Skip to content

Commit 621bd32

Browse files
UlexusUlexus
committed
Merge pull-request #515 
2 parents 085f152 + 33a78a7 commit 621bd32

File tree

3 files changed

+115
-49
lines changed

3 files changed

+115
-49
lines changed

‎README.md‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,10 @@ The consensus on environment configuration is coordinated through the Manifest d
1212

1313
The Quorum Key itself can be used by QuorumOS and enclave apps to encrypt and authenticate data.
1414

15-
1615
QuorumOS ("QOS") is a minimal, immutable, and deterministic Linux unikernel targeting various Trusted Execution Environments for use cases that require high security and accountability.
1716

17+
For more information about how it's used within Turnkey, please refer to [The Turnkey Whitepaper](https://whitepaper.turnkey.com/), and more specifically: [Foundations](https://whitepaper.turnkey.com/foundations).
18+
1819
## Development
1920

2021
### Requirements
@@ -23,6 +24,41 @@ QuorumOS ("QOS") is a minimal, immutable, and deterministic Linux unikernel targ
2324
- Docker 26+
2425
- GNU Make
2526

27+
### Reproducing builds
28+
29+
QuorumOS is built with [StageX](https://codeberg.org/stagex/stagex), a new deterministic Linux distro. StageX provides reproducible builds and guarantees a 1-to-1, immutable relationship between the human-readable source code in this repo and the resulting machine-executable artifacts produced by the build system.
30+
31+
This repository produces deterministic OCI container images. QuorumOS, the operating system, is packaged for execution inside of a Nitro EIF (Enclave Image File). This packaging is deterministic and done as part of [`qos_enclave`](./src/qos_enclave). The associated [Containerfile](./src/images/qos_enclave/Containerfile) contains the set of instructions to build the `nitro.eif` file, as well as `nitro.pcrs`, which contains the PCR measurements.
32+
33+
To produce the `qos_enclave` OCI container image, run:
34+
```
35+
make out/qos_enclave/index.json
36+
```
37+
38+
If you need to extract files from it, you can do so by using [docker](https://docs.docker.com/get-started/get-docker/) and [skopeo](https://github.com/containers/skopeo):
39+
40+
```sh
41+
# Creates an archive called qos_enclave.tar, with a tag "qos-enclave:latest"
42+
skopeo copy oci:./out/qos_enclave docker-archive:qos_enclave.tar:qos-enclave:latest
43+
44+
# Load the tar into local docker
45+
docker load < qos_enclave.tar
46+
47+
# Create the container without running it (outputs a container ID)
48+
docker create qos-enclave:latest
49+
50+
# Copy files locally for inspection
51+
docker cp CONTAINER_ID:/nitro.pcrs nitro.pcrs
52+
53+
# Look at the PCR values
54+
cat nitro.pcrs
55+
b26733f9... PCR0
56+
b26733f9... PCR1
57+
21b9efbc... PCR2
58+
```
59+
60+
These PCR values can be referenced against the content of [AWS remote attestations](https://docs.aws.amazon.com/enclaves/latest/user/set-up-attestation.html#pcr012).
61+
2662
### Submitting a PR
2763

