* Implement IMAMeasurements method in agentSDK and add corresponding unit tests
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add unit tests for NewIMAMeasurements command in CLI
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add error assertion for command execution in NewIMAMeasurements test
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Fix nil pointer dereference in Close method and update NewCreateVMCmd logic for manager client initialization
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Refactor file permission settings to use octal notation and improve cleanup handling in NewCreateVMCmd test
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add comprehensive unit tests for state machine functionality
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add mock implementation for Algorithm interface and corresponding test cases
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Refactor file permission settings to use octal notation in TestStopComputationIntegration
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove redundant reset test cases from TestStateMachine_Reset
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Fix race condition in action call verification in TestStateMachine_HandleEvent
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Enhance state machine with reset functionality and improve thread safety in event handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Improve error handling in state machine start function during tests
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove concurrent reset and send event test from state machine tests
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove error logging for Start function in transition tests
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add mock implementations for AgentService_IMAMeasurementsClient and Service Shutdown method; enhance progress tests for IMA measurements handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add comprehensive tests for FileStorage functionality including loading, saving, and concurrent access
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Enhance tests by adding dataset and algorithm hashes in handleRunReqChunks; improve error handling in TestFileStorage_ErrorHandling cleanup
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Enhance TestManagerClient_Process by adding new test cases for Agent state and Disconnect requests; update setupMocks to include grpcClient
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Fix graceful shutdown in gRPC server by adding nil checks for health and server instances
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Enhance TestAttestation by adding mock expectations for VTpmAttestation and Attestation methods; update service call to include platform parameter
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Enhance gRPC Server by adding synchronization for start/stop methods; prevent multiple starts and ensure graceful shutdown
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add unit tests for gRPC server methods including VM creation, removal, and info retrieval
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add tests for SEVSNP and TDX host capabilities; remove unused vsock code
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add a newline for better readability in vm_test.go
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add integration tests for gRPC client in cvm_test.go
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove unused vsock dependencies and add comprehensive unit tests for GCP attestation functions
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Skip GCP tests if credentials are not set
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add tests for error handling in attestation configuration and GCP commands
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Improve error handling in Azure VM test response writing
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Skip tests in GCP functions if credentials are not set
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add comprehensive unit tests for Azure attestation provider and verifier
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add unit tests for TPM functionality and improve error handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add comprehensive tests for attestation functionality and improve error handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add validation for teeNonce in TeeAttestation and implement comprehensive tests for provider methods
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Refactor error messages in TDX attestation tests for clarity
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Fix error message in TeeAttestation test for valid nonce case
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add MeasurementProvider mock and update mockery configuration
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add logging for product in parseUints and rename test functions for clarity
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Refactor TestSevsnpverify to reset configuration and improve error logging
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add token measurement command
Add Azure cloud attestation fetching
Add ability to fetch azure attestation token
Remove gcp changes
Remove gcp changes
Add Azure attestation support
Modify pipeline proto checks
Update protoc version
Fix failing CI
fetch token as a file
Convert jwt to json
Small bug fix -- correct file name for attestation token
Fix failing CI
Modify protoc version
Update protoc version
Update protoc version
Update protoc version
Add changes to allow passing vtpm nonce
Add PR review changes to refactor the code
Refactor name change to AttestationResult
Refactor name change to AttestationResult
Return report as json
Format files properly
Fix attestaton changes
Modify changes based on PR review
Add more test coverage
Correct bug in Server test
Rename "FetchAttestationResult" to "AttestationResult"
Send token as part of stream
Fix CI
NOISSUE - Add DisconnectReq message and TTL support for VM creation (#428)
* feat: Add DisconnectReq message and TTL support for VM creation
- Introduced DisconnectReq message in cvms.proto to handle disconnection requests.
- Enhanced CreateReq in manager.proto to include a TTL field for virtual machines.
- Updated CLI to accept TTL as a command-line flag during VM creation.
- Modified manager service to remove VMs after the specified TTL duration.
- Adjusted gRPC client connection handling in agent main.go to support new client structure.
- Added mock implementation for gRPC client to facilitate testing.
