact containing the EIF."
29+
value: ${{ jobs.build.outputs.image_artifact_name }}
30+
output_file:
31+
description: "Path to the EIF file within the artifact."
32+
value: ${{ jobs.build.outputs.output_file }}
33+
pcr0:
34+
description: "PCR0 measurement (enclave image hash)."
35+
value: ${{ jobs.build.outputs.pcr0 }}
36+
pcr1:
37+
description: "PCR1 measurement (Linux kernel hash)."
38+
value: ${{ jobs.build.outputs.pcr1 }}
39+
pcr2:
40+
description: "PCR2 measurement (application hash)."
41+
value: ${{ jobs.build.outputs.pcr2 }}
42+
43+
permissions:
44+
contents: read
45+
46+
jobs:
47+
build:
48+
runs-on: ${{ inputs.runner }}
49+
timeout-minutes: 30
50+
outputs:
51+
image_artifact_name: ${{ steps.eif.outputs.image_artifact_name }}
52+
output_file: ${{ steps.eif.outputs.output_file }}
53+
pcr0: ${{ steps.eif.outputs.pcr0 }}
54+
pcr1: ${{ steps.eif.outputs.pcr1 }}
55+
pcr2: ${{ steps.eif.outputs.pcr2 }}
56+
steps:
57+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
58+
59+
- name: Set up Docker Buildx
60+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
61+
62+
- name: Build enclave image
63+
run: docker buildx bake --provenance=false --allow fs.read=./docker/certs enclave
64+
65+
- name: Restore nitro-cli from cache
66+
id: cli-cache
67+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
68+
with:
69+
path: /tmp/nitro-install
70+
key: nitro-cli-${{ inputs.cli_commit }}-${{ runner.os }}-${{ runner.arch }}
71+
72+
- name: Install Rust toolchain
73+
if: steps.cli-cache.outputs.cache-hit != 'true'
74+
uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
75+
with:
76+
toolchain: stable
77+
78+
- name: Build nitro-cli from source
79+
if: steps.cli-cache.outputs.cache-hit != 'true'
80+
env:
81+
COMMIT: ${{ inputs.cli_commit }}
82+
run: |
83+
sudo apt-get update
84+
sudo apt-get install -y --no-install-recommends \
85+
curl tar build-essential clang gcc \
86+
libssl-dev pkg-config musl-tools
87+
88+
mkdir -p /tmp/nitro-src
89+
curl -sSfL "https://github.com/aws/aws-nitro-enclaves-cli/archive/${COMMIT}.tar.gz" | \
90+
tar -C /tmp/nitro-src -xz --strip-components=1
91+
92+
cd /tmp/nitro-src
93+
make vsock-proxy-native nitro-cli-native
94+
mkdir -p /tmp/nitro-install
95+
NITRO_CLI_INSTALL_DIR=/tmp/nitro-install make install-tools
96+
97+
- name: Install nitro-cli
98+
run: sudo cp -a /tmp/nitro-install/. /
99+
100+
- name: Build EIF
101+
id: eif
102+
run: |
103+
sudo mkdir -p /var/log/nitro_enclaves
104+
sudo chmod 777 /var/log/nitro_enclaves
105+
106+
nitro-cli build-enclave \
107+
--docker-uri nitro-enclave-signer/enclave:latest \
108+
--output-file enclave.eif
109+
110+
nitro-cli describe-eif \
111+
--eif-path enclave.eif \
112+
> describe_eif.json
113+
114+
echo "image_artifact_name=${{ inputs.artifact_name }}" >> "$GITHUB_OUTPUT"
115+
echo "output_file=enclave.eif" >> "$GITHUB_OUTPUT"
116+
pcr0=$(jq -er '.Measurements.PCR0' describe_eif.json)
117+
pcr1=$(jq -er '.Measurements.PCR1' describe_eif.json)
118+
pcr2=$(jq -er '.Measurements.PCR2' describe_eif.json)
119+
echo "pcr0=${pcr0}" >> "$GITHUB_OUTPUT"
120+
echo "pcr1=${pcr1}" >> "$GITHUB_OUTPUT"
121+
echo "pcr2=${pcr2}" >> "$GITHUB_OUTPUT"
122+
123+
- name: Upload EIF and metadata
124+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
125+
with:
126+
name: ${{ inputs.artifact_name }}
127+
retention-days: ${{ inputs.retention_days }}
128+
path: |
129+
enclave.eif
130+
describe_eif.json

‎.github/workflows/pipeline-common-ci.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ jobs:
99
env:
1010
APP_ENV: qa
1111
steps:
12-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
12+
- uses: actions/checkout@v4
1313

14-
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
14+
- uses: actions/setup-go@v5
1515
with:
1616
go-version: "1.24"
1717

‎Makefile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ proto: ## Generate protocol buffers
1515
build: proto ## Build application binary
1616
@$(SCRIPTS)/build.sh
1717

18-
local-enclave-docker: build ## Build local enclave docker image
19-
@docker buildx bake --set "*.tags=$(ENCLAVE_NAME):local" signer
18+
local-enclave-docker: ## Build local enclave docker image
19+
@docker buildx bake --set "*.tags=$(ENCLAVE_NAME):local" signer-dev
2020

2121
#------------------------------------------------------------------------------
2222
# Test
@@ -25,7 +25,7 @@ local-enclave-docker: build ## Build local enclave docker image
2525
test: build ## Run unit tests and linting
2626
@$(SCRIPTS)/test.sh
2727

28-
test-it: up ## Run integration tests
28+
test-it: build up ## Run integration tests
2929
@RUN_IT_TESTS=true $(SCRIPTS)/test.sh
3030

3131
test-all: test-it smoke ## Run all tests
@@ -40,7 +40,7 @@ test-reproducibility: ## Verify enclave build reproducibility
4040
# Development
4141
#------------------------------------------------------------------------------
4242

43-
dev: up ## Start local development
43+
dev: build up ## Start local development
4444
@$(SCRIPTS)/dev.sh
4545

4646
up: local-enclave-docker ## Start dependencies

0 commit comments

Comments
 (0)