Skip to content
This repository was archived by the owner on Jan 27, 2022. It is now read-only.

Commit 68d9910

Browse files
author
Ramakrishna Srinivasamurthy
committed
Create Avalon attestation service
1. Attestation service to do verify IAS AVR, DCAP quote 2. Service listens on HTTP based jrpc listener and uses format json-rpc 3. Python API makes to call to attestation service 4. Shell container having pure python packages and become light-weight. Signed-off-by: Ramakrishna Srinivasamurthy <[email protected]>
1 parent e3ff2b5 commit 68d9910

File tree

18 files changed

+574
-101
lines changed

18 files changed

+574
-101
lines changed

‎attestation_service/Dockerfile‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
# Copyright 2020 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
# ------------------------------------------------------------------------------
15+
16+
# Description:
17+
# Builds the environment needed to build Avalon shell.
18+
#
19+
# Configuration (build) parameters
20+
# - proxy configuration: https_proxy http_proxy ftp_proxy
21+
#
22+
# Build:
23+
# $ docker build docker -f docker/Dockerfile -t avalon-shell-dev
24+
# if behind a proxy, you might want to add also below options
25+
# --build-arg https_proxy=$https_proxy --build-arg http_proxy=$http_proxy --build-arg ftp_proxy=$ftp_proxy
26+
27+
# -------------=== build avalon shell image ===-------------
28+
FROM ubuntu:bionic as base_image
29+
30+
# Ignore timezone prompt in apt
31+
ENV DEBIAN_FRONTEND=noninteractive
32+
33+
# Add necessary packages
34+
RUN apt-get update \
35+
&& apt-get install -y -q \
36+
software-properties-common \
37+
python3-requests \
38+
python3-colorlog \
39+
python3-twisted \
40+
&& apt-get clean
41+
42+
# Make Python3 default
43+
RUN ln -sf /usr/bin/python3 /usr/bin/python
44+
45+
46+
# -------------=== python build ===-------------
47+
48+
#Build python intermediate docker image
49+
FROM ubuntu:bionic as python_image
50+
51+
52+
# Add necessary packages
53+
RUN apt-get update \
54+
&& apt-get install -y -q \
55+
ca-certificates \
56+
pkg-config \
57+
python3-pip \
58+
python3-dev \
59+
make \
60+
&& apt-get clean
61+
62+
# Install setuptools packages using pip because
63+
# these are not available in apt repository.
64+
RUN pip3 install setuptools
65+
66+
# Make Python3 default
67+
RUN ln -sf /usr/bin/python3 /usr/bin/python
68+
69+
# -------------=== Build openssl_image ===-------------
70+
71+
#Build openssl intermediate docker image
72+
FROM ubuntu:bionic as openssl_image
73+
74+
RUN apt-get update \
75+
&& apt-get install -y -q \
76+
ca-certificates \
77+
pkg-config \
78+
make \
79+
wget \
80+
tar \
81+
&& apt-get clean \
82+
&& rm -rf /var/lib/apt/lists/*
83+
84+
WORKDIR /tmp
85+
86+
# Build ("Untrusted") OpenSSL
87+
RUN OPENSSL_VER=1.1.1g \
88+
&& wget https://www.openssl.org/source/openssl-$OPENSSL_VER.tar.gz \
89+
&& tar -zxf openssl-$OPENSSL_VER.tar.gz \
90+
&& cd openssl-$OPENSSL_VER/ \
91+
&& ./config \
92+
&& THREADS=8 \
93+
&& make -j$THREADS \
94+
&& make test \
95+
&& make install -j$THREADS
96+
97+
98+
# -------------=== common/cpp build ===-------------
99+
100+
#Build common/cpp intermediate docker image
101+
FROM ubuntu:bionic as common_cpp_image
102+
103+
RUN apt-get update \
104+
&& apt-get install -y -q \
105+
pkg-config \
106+
cmake \
107+
make
108+
109+
110+
# Copy openssl build artifacts from openssl_image
111+
COPY --from=openssl_image /usr/local/ssl /usr/local/ssl
112+
COPY --from=openssl_image /usr/local/bin /usr/local/bin
113+
COPY --from=openssl_image /usr/local/include /usr/local/include
114+
COPY --from=openssl_image /usr/local/lib /usr/local/lib
115+
116+
RUN ldconfig \
117+
&& ln -s /etc/ssl/certs/* /usr/local/ssl/certs/
118+
119+
ENV TCF_HOME=/project/avalon
120+
121+
COPY ./common/cpp /project/avalon/common/cpp
122+
123+
WORKDIR /project/avalon/common/cpp
124+
125+
RUN mkdir -p build \
126+
&& cd build \
127+
&& cmake .. -DUNTRUSTED_ONLY=1 \
128+
&& make
129+
130+
131+
# -------------=== common/python build ===-------------
132+
133+
#Build common/python intermediate docker image
134+
FROM python_image as common_python_image
135+
136+
COPY VERSION /project/avalon/
137+
COPY ./bin /project/avalon/bin
138+
139+
ENV TCF_HOME=/project/avalon
140+
141+
COPY ./common/python /project/avalon/common/python
142+
143+
WORKDIR /project/avalon/common/python
144+
145+
RUN echo "Building Avalon Common Python\n" \
146+
&& make
147+
148+
149+
# -------------=== common/verify_report_utils build ===-------------
150+
151+
#Build common/verify_report_utils intermediate docker image
152+
FROM python_image as verify_report_utils
153+
154+
RUN apt-get update \
155+
&& apt-get install -y -q \
156+
swig
157+
158+
# Copy openssl build artifacts from openssl_image
159+
COPY --from=openssl_image /usr/local/ssl /usr/local/ssl
160+
COPY --from=openssl_image /usr/local/bin /usr/local/bin
161+
COPY --from=openssl_image /usr/local/include /usr/local/include
162+
COPY --from=openssl_image /usr/local/lib /usr/local/lib
163+
164+
RUN ldconfig \
165+
&& ln -s /etc/ssl/certs/* /usr/local/ssl/certs/
166+
167+
COPY --from=common_cpp_image /project/avalon/common/cpp/build /project/avalon/common/cpp/build
168+
COPY VERSION /project/avalon/
169+
COPY ./bin /project/avalon/bin
170+
COPY ./common/cpp /project/avalon/common/cpp
171+
172+
ENV TCF_HOME=/project/avalon
173+
174+
COPY ./common/verify_report_utils /project/avalon/common/verify_report_utils
175+
176+
WORKDIR /project/avalon/common/verify_report_utils
177+
178+
RUN echo "Building Avalon Verify Report Utils\n" \
179+
&& make
180+
181+
182+
# Build image for attestation service
183+
FROM python_image as build_attestation_service
184+
185+
#Environment setup
186+
ENV TCF_HOME=/project/avalon
187+
188+
WORKDIR /project/avalon/
189+
190+
COPY ./attestation_service /project/avalon/attestation_service
191+
COPY VERSION /project/avalon/
192+
COPY ./bin /project/avalon/bin
193+
194+
WORKDIR /project/avalon/attestation_service
195+
196+
RUN echo "Building Avalon Attestation Verification service\n" \
197+
&& make
198+
199+
200+
# Build Final image and install dependent modules
201+
FROM base_image as final_image
202+
203+
COPY --from=common_python_image /project/avalon/common/python/dist/*.whl dist/
204+
COPY --from=verify_report_utils /project/avalon/common/verify_report_utils/dist/*.whl dist/
205+
COPY --from=build_attestation_service /project/avalon/attestation_service/dist/*.whl dist/
206+
207+
# Installing wheel file requires python3-pip package.
208+
# But python3-pip package will increase size of final docker image.
209+
# So remove python3-pip package and dependencies after installing wheel file.
210+
RUN apt-get update \
211+
&& apt-get install -y -q python3-pip \
212+
&& echo "Install Attestation verification service \n" \
213+
&& pip3 install dist/*.whl \
214+
&& pip3 install json-rpc \
215+
&& echo "Remove unused packages from image\n" \
216+
&& apt-get autoremove --purge -y -q python3-pip \
217+
&& apt-get clean \
218+
&& rm -rf /var/lib/apt/lists/*
219+