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix: Mark server URL flag as required with error handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
COCOS-407 - Add support for Linux IMA (#429)
* Added a feature which enables users to fetch IMA measurements and verify them
* Added a feature which enables users to fetch IMA measurements and verify them
* fixed lint error
* fixed according to comments
* fixed according to comments
* fixed according to comments
* fixed according to comments
* final bug fix
Add token measurement command
Add Azure cloud attestation fetching
Add ability to fetch azure attestation token
Remove gcp changes
Remove gcp changes
Add Azure attestation support
Modify pipeline proto checks
Update protoc version
Fix failing CI
fetch token as a file
Convert jwt to json
Small bug fix -- correct file name for attestation token
Fix failing CI
Modify protoc version
Update protoc version
Update protoc version
Update protoc version
Add changes to allow passing vtpm nonce
Add PR review changes to refactor the code
Refactor name change to AttestationResult
Refactor name change to AttestationResult
Return report as json
Format files properly
Fix attestaton changes
Modify changes based on PR review
Add more test coverage
Correct bug in Server test
Rename "FetchAttestationResult" to "AttestationResult"
Send token as part of stream
Fix CI
Rebase changes to main
Refactor after rebase
* Add Azure attestation
* COCOS-395 - Cloud Provider Firmware Integration (#415)
* add CC platform identification capability
* add token verification
* add snp azure
* add azure snp report verification
* fix linter errors
* fix agent tests
* expand the CC provider
* fix azure atls
* rebase branch
* add nonce check for azure token
* rename package attestations
* remove alias attestations
---------
Co-authored-by: Ubuntu <azureuser@UVCTestCVM.bu0p0zdolasezg1jifpyqhaxuc.dx.internal.cloudapp.net>
* Add token measurement command
Add Azure cloud attestation fetching
Add ability to fetch azure attestation token
Remove gcp changes
Remove gcp changes
Add Azure attestation support
Modify pipeline proto checks
Update protoc version
Fix failing CI
fetch token as a file
Convert jwt to json
Small bug fix -- correct file name for attestation token
Fix failing CI
Modify protoc version
Update protoc version
Update protoc version
Update protoc version
Add changes to allow passing vtpm nonce
Add PR review changes to refactor the code
Refactor name change to AttestationResult
Refactor name change to AttestationResult
Return report as json
Format files properly
Fix attestaton changes
Modify changes based on PR review
Add more test coverage
Correct bug in Server test
Rename "FetchAttestationResult" to "AttestationResult"
Send token as part of stream
Fix CI
NOISSUE - Add DisconnectReq message and TTL support for VM creation (#428)
* feat: Add DisconnectReq message and TTL support for VM creation
- Introduced DisconnectReq message in cvms.proto to handle disconnection requests.
- Enhanced CreateReq in manager.proto to include a TTL field for virtual machines.
- Updated CLI to accept TTL as a command-line flag during VM creation.
- Modified manager service to remove VMs after the specified TTL duration.
- Adjusted gRPC client connection handling in agent main.go to support new client structure.
- Added mock implementation for gRPC client to facilitate testing.
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix: Mark server URL flag as required with error handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
COCOS-407 - Add support for Linux IMA (#429)
* Added a feature which enables users to fetch IMA measurements and verify them
* Added a feature which enables users to fetch IMA measurements and verify them
* fixed lint error
* fixed according to comments
* fixed according to comments
* fixed according to comments
* fixed according to comments
* final bug fix
Add token measurement command
Add Azure cloud attestation fetching
Add ability to fetch azure attestation token
Remove gcp changes
Remove gcp changes
Add Azure attestation support
Modify pipeline proto checks
Update protoc version
Fix failing CI
fetch token as a file
Convert jwt to json
Small bug fix -- correct file name for attestation token
Fix failing CI
Modify protoc version
Update protoc version
Update protoc version
Update protoc version
Add changes to allow passing vtpm nonce
Add PR review changes to refactor the code
Refactor name change to AttestationResult
Refactor name change to AttestationResult
Return report as json
Format files properly
Fix attestaton changes
Modify changes based on PR review
Add more test coverage
Correct bug in Server test
Rename "FetchAttestationResult" to "AttestationResult"
Send token as part of stream
Fix CI
Rebase changes to main
Refactor after rebase
* Rebase with main
* Modify tests to accomodate changes
* Use env vars appropriately
* Use env vars appropriately
* Use caps in err name
---------
Co-authored-by: Danko Miladinovic <72250944+danko-miladinovic@users.noreply.github.com>
Co-authored-by: Ubuntu <azureuser@UVCTestCVM.bu0p0zdolasezg1jifpyqhaxuc.dx.internal.cloudapp.net>
* Added a feature which enables users to fetch IMA measurements and verify them
* Added a feature which enables users to fetch IMA measurements and verify them
* fixed lint error
* fixed according to comments
* fixed according to comments
* fixed according to comments
* fixed according to comments
* final bug fix
* feat: Add DisconnectReq message and TTL support for VM creation
- Introduced DisconnectReq message in cvms.proto to handle disconnection requests.