2864
Before a PR can be merged our linter and unit tests need to pass.

‎src/images/common/Containerfile‎

Lines changed: 42 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,18 @@
11
FROM stagex/bash:5.2.21@sha256:cb58f55d268fbe7ef629cda86e3a8af893066e4af7f26ef54748b6ad47bdaa66 AS bash
22
FROM stagex/binutils:2.43.1@sha256:30a1bd110273894fe91c3a4a2103894f53eaac43cf12a035008a6982cb0e6908 AS binutils
3+
FROM stagex/busybox:1.36.1@sha256:d34bfa56566aa72d605d6cbdc154de8330cf426cfea1bc4ba8013abcac594395 AS busybox
34
FROM stagex/ca-certificates:sx2024.09.0@sha256:33787f1feb634be4232a6dfe77578c1a9b890ad82a2cf18c11dd44507b358803 AS ca-certificates
45
FROM stagex/coreutils:9.4@sha256:1955f532d8923b5e17f60635c994bd9577bb3e6bccb5da702a69e79070bae0a9 AS coreutils
5-
FROM stagex/eif_build:0.2.2@sha256:291653f1ca528af48fd05858749c443300f6b24d2ffefa7f5a3a06c27c774566 AS eif_build
66
FROM stagex/file:5.45@sha256:b43a7f0bd50419a39d91d77a316bb888ed87c94aeb6f9eb11f12efd275ca4ab8 AS file
77
FROM stagex/filesystem:sx2024.11.0@sha256:d03195563f548c3ac8f34acf777b7e86f0d0d049a9430d715e5774eb7cc93302 AS filesystem
88
FROM stagex/findutils:4.9.0@sha256:d92494daaf08999aac0a277327d240a0149494716707fbce93381df058f693e2 AS findutils
99
FROM stagex/gcc:13.1.0@sha256:439bf36289ef036a934129d69dd6b4c196427e4f8e28bc1a3de5b9aab6e062f0 AS gcc
10-
FROM stagex/gen_initramfs:6.8@sha256:f5b9271cca6003e952cbbb9ef041ffa92ba328894f563d1d77942e6b5cdeac1a AS gen_initramfs
1110
FROM stagex/git:2.9.5@sha256:29a02c423a4b55fa72cf2fce89f3bbabd1defea86d251bb2aea84c056340ab22 AS git
1211
FROM stagex/grep:3.11@sha256:576288125a7ecda969285e5edfaedef479c4bc18cba8230c0502000fdf2586c1 AS grep
1312
FROM stagex/libunwind:1.7.2@sha256:97ee6068a8e8c9f1c74409f80681069c8051abb31f9559dedf0d0d562d3bfc82 AS libunwind
14-
# This is using an old version of linux-nitro on a recommendation from Lance
15-
# Once we've confirmed the new version work we should upgrade this again.
16-
FROM stagex/linux-nitro:sx2024.03.0@sha256:073c4603686e3bdc0ed6755fee3203f6f6f1512e0ded09eaea8866b002b04264 AS linux-nitro
17-
FROM stagex/llvm13:13.0.1@sha256:aa60e2883ecf2070c7591fc29622a578c8ea24a14a2b7fcce95d3e5d9c00b101 AS llvm13
1813
FROM stagex/llvm:18.1.8@sha256:30517a41af648305afe6398af5b8c527d25545037df9d977018c657ba1b1708f AS llvm
1914
FROM stagex/make:4.4@sha256:df43f0cf3ac1ad91bf91baefb539e8df42c11b0954a6e2498322a5467deb81e3 AS make
20-
FROM stagex/musl-fts:1.2.7@sha256:87edcc648085e8fd6cd8a6ebc94a9464181c3035a00266c621c6450f5d7c66d8 AS musl-fts
2115
FROM stagex/musl:1.2.4@sha256:ad351b875f26294562d21740a3ee51c23609f15e6f9f0310e0994179c4231e1d AS musl
22-
FROM stagex/musl-obstack:1.2.3@sha256:2a308833441b46a64a1fa5cf90d0bb75dec4807d5a15035776165db88ca661fd AS musl-obstack
2316
FROM stagex/openssl:3.0.12@sha256:2c1a9d8fcc6f52cb11a206f380b17d74c1079f04cbb08071a4176648b4df52c1 AS openssl
2417
# This is using an old version of pcsc-lite since upgrading to v2.2.3 broke
2518
# static builds. Once we have confirmed an updated pcsc-lite has fixed this
@@ -30,31 +23,52 @@ FROM stagex/rust:1.81.0@sha256:b7c834268a81bfcc473246995c55b47fe18414cc553e3293b
3023
FROM stagex/zlib:1.3.1@sha256:96b4100550760026065dac57148d99e20a03d17e5ee20d6b32cbacd61125dbb6 AS zlib
3124

3225
FROM scratch AS base
33-
ENV TARGET=x86_64-unknown-linux-musl
34-
ENV RUSTFLAGS="-C target-feature=+crt-static"
35-
ENV CARGOFLAGS="--locked --no-default-features --release --target ${TARGET}"
36-
ENV OPENSSL_STATIC=true
37-
COPY --from=stagex/busybox . /
38-
COPY --from=stagex/bash . /
26+
27+
COPY --from=bash . /
28+
COPY --from=binutils . /
29+
COPY --from=busybox . /
30+
COPY --from=ca-certificates . /
3931
COPY --from=coreutils . /
32+
COPY --from=file . /
33+
COPY --from=filesystem . /
4034
COPY --from=findutils . /
35+
COPY --from=gcc . /
36+
COPY --from=git . /
4137
COPY --from=grep . /
38+
COPY --from=make . /
4239
COPY --from=musl . /
4340
COPY --from=libunwind . /
4441
COPY --from=openssl . /
45-
COPY --from=zlib . /
46-
COPY --from=ca-certificates . /
47-
COPY --from=binutils . /
42+
COPY --from=pcsc-lite . /
4843
COPY --from=pkgconf . /
49-
COPY --from=git . /
50-
COPY --from=rust . /
51-
COPY --from=gen_initramfs . /
52-
COPY --from=eif_build . /
5344
COPY --from=llvm . /
54-
COPY --from=pcsc-lite . /
55-
COPY --from=file . /
56-
COPY --from=gcc . /
57-
COPY --from=make . /
58-
COPY --from=linux-nitro /bzImage .
59-
COPY --from=linux-nitro /nsm.ko .
60-
COPY --from=linux-nitro /linux.config .
45+
COPY --from=rust . /
46+
COPY --from=zlib . /
47+
48+
49+
COPY --chmod=644 <<-EOF /etc/passwd
50+
root:x:0:0:root:/root:/bin/sh
51+
user:x:1000:1000::/home/user:/bin/sh
52+
EOF
53+
COPY --chmod=644 <<-EOF /etc/group
54+
root:x:0:
55+
user:x:1000:
56+
EOF
57+
58+
RUN mkdir -p /rootfs/etc
59+
RUN mkdir -p /rootfs/home/user
60+
RUN chown -R user:user /rootfs/home/user
61+
62+
RUN touch -hcd "@0" /etc/group /etc/hpasswd
63+
ENV TZ=UTC
64+
ENV LANG=C.UTF-8
65+
ENV LC_ALL=C
66+
ENV USER=user
67+
ENV HOME=/home/user
68+
ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
69+
70+
ENV TARGET=x86_64-unknown-linux-musl
71+
ENV RUSTFLAGS="-C target-feature=+crt-static"
72+
ENV CARGOFLAGS="--locked --no-default-features --release --target ${TARGET}"
73+
74+
WORKDIR /src

