From 6f14c611a7e3f28a70afd885f7376374acd06bd8 Mon Sep 17 00:00:00 2001 From: Joshua Date: Thu, 15 Oct 2026 11:10:36 +0300 Subject: [PATCH] ci: stop publishing dev enclave bundles Nothing pins a published bundle any more. The one consumer, infra's dev enclave image, packs the bundle itself from a runtime commit it pins (dev-enclave.sh --pack), and the cosigner builds without the runtime. The releases already published stay where they are. --pack, --prebuilt and scripts/ci-pack.sh are unchanged: they are how a consumer packs the bundle it needs. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish-dev-enclave.yml | 79 ----------------------- README.md | 2 +- docs/DEV_ENCLAVE.md | 13 ++-- scripts/ci-pack.sh | 8 +-- 4 files changed, 11 insertions(+), 91 deletions(-) delete mode 100644 .github/workflows/publish-dev-enclave.yml diff --git a/.github/workflows/publish-dev-enclave.yml b/.github/workflows/publish-dev-enclave.yml deleted file mode 100644 index 7e6264e..0000000 --- a/.github/workflows/publish-dev-enclave.yml +++ /dev/null @@ -1,79 +0,0 @@ -# A dev enclave anyone can download: the bundle `dev-enclave.sh --pack` makes, -# with the harness, the WIT and the container images inside it, published as a -# release asset. Manual, because image options fix PCR0 and a consumer names -# the options its harness expects — see docs/DEV_ENCLAVE.md, "Build here, run -# there". One dispatch is one profile: a name, and the image options as one -# string, which dev-enclave.sh validates value by value. -# -# ubuntu-22.04 rather than latest, on purpose: the host binaries in the bundle -# link glibc, and what was built against 22.04's runs on 22.04 and 24.04 hosts -# where the reverse does not hold. -name: Publish a dev enclave - -on: - workflow_dispatch: - inputs: - profile: - description: A name for this configuration, e.g. merlin-e2e - required: true - type: string - image_args: - description: dev-enclave.sh image options, as one line (--rp-id ..., --allowed-origin ..., --push-app-id ...). A guest's settings are not image options; they are given when a bundle boots. - required: false - default: "" - type: string - -permissions: - contents: write - -env: - CARGO_TERM_COLOR: always - -jobs: - publish: - name: pack, prove, release - runs-on: ubuntu-22.04 - timeout-minutes: 90 - steps: - - uses: actions/checkout@v4 - with: - # The image is built through `builtins.getFlake "git+file://..."`, which wants the - # repository's revision count; a shallow clone has none and Nix refuses it. - fetch-depth: 0 - # Also configures KVM on a hosted runner, which the smoke boot needs. - - uses: DeterminateSystems/nix-installer-action@main - - uses: ./.github/actions/rust - with: - shared-key: guests - workspaces: | - . -> target - examples/guest-http -> target - examples/guest-grpc -> target - - uses: actions/cache@v4 - with: - path: target/qemu-nitro/tools - key: vhost-device-vsock-${{ hashFiles('scripts/lib.sh') }} - - name: Pack, then run the whole stack from the tarball - env: - # A runner boots the emulated enclave more slowly than a workstation. - TIMEOUT: 480 - run: scripts/ci-pack.sh out "${{ inputs.profile }}" ${{ inputs.image_args }} - - name: Release - env: - GH_TOKEN: ${{ github.token }} - run: | - tag="dev-enclave-${{ inputs.profile }}-$(git rev-parse --short HEAD)" - pcr0="$(jq -r .PCR0 "out/${{ inputs.profile }}/eif/pcr.json")" - if ! gh release view "$tag" >/dev/null 2>&1; then - gh release create "$tag" --target "$GITHUB_SHA" --prerelease --title "$tag" \ - --notes "Dev enclave bundle, profile ${{ inputs.profile }}. - PCR0 \`$pcr0\` - Image options: \`${{ inputs.image_args }}\` - Run it: \`/deploy/qemu-nitro/dev-enclave.sh --prebuilt --guest your.wasm\`" - fi - gh release upload --clobber "$tag" "out/$tag.tar.gz" "out/$tag.tar.gz.sha256" - - uses: actions/upload-artifact@v4 - if: failure() - with: - name: pack-smoke-logs - path: out/smoke/target/qemu-nitro/e2e/*.log diff --git a/README.md b/README.md index 1863150..6721a7a 100644 --- a/README.md +++ b/README.md @@ -256,7 +256,7 @@ The first run builds an enclave image and takes a while. The harness prints the **The emulator exercises the protocol, not AWS's hardware trust boundary.