NOISSUE - Refactor single algorithm processing (#117 )

* Refactor single algorithm processing Simplified the agent service's algorithm handling logic to process a single algorithm instead of multiple. This change: - Removed the `Algorithms` type and associated stringer implementation. - Updated the state machine and service logic to expect a singular algorithm, aligning the agent's internal state transitions with the new model. - Adjusted the manager service and computations test server to mirror these changes in their respective payload structures, ensuring API and test consistency. - Altered README files to reflect the simplified interaction model and removed outdated descriptions. - Reverted the protoc-gen-go version used for generating protobuf files to maintain compatibility with the rest of the codebase. The single-algorithm approach streamlines the computation running process, reducing complexity and potential error conditions. It directly impacts how external services will construct and send computation requests. Signed-off-by: SammyOina <sammyoina@gmail.com> * Update protoc-gen-go version to v1.33.0 Signed-off-by: SammyOina <sammyoina@gmail.com> * Refactor variable name in computations.go and grpc.go Signed-off-by: SammyOina <sammyoina@gmail.com> --------- Signed-off-by: SammyOina <sammyoina@gmail.com>
NOISSUE - Attested TLS (#99 )
2026-08-07 15:26:26 +00:00 · 2024-04-17 13:34:54 +02:00 · 2024-04-16 15:19:19 +02:00 · 2024-04-16 00:42:47 +02:00 · 2024-04-15 22:26:41 +02:00
23 changed files with 470 additions and 179 deletions
@@ -34,7 +34,7 @@ jobs:
      - name: Set up protoc
        run: |
          PROTOC_VERSION=25.3
-          PROTOC_GEN_VERSION=v1.31.0
+          PROTOC_GEN_VERSION=v1.33.0
          PROTOC_GRPC_VERSION=v1.3.0

          # Download and install protoc
@@ -26,20 +26,28 @@ Cocos AI is implementing the following features:

 ## Usage

-The quickest way to start using Cocos is via the CLI. The latest version can be downloaded from the [official releases page][rel].
-
-It can also be built and used from the project's root directory:
+Clone the repo and create binaries:

 ```bash
-make cli
-./build/cocos-cli version
+git clone git@github.com:ultravioletrs/cocos.git
+make
 ```

-Additional details on using the CLI can be found in the [CLI documentation][cli].
+This will create 3 binaries:
+```bash
+ls build/
+# cocos-agent  cocos-cli  cocos-manager
+```
+
+- Manager can be deployed on the AMD SEV-SNP host
+- Agent can be built into [EOS][eos]-based HAL
+- CLI can be used to communicate to remote Agent.

 ## Documentation

-Official documentation is hosted at [Cocos official docs page][docs]. Documentation is auto-generated, checkout the instructions on [official docs repository](https://github.com/ultravioletrs/docs).
+Project documentation is hosted at [Cocos AI official docs page][docs].
+
+Documentation is generated from the [docs repository](https://github.com/ultravioletrs/docs).

 ## License
 Cocos AI is published under permissive open-source [Apache-2.0](LICENSE) license.
@@ -50,3 +58,4 @@ Cocos AI is published under permissive open-source [Apache-2.0](LICENSE) license
 [tee]: https://en.wikipedia.org/wiki/Trusted_execution_environment
 [docs]: https://docs.cocos.ultraviolet.rs
 [cli]: https://docs.cocos.ultraviolet.rs/cli
+[eos]: https://github.com/ultravioletrs/eos
@@ -15,7 +15,6 @@ The service is configured using the environment variables from the following tab
 | AGENT_GRPC_SERVER_KEY         | Path to gRPC server key in pem format                  | ""                             |
 | AGENT_GRPC_SERVER_CA_CERTS    | Path to gRPC server CA certificate                     | ""                             |
 | AGENT_GRPC_CLIENT_CA_CERTS    | Path to gRPC client CA certificate                     | ""                             |
-| COCOS_NOTIFICATION_SERVER_URL | Server to receive notification events from agent.      | http:/localhost:9000           |


 ## Deployment
@@ -3,7 +3,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.33.0
 // 	protoc        v4.25.3
 // source: agent/agent.proto

@@ -8,10 +8,7 @@ import (
 	"reflect"
 )