‎src/images/qos_enclave/Containerfile‎

Lines changed: 36 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,41 @@
1+
FROM stagex/eif_build:0.2.2@sha256:291653f1ca528af48fd05858749c443300f6b24d2ffefa7f5a3a06c27c774566 AS eif_build
2+
FROM stagex/gen_initramfs:6.8@sha256:f5b9271cca6003e952cbbb9ef041ffa92ba328894f563d1d77942e6b5cdeac1a AS gen_initramfs
3+
FROM stagex/linux-nitro:sx2024.03.0@sha256:073c4603686e3bdc0ed6755fee3203f6f6f1512e0ded09eaea8866b002b04264 AS linux-nitro
4+
15
FROM common as base
2-
ADD . /src
36

4-
FROM base as build-qos_enclave
5-
RUN <<-EOF
6-
set -eux
7-
env -C /src/qos_enclave cargo build ${CARGOFLAGS}
8-
cp /src/qos_enclave/target/${TARGET}/release/qos_enclave /
9-
file /qos_enclave | grep "static-pie"
10-
EOF
7+
RUN mkdir -p /qos/src
8+
ADD . /qos/src
119

12-
FROM base as build-init
13-
RUN <<-EOF
14-
set -eux
15-
env -C /src/init cargo build ${CARGOFLAGS}
16-
cp /src/init/target/${TARGET}/release/init /
17-
file /init | grep "static-pie"
18-
EOF
10+
# pre-fetch all QOS deps
11+
RUN cd /qos/src && cargo fetch
12+
13+
# pre-fetch all QOS deps even for crates excluded from the workspace
14+
# these dependencies are needed when building qos_enclave
15+
RUN cd /qos/src/init && cargo fetch
16+
RUN cd /qos/src/qos_enclave && cargo fetch
17+
18+
FROM base AS build-qos_enclave
19+
WORKDIR /qos/src/qos_enclave
20+
RUN --network=none cargo build ${CARGOFLAGS}
21+
RUN cp target/x86_64-unknown-linux-musl/release/qos_enclave /
22+
RUN file /qos_enclave | grep "static-pie"
23+
24+
FROM base AS build-init
25+
WORKDIR /qos/src/init
26+
RUN --network=none cargo build ${CARGOFLAGS}
27+
RUN cp target/x86_64-unknown-linux-musl/release/init /
28+
RUN file /init | grep "static-pie"
1929

2030
FROM base as build-eif
2131
WORKDIR /build_cpio
32+
COPY --from=eif_build . /
33+
COPY --from=gen_initramfs . /
2234
COPY --from=build-init /init .
35+
COPY --from=linux-nitro /nsm.ko .
2336
COPY <<-EOF initramfs.list
2437
file /init init 0755 0 0
25-
file /nsm.ko /nsm.ko 0755 0 0
38+
file /nsm.ko nsm.ko 0755 0 0
2639
dir /run 0755 0 0
2740
dir /tmp 0755 0 0
2841
dir /etc 0755 0 0
@@ -42,14 +55,17 @@ ENV CPIO_TIMESTAMP=1
4255
ENV KBUILD_BUILD_TIMESTAMP=1
4356
RUN <<-EOF
4457
find . -exec touch -hcd "@0" "{}" +
45-
gen_init_cpio -t 1 initramfs.list > rootfs.cpio
58+
mkdir /build_eif
59+
gen_init_cpio -t 1 initramfs.list > /build_eif/rootfs.cpio
4660
touch -hcd "@0" rootfs.cpio
4761
EOF
4862
WORKDIR /build_eif
63+
COPY --from=linux-nitro /bzImage .
64+
COPY --from=linux-nitro /linux.config .
4965
RUN eif_build \
50-
--kernel /bzImage \
51-
--kernel_config /linux.config \
52-
--ramdisk /build_cpio/rootfs.cpio \
66+
--ramdisk rootfs.cpio \
67+
--kernel bzImage \
68+
--kernel_config linux.config \
5369
--pcrs_output /nitro.pcrs \
5470
--output /nitro.eif \
5571
--cmdline 'reboot=k initrd=0x2000000,3228672 root=/dev/ram0 panic=1 pci=off nomodules console=ttyS0 i8042.noaux i8042.nomux i8042.nopnp i8042.dumbkbd'

0 commit comments

Comments
 (0)