feat: split mutual_quine_ne into _sha and _pcrs variants - #2
Merged
Conversation
Split the Nitro Enclave example in two so the Kleene fixed point can be
demonstrated on real hardware independently of the reproducible-build
machinery:
- examples/mutual_quine_ne_pcrs (renamed from examples/mutual_quine_ne):
the full scheme, unchanged - each enclave rebuilds its peer's EIF in
RAM and prints the peer's reference PCRs. Internal derivation names
and the EIF name are deliberately kept ("mutual-quine-ne"): they are
substituted into the entrypoint and hence measured, so renaming them
would invalidate the PCR values documented in its README.
- examples/mutual_quine_ne_sha (new): two EIFs that differ in exactly
one file (/app/node.nix); at runtime each enclave evaluates its quine
node, reconstructs the peer's exact source, and prints its SHA-384
digest — chosen to match the digest family of Nitro PCRs, computed
with coreutils sha384sum since builtins.hashString has no SHA-384.
Nothing is rebuilt inside the enclave: no eif_build, no payload of
EIF build inputs, a shared bootstrap ramdisk (so PCR1 is identical
across the two images), and ~2 GiB of enclave memory instead of ~8.
The digests depend only on the template and the transpiler, not on
flake.lock or the architecture.
Signed-off-by: Takuma IMAMURA <takuma.imamura@acompany-ac.com>
hyperfinitism
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splits the Nitro Enclave example in two:
examples/mutual_quine_ne_pcrs(renamed fromexamples/mutual_quine_ne) — the full scheme, unchanged: each enclave rebuilds its peer's EIF in RAM and prints the peer's reference PCRs. Internal derivation names and the EIF name are deliberately kept, since they are substituted into the entrypoint and hence measured — the PCR values documented in its README remain valid (re-verified on the AArch64 Nitro host).examples/mutual_quine_ne_sha(new) — two EIFs that differ in exactly one file (/app/node.nix); at runtime each enclave evaluates its quine node, reconstructs the peer's exact source, and prints its SHA-384 digest. Nothing is rebuilt inside the enclave: noeif_build, no payload of EIF build inputs, a shared bootstrap ramdisk (PCR1 identical across the two images), and ~2 GiB of enclave memory instead of ~8. The digests depend only on the template and the transpiler — not onflake.lockor the architecture.Flake outputs are renamed/added accordingly: packages
mutual-quine-ne-{sha,pcrs}-{nodes,eif1,eif2}, checksmutual-quine-ne-sha-verify-*/mutual-quine-ne-pcrs-verify-*.Verified end to end on the parent VM (m6g.xlarge, AArch64) on 2026-08-07:
nix flake checkpasses including the new_shaverify checks; both_shaenclaves booted on real hardware and printed exactly the SHA-384 digest of their peer's node file, with hypervisor-reported PCR0–2 matching each image's build-timepcr.json; and the rebuilt_pcrsimages'pcr.jsonstill match the README's documented values.