‎attestation_service/Makefile‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Copyright 2020 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
PY_VERSION=${shell python3 --version | sed 's/Python \(3\.[0-9]\).*/\1/' | cut -b 1}
16+
MOD_VERSION=${shell ../bin/get_version}
17+
18+
WHEEL_FILE=dist/attestation_verification_service-${MOD_VERSION}-py${PY_VERSION}-none-any.whl
19+
20+
all : $(WHEEL_FILE)
21+
22+
$(WHEEL_FILE): build_ext
23+
@echo Build Distribution
24+
python3 setup.py bdist_wheel
25+
26+
build_ext:
27+
@echo Build build_ext
28+
python3 setup.py build_ext
29+
30+
build :
31+
mkdir $@
32+
33+
install:
34+
@echo INSTALLING WHEEL FILE =================
35+
pip3 install $(WHEEL_FILE)
36+
37+
clean:
38+
if pip3 uninstall --yes $(WHEEL_FILE); then \
39+
echo UNINSTALLED $(WHEEL_FILE); fi
40+
rm -rf build deps dist *.egg-info
41+
find . -iname '*.pyc' -delete
42+
find . -iname '__pycache__' -delete
43+
44+
45+
.PHONY : all
46+
.PHONY : clean
47+
.PHONY : install

‎attestation_service/attestation_verification/__init__.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Copyright 2020 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
all = []

0 commit comments

Comments
 (0)