- Enhanced CreateReq in manager.proto to include a TTL field for virtual machines.
- Updated CLI to accept TTL as a command-line flag during VM creation.
- Modified manager service to remove VMs after the specified TTL duration.
- Adjusted gRPC client connection handling in agent main.go to support new client structure.
- Added mock implementation for gRPC client to facilitate testing.
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix: Mark server URL flag as required with error handling
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Initial commit, will be tested before creating a PR
* Initial commit, will be tested before creating a PR
* Fixed all issues
* Initial commit, will be tested before creating a PR
* Updated agent docs
* Fixed based on comments
* Fixed based on comments
* Initial commit, will be tested before creating a PR
* Updated agent docs
* Fixed based on comments
* Fixed based on comments
* added certificate verification
* Initial commit, will be tested before creating a PR
* Fixed all issues
* Initial commit, will be tested before creating a PR
* Initial commit, will be tested before creating a PR
* Updated agent docs
* Fixed based on comments
* Fixed based on comments
* added certificate verification
* Fixed rebase errors
* Fixed proto issues
* fixed proto issues
* Fixed format error
* Fixed based on comments
* NOISSUE - Simplify local agent running in non sev-snp environment (#411)
* Add vtpm attestation support to agent service and server
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Update mockery version to v2.53.2 and refactor VM factory to include logger
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Send event notification when computation is stopped in agentService
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove redundant assignment of Stderr in qemuVM Start method
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Rename SVM references to CVM in tracing, logging, metrics, and service layers
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Bump github.com/docker/docker (#416)
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 28.0.1+incompatible to 28.0.4+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.0.1...v28.0.4)
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 (#412)
Bumps google.golang.org/protobuf from 1.36.5 to 1.36.6.
---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* COCOS-393 - Disable SSH service and update user shell in cloud config (#396)
* Disable SSH service and update user shell in cloud config
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove SSH server and clean up dependencies in cloud config
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add firewall configuration and ensure iptables rules persist after reboot
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add algo_user configuration and setup script for container execution
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Initial commit, will be tested before creating a PR
* Fixed all issues
* Initial commit, will be tested before creating a PR
* Initial commit, will be tested before creating a PR
* Fixed based on comments
* Fixed based on comments
* added certificate verification
* Initial commit, will be tested before creating a PR
* Fixed all issues
* Initial commit, will be tested before creating a PR
* Initial commit, will be tested before creating a PR
* Fixed based on comments
* Fixed rebase errors
* Fixed format error
* Fixed based on comments
* Fixed rebase errors
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Add vtpm attestation support to agent service and server
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Update mockery version to v2.53.2 and refactor VM factory to include logger
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Send event notification when computation is stopped in agentService
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove redundant assignment of Stderr in qemuVM Start method
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Rename SVM references to CVM in tracing, logging, metrics, and service layers
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
Add copyright information to package
Add testing to igvm measurements
Remove trailing white space
Improve testing
Resolve PR comments
Add measure to cli
Add README for feature
Fix PR comments
Added new line to shell script
Add measurement interface
Fix ci
Refactor code for IgvmMeasurement to become a CLI dependency
Refactor code for IgvmMeasurement to become a CLI dependency
Refactor based on ci failures
Fix error handling
Add header
Fix ci
* manager, cli and agent vtpm support
* rebase and changed atls for vtpm
* deleted unused code
* changed chekproto.yaml script so it find the manager proto file correctly
* fixe manager proto version
* fix agent tests
* fix server agent test
* fix attestation test
* fix attestation test gofumpt
* created dummy RWC for TPM
* fix comment
* add default PCR values
* rebase main
* fix rust ci and missing header
* changed embedded attestation to VMPL 2
* fix unused impot
* fix pkg test
* address attestation type
* fix agent attestation test
* add prc15 check
* fix comments
* fix cli tests
* add doc
* add mock for LeveledQuoteProvider when SEV-SNP device is not found
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix manager reading attestation policy
* refactor PCR value checks and update attestation policy values
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix tests for sev and grpc
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
Co-authored-by: Sammy Oina <sammyoina@gmail.com>
* feat(algorithm): Add wasm as an algo type
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* feat(algorithm): Use filesystem to store results
Move from unix socket for results storage to filesystem
* test: test new filesystem changes