-var (
-	_ fmt.Stringer = (*Datasets)(nil)
-	_ fmt.Stringer = (*Algorithms)(nil)
-)
+var _ fmt.Stringer = (*Datasets)(nil)

 type AgentConfig struct {
 	LogLevel     string `json:"log_level"`
@@ -21,6 +18,7 @@ type AgentConfig struct {
 	KeyFile      string `json:"server_key"`
 	ServerCAFile string `json:"server_ca_file"`
 	ClientCAFile string `json:"client_ca_file"`
+	AttestedTls  bool   `json:"attested_tls"`
 }

 type Computation struct {
@@ -28,7 +26,7 @@ type Computation struct {
 	Name            string      `json:"name,omitempty"`
 	Description     string      `json:"description,omitempty"`
 	Datasets        Datasets    `json:"datasets,omitempty"`
-	Algorithms      Algorithms  `json:"algorithms,omitempty"`
+	Algorithm       Algorithm   `json:"algorithms,omitempty"`
 	ResultConsumers []string    `json:"result_consumers,omitempty"`
 	AgentConfig     AgentConfig `json:"agent_config,omitempty"`
 }
@@ -41,14 +39,6 @@ func (d *Datasets) String() string {
 	return string(dat)
 }

-func (a *Algorithms) String() string {
-	dat, err := json.Marshal(a)
-	if err != nil {
-		return ""
-	}
-	return string(dat)
-}
-
 type Dataset struct {
 	Dataset  []byte   `json:"-"`
 	Hash     [32]byte `json:"hash,omitempty"`
@@ -65,8 +55,6 @@ type Algorithm struct {
 	ID        string   `json:"id,omitempty"`
 }

-type Algorithms []Algorithm
-
 func containsID(slice interface{}, id string) int {
 	rangeOnMe := reflect.ValueOf(slice)
 	for i := 0; i < rangeOnMe.Len(); i++ {
@@ -59,7 +59,7 @@ type Service interface {

 type agentService struct {
 	computation Computation    // Holds the current computation request details.
-	algorithms  [][]byte       // Stores the algorithms received for the computation.
+	algorithm   []byte         // Stores the algorithm received for the computation.
 	datasets    [][]byte       // Stores the datasets received for the computation.
 	result      []byte         // Stores the result of the computation.
 	sm          *StateMachine  // Manages the state transitions of the agent service.
@@ -80,49 +80,49 @@ func New(ctx context.Context, logger *slog.Logger, eventSvc events.Service, cmp
 		sm:       NewStateMachine(logger),
 		eventSvc: eventSvc,
 	}
+
 	go svc.sm.Start(ctx)
 	svc.sm.SendEvent(start)
 	svc.sm.StateFunctions[idle] = svc.publishEvent("in-progress", json.RawMessage{})
-	svc.sm.StateFunctions[receivingManifests] = svc.publishEvent("in-progress", json.RawMessage{})
-	svc.sm.StateFunctions[receivingAlgorithms] = svc.publishEvent("in-progress", json.RawMessage{})
+	svc.sm.StateFunctions[receivingManifest] = svc.publishEvent("in-progress", json.RawMessage{})
+	svc.sm.StateFunctions[receivingAlgorithm] = svc.publishEvent("in-progress", json.RawMessage{})
 	svc.sm.StateFunctions[receivingData] = svc.publishEvent("in-progress", json.RawMessage{})
 	svc.sm.StateFunctions[resultsReady] = svc.publishEvent("in-progress", json.RawMessage{})
 	svc.sm.StateFunctions[complete] = svc.publishEvent("in-progress", json.RawMessage{})
 	svc.sm.StateFunctions[running] = svc.runComputation

 	svc.computation = cmp
-	svc.sm.SendEvent(manifestsReceived)
+	svc.sm.SendEvent(manifestReceived)
 	return svc
 }

 func (as *agentService) Algo(ctx context.Context, algorithm Algorithm) error {
-	if as.sm.GetState() != receivingAlgorithms {
+	if as.sm.GetState() != receivingAlgorithm {
 		return errStateNotReady
 	}
-	if len(as.computation.Algorithms) == 0 {
+	if as.algorithm != nil {
 		return errAllManifestItemsReceived
 	}

 	hash := sha3.Sum256(algorithm.Algorithm)

-	index := containsID(as.computation.Algorithms, algorithm.ID)
+	index := containsID(as.computation.Algorithm, algorithm.ID)
 	switch index {
 	case -1:
 		return errUndeclaredAlgorithm
 	default:
-		if as.computation.Algorithms[index].Provider != algorithm.Provider {
+		if as.computation.Algorithm.Provider != algorithm.Provider {
 			return errProviderMissmatch
 		}
-		if hash != as.computation.Algorithms[index].Hash {
+		if hash != as.computation.Algorithm.Hash {
 			return errHashMismatch
 		}
-		as.computation.Algorithms = slices.Delete(as.computation.Algorithms, index, index+1)
 	}

-	as.algorithms = append(as.algorithms, algorithm.Algorithm)
+	as.algorithm = algorithm.Algorithm

