Li, Xun
c505e6129a
Added support for Reproducible Enclave Build using Docker file. Added support for Intel AVX-512 instructions and Intel SHA Extensions New Instructions (SHA-NI) in trusted libraries. Support both EPID and ECDSA based quote for quoting related interfaces in sgx_uae_service library. Updated key exchange library to support both EPID and ECDSA based remote attestation. Support new interface to check platform information blob from remote attestation response message. Fixed bugs. Signed-off-by: Li, Xun <xun.li@intel.com>
Reproducible Enclave Build
Intel(R) SGX applications are built a trusted part and untrusted part. The SGX trusted part (Enclave) is protect by Intel® SGX technology. The signed enclave is running in the protected environment, it has the capability to access the sensitive secrets. So, user wants to confirm the enclave is built from the right source code with a clean tool chain. Sometimes, user would get a signed enclave from third party, user may want to confirm the enclave is the right one they should use. Below is a solution to help Intel(R) SGX user to achieve the goal by “reproduce the enclave build”. In order to reproduce the enclave build, there are three requirements:1. stable source code 2. clean and secure environment and 3. auditable build tool chain. In this solution we use two opensource products: Docker and Nix to achive the goal.
Follow the below steps to setup the enclave build environment:
- Install docker on the build machine:
Follow the docker guide.
- Check out the SGX source code:
git clone https://github.com/intel/linux-sgx.git ~/linux-sgx
cd ~/linux-sgx
make dcap_source
./download_prebuilt.sh
- Build docker image:
docker build -t sgx.build.env ~/linux-sgx/linux/docker
- Launch the docker image:
docker run -v ~/linux-sgx:/linux-sgx -it --network none --rm sgx.build.env
- Launch enclave build environment:
nix-shell ~/shell.nix
- Build the sgx sdk installer:
cd /linux-sgx/sdk
make
/linux-sgx/linux/installer/bin/build-installpkg.sh sdk
- Install the sdk installer:
/linux-sgx/linux/installer/bin/sgx_linux_x64_sdk_[version].bin
Build the sample code enclave with SDK
cd [SGX SDK installed folder]
nix-shell ~/shell.nix
source environment
cd SampleCode/SampleEnclave
make enclave.signed.so
Copy the enclave.signed.so out of the docker.