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* refactor(files): rename resultFile to resultsFilePath
* feat(wasm-runtime): change from wasmtime to wasmedge
Wasmedge enables easier directory mapping to get results
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* feat(algorithm): send results as zipped directory
Create a new function to zip the results directory and send it back to the user
* fix(wasm): runtime argument
Fix the directory mapping for wasm runtime arguments
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* fix(errors): provide useful error message
* chore(gitignore): add results zip to gitignore
* feat(filesystem): Enable storing results on filesystem for python algos
* refactor: revert to upstream cocos repo
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* fix: remove AddDataset from algorithm interface
* fix: agent to handle results zipping
* test: test zipping directories
* refactor(agent): Handle file operations from agent
* test: run test inside eos
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* refactor(test): Document and test algos are running
Document steps on running the 2 python exampls and ensure they are running on eos
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* fix: remove witheDataset option
* test: test without dataset argument
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
---------
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
* add host_data option
* add CLI hostdata option and rename platform to backend
* move code for computation hash to a function
* rename getComputationHash to computationHash
* add default for backend information field switch
* add cli option to download ask and ark
* add ARK and ASK to cert chain of the attestation report
* fix spelling mistake
* add explanation for aTLS testing
* remove commented code
* add rust program for fetching platform data
* fix new line error
* add CLI options to add the measurement to platform_info.json file
* add documentation for platform info testing
* add explanation for sev-snp-measure
* delete excess space
* fix minor errors
* fix minor errors
* add file permision constant
* Update Go to 1.22 and enhance security features
- Upgraded the Go version in GitHub Actions workflows to 1.22.x for latest features and security patches.
- Added RSA public key field `UserKey` in `Dataset` and `Algorithm` to reinforce data integrity and encryption.
- Refactored `Result` method in `agentService` to use `containsID` for improved readability and potential performance benefits.
- Updated `grpcserver.New` and `internal/server/grpc` invocations to pass `agent.Service` by value in line with recommended Go practices.
- Introduced `grpc.StreamInterceptor` with no args in `Server.Start` which seems to be an initial step for future stream interceptor configuration.
These changes prepare for stronger data security measures, maintain compatibility with the latest Go features, and improve code quality regarding service struct usage. Potential follow-up is needed to configure the stream interceptor and to ensure the new RSA key field is appropriately utilized in data handling.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor auth system and protocol buffers
Enhanced the authentication system by adding context support and an improved user-role model. Implemented robust RSA public key verification for users and a restructured interceptor logic specific to stream types, streamlining the auth process. Updated protocol buffers and associated structures to accommodate user keys as byte slices, aligning with standard cryptographic practice. CLI commands for algorithms and datasets now require a private key file path argument for signing, strengthening security during interactions.
This comprehensive overhaul addresses security and efficiency considerations in the RPC framework and aligns with best practices for key handling. By streamlining and securing the user authentication process, the agent service's reliability is greatly improved, directly impacting the robustness of the entire computation pipeline.
- Refactored auth: added role-based user validation, context handling
- Reworked interceptors: separated stream types, fortified signature checks
- Updated protocol buffers: user public keys as byte slices for standard compatibility
- Enhanced CLI: introduced private key argument, ensuring secure algorithm and dataset submission
- Improved server and SDK contracts to align with auth changes
Related issues:
- Implements user roles and auth context [#103]
- CLI security enhancement for private key management
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Updated PEM decoding for key parsing in CLI and tests
Added `encoding/pem` to decode PEM blocks when parsing private and public keys across CLI commands and test computation scenarios, ensuring compatibility with key files. This enhances robustness in key handling by supporting PEM encoded keys. The update also includes registration of a new Keys command in the CLI.
Refactored code is now compliant with common key formats, addressing potential parsing issues.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix auth signature encoding and improve CLI usage example
The authentication system now decodes base64 strings before verifying signatures to align with the expected format. Additionally, the signature generation now encodes the output in base64, ensuring consistency across the auth process.
The CLI help message for the `result` command is enhanced by providing a usage example, making it more user-friendly and informative.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor containsID to handle dynamic fields
Updated the `containsID` function to accept a field name parameter, enabling dynamic field lookup within the reflection logic. This change facilitates the use of the function for various struct fields, improving code reusability and flexibility.