** It uses a development master key, and it signs attestation documents with a chain it mints at each boot because QEMU's NSM cannot produce AWS-signed ones. It also runs on the host clock. Use it with test data only. -To build on one machine and run on another, `--pack` produces a self-contained bundle and `--prebuilt` runs one; the *Publish a dev enclave* workflow attaches such bundles to GitHub releases. See the [development guide](docs/DEV_ENCLAVE.md). +To build on one machine and run on another, `--pack` produces a self-contained bundle and `--prebuilt` runs one; a consumer packs the bundle it needs from a commit it pins. See the [development guide](docs/DEV_ENCLAVE.md). ### 3. Make an authenticated, stateful request diff --git a/docs/DEV_ENCLAVE.md b/docs/DEV_ENCLAVE.md index 0c5d6fa..c4d5116 100644 --- a/docs/DEV_ENCLAVE.md +++ b/docs/DEV_ENCLAVE.md @@ -207,13 +207,12 @@ the udev rule `scripts/lib.sh`'s `prepare_enclave_host` applies. Image options a short path: its sockets live under `DIR/target/qemu-nitro//`, and a Unix socket path is at most 107 bytes — past that `vhost-device-vsock` fails with "path must be shorter than SUN_LEN". -`scripts/ci-pack.sh OUT PROFILE [image options...]` is the whole release step: it packs, tars the -bundle as `dev-enclave-PROFILE-.tar.gz` with a `.sha256`, and then runs `run-e2e.sh` — all -eight legs — from an extracted copy with nothing pointing at the checkout. The "Publish a dev -enclave" workflow runs it on a hosted runner and attaches the result to a release named after the -profile and the revision. One bundle is one configuration: image options are measured into PCR0, -so a consumer publishes the options its harness expects, pins the bundle built from them, and -checks `image.env` against them before booting. +A consumer packs the bundle it needs from a commit it pins: `dev-enclave.sh --pack DIR`, or +`scripts/ci-pack.sh OUT PROFILE [image options...]`, which also tars the bundle as +`dev-enclave-PROFILE-.tar.gz` with a `.sha256` and then runs `run-e2e.sh` — all eight legs — +from an extracted copy with nothing pointing at the checkout. One bundle is one configuration: +image options are measured into PCR0, so a consumer packs with the options its harness expects +and checks `image.env` against them before booting. The attestation chain the emulator mints is valid for 30 days, so a long-running host has to be restarted within that — with `--keep-store`, a restart costs nothing but new pins. diff --git a/scripts/ci-pack.sh b/scripts/ci-pack.sh index b94476c..d642e0a 100755 --- a/scripts/ci-pack.sh +++ b/scripts/ci-pack.sh @@ -1,5 +1,6 @@ #!/usr/bin/env bash -# A dev enclave, built here and runnable anywhere: the bundle a release carries. +# A dev enclave, built here and runnable anywhere: the bundle a consumer packs +# from a commit it pins. # # scripts/ci-pack.sh OUT PROFILE [image options...] # @@ -15,9 +16,8 @@ # The example guest is what the smoke boots; a bundle carries no guest, and # whoever runs it names their own. # -# Image options fix PCR0, so one bundle is one configuration. A consumer -# repository publishes the options its harness expects and pins the bundle -# built from them — see docs/DEV_ENCLAVE.md. +# Image options fix PCR0, so one bundle is one configuration. A consumer packs +# with the options its harness expects — see docs/DEV_ENCLAVE.md. . "$(dirname "${BASH_SOURCE[0]}")/lib.sh" cd "$REPO"