fix: keep enclave signing key out of image builds - #694
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7059c7026e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| RUN --mount=type=secret,id=enclave_key,target=/run/secrets/enclave-key.pem \ | ||
| set -e; \ | ||
| test -n "${ENCLAVE_KEY_PUBLIC_SHA256}"; \ | ||
| test -s /run/secrets/enclave-key.pem; \ | ||
| test "$(openssl rsa -in /run/secrets/enclave-key.pem -pubout 2>/dev/null | openssl sha256 | awk '{print $2}')" = "${ENCLAVE_KEY_PUBLIC_SHA256}"; \ |
There was a problem hiding this comment.
This makes Dockerfile require both ENCLAVE_KEY_PUBLIC_SHA256 and the enclave_key BuildKit secret, but the existing docker/docker-compose*.yml build blocks for Dockerfile only set context/dockerfile (and sometimes ENABLE_SELF_REGISTER) and never provide that arg or secret. Any documented local flow such as docker compose build raiko will now fail at this first signing step (and the same requirement is repeated in the runtime stage), even when the user has docker/enclave-key.pem locally, because compose is not passing it as a build secret.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in 5da6773: compose/CI builds no longer require a BuildKit secret because the Dockerfile generates a throwaway RSA-3072/e=3 key only when no secret/hash is supplied. Release builds still pass ENCLAVE_KEY_PUBLIC_SHA256 and fail if the secret is missing.
e499ba1
into
hotfix/hotfix-based-on-1.16.1
1 participant
Summary
Image
us-docker.pkg.dev/evmchain/images/raiko:latestsha256:9fccfbd3fac4a0305a4f1aea7117c01bfc9cd0c08a7efb82b779eb4b1090c717Verification
bash -n script/publish-image.shgit diff --check origin/hotfix/hotfix-based-on-1.16.1...HEAD -- Dockerfile script/publish-image.sh .dockerignore .gitignore .envSGX_MRENCLAVE=72258d3cae0e9901d0efc1f630064f1c44f11950bd25fee0b62ec8df84532da2SGXGETH_MRENCLAVE=398be8424f27802b38e6e8d3413bf6a0b187349e68522a218f5bfc00279006acmr_signer=e08aef23d4357d47e5ac5f278ba5492a5f5fb145c4fc026995367210f21a333c