CLI command 'data' now requires an additional argument for the private key file path, outlined in the usage example update, reinforcing command clarity and user guidance.
Resolves issues with hardcoded field lookups and enhances CLI usability.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Remove extraneous newline in key generation log output
A redundant newline after the success message in the key generation command was removed to clean up log output formatting. This change ensures a more consistent and professional appearance of the CLI tool's messages.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Implemented auth service in gRPC startup
Added authentication services to the gRPC server initialization to enforce security measures. The gRPC server's New function now includes an `authSvc` parameter, requiring instantiation of the auth service before starting the server. Failure to create the auth service results in a fatal error, halting the process to avoid running without protection. Tests have been updated to include `nil` values for the auth service parameter to maintain their functionality without authentication.
Refactored `grpcserver.New` to accept the new auth service, and updated the main agent startup logic to create and inject the auth service. Added the auth middleware interceptors to the server options, which ensures that each gRPC call will undergo authentication.
This change is a step towards secure communication, and affected components should now consider the authentication requirement.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor config read logic and update agent setup
Improved the configuration reading in `cmd/agent/main.go` to handle larger payloads by reading data in chunks and checking for EOF, ensuring that all config data is captured even if it exceeds the initial buffer size. Enhanced the `test/manual/agent-config/main.go` to require additional command-line arguments, improving the setup process by explicitly requiring paths for data, algorithm, and public key as well as a boolean for attested TLS. Also updated the hashing method to SHA3 for the algorithm and data files, and included the hash and public keys as part of the agent, dataset, and result consumer configurations. These changes will make the agent setup more robust and provide better integrity checks for the involved files.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor run method to agentService
Moved the run function into agentService for better encapsulation and maintainability. This refactoring includes capturing both stdout and stderr during algorithm execution, enabling more informative debugging through enhanced logging. Consequentially, the run method now references members through the service instance, aligning with object-oriented best practices and improving code coherence.
Resolves issue with insufficient execution details when computations fail.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor computation data handling to use filepaths
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor error logging and ensure consistency
Replaced usage of the standard log package with a custom logger for error reporting to standardize error logging throughout the application. Additionally, introduced graceful shutdown by returning from the main function rather than forcing exit when failing to create auth service, aligning the application's error handling strategy.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor auth initialization and key file handling
Improved the readability and maintainability of the authentication service initialization by adding line breaks for logical separation. Also, standardized key filenames in the CLI key generation by introducing constants, enhancing code clarity and reducing the likelihood of file-naming errors.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor auth verification logic for improved security
Removed an extraneous line in the `verifySignature` function that was not necessary for the signature verification process. This change simplifies the code and improves readability.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor payload structures to simplify API
Removed the 'provider', 'id', 'consumer' fields from protocol buffers, gRPC services, and related functions across various files to streamline the data model and align with the new authentication system based on cryptographic verification rather than string identifiers. This results in more efficient data handling and a reduction in unnecessary payload data, while enhancing security by making entity validation strictly cryptographic.
The changes affect agent-SDK interactions, CLI tools, and related services, ensuring only the necessary data (algorithm/data bytes, user keys, and hashes) is transmitted and processed. Consequently, the core computation algorithm and dataset handlers now rely on indexes derived from context to associate data with respective manifest entries, thus maintaining the ability to link to specific computation manifests without relying on explicit IDs in the payload. Additionally, refactored authentication methods now enforce role-based security seamlessly through metadata.
This approach enhances privacy by avoiding transmission of potentially sensitive strings over the network and by ensuring that only internal indices, not globally interpretable identifiers, are used to process computations.
Aligned with the broader architectural goal of simplifying and securing the platform's core services, this change paves the way for upcoming revisions to the authentication scheme that will further consolidate role-based security and improve system integrity.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Enhance CLI security with key paths
Removed the section on running computations from the CLI README as it may no longer be necessary or the functionality has been moved elsewhere. Required private key file paths for algorithm, dataset upload, and result retrieval commands to enhance security. This change associates each action with a specific identity, ensuring secure and traceable operations. Additionally, updated the manual test commands to reflect this new requirement.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix ci
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix fmt
Signed-off-by: SammyOina <sammyoina@gmail.com>
---------
Signed-off-by: SammyOina <sammyoina@gmail.com>
Sammy Kerata Oina
dorcaslitunya
Danko Miladinovic
Jovan Djukic
Washington Kigani Kamadi
Smith Jilks
b1ackd0t