-	if len(as.computation.Algorithms) == 0 {
-		as.sm.SendEvent(algorithmsReceived)
+	if as.algorithm != nil {
+		as.sm.SendEvent(algorithmReceived)
 	}

 	return nil
@@ -201,7 +201,7 @@ func (as *agentService) runComputation() {
 	as.sm.logger.Debug("computation run started")
 	defer as.sm.SendEvent(runComplete)
 	as.publishEvent("in-progress", json.RawMessage{})()
-	result, err := run(as.algorithms[0], as.datasets[0])
+	result, err := run(as.algorithm, as.datasets[0])
 	if err != nil {
 		as.runError = err
 		as.publishEvent("failed", json.RawMessage{})()
@@ -14,8 +14,8 @@ type state int

 const (
 	idle state = iota
-	receivingManifests
-	receivingAlgorithms
+	receivingManifest
+	receivingAlgorithm
 	receivingData
 	running
 	resultsReady
@@ -26,8 +26,8 @@ type event int

 const (
 	start event = iota
-	manifestsReceived
-	algorithmsReceived
+	manifestReceived
+	algorithmReceived
 	dataReceived
 	runComplete
 	resultsConsumed
@@ -56,13 +56,13 @@ func NewStateMachine(logger *slog.Logger) *StateMachine {
 	}

 	sm.Transitions[idle] = make(map[event]state)
-	sm.Transitions[idle][start] = receivingManifests
+	sm.Transitions[idle][start] = receivingManifest

-	sm.Transitions[receivingManifests] = make(map[event]state)
-	sm.Transitions[receivingManifests][manifestsReceived] = receivingAlgorithms
+	sm.Transitions[receivingManifest] = make(map[event]state)
+	sm.Transitions[receivingManifest][manifestReceived] = receivingAlgorithm

-	sm.Transitions[receivingAlgorithms] = make(map[event]state)
-	sm.Transitions[receivingAlgorithms][algorithmsReceived] = receivingData
+	sm.Transitions[receivingAlgorithm] = make(map[event]state)
+	sm.Transitions[receivingAlgorithm][algorithmReceived] = receivingData

 	sm.Transitions[receivingData] = make(map[event]state)
 	sm.Transitions[receivingData][dataReceived] = running
@@ -9,8 +9,8 @@ func _() {
 	// Re-run the stringer command to generate them again.
 	var x [1]struct{}
 	_ = x[idle-0]
-	_ = x[receivingManifests-1]
-	_ = x[receivingAlgorithms-2]
+	_ = x[receivingManifest-1]
+	_ = x[receivingAlgorithm-2]
 	_ = x[receivingData-3]
 	_ = x[running-4]
 	_ = x[resultsReady-5]
@@ -16,9 +16,9 @@ func TestStateMachineTransitions(t *testing.T) {
 		event     event
 		expected  state
 	}{
-		{idle, start, receivingManifests},
-		{receivingManifests, manifestsReceived, receivingAlgorithms},
-		{receivingAlgorithms, algorithmsReceived, receivingData},
+		{idle, start, receivingManifest},
+		{receivingManifest, manifestReceived, receivingAlgorithm},
+		{receivingAlgorithm, algorithmReceived, receivingData},
 		{receivingData, dataReceived, running},
 		{running, runComplete, resultsReady},
 		{resultsReady, resultsConsumed, complete},
@@ -66,13 +66,14 @@ func main() {
 		KeyFile:      cfg.AgentConfig.KeyFile,
 		ServerCAFile: cfg.AgentConfig.ServerCAFile,
 		ClientCAFile: cfg.AgentConfig.ClientCAFile,
+		AttestedTLS:  cfg.AgentConfig.AttestedTls,
 	}

 	registerAgentServiceServer := func(srv *grpc.Server) {
 		reflection.Register(srv)
 		agent.RegisterAgentServiceServer(srv, agentgrpc.NewServer(svc))
 	}
-	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger)
+	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, &svc)

 	g.Go(func() error {
 		return gs.Start()
@@ -24,7 +24,7 @@ const (
 )

 type config struct {
-	LogLevel string `env:"AGENT_LOG_LEVEL"               envDefault:"info"`
+	LogLevel string `env:"AGENT_LOG_LEVEL" envDefault:"info"`
 }

 func main() {
@@ -5,36 +5,55 @@ package grpc

 import (
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/pem"
 	"fmt"
 	"log/slog"
+	"math/big"
 	"net"
 	"os"
 	"time"

+	"github.com/ultravioletrs/cocos/agent"
 	"github.com/ultravioletrs/cocos/internal/server"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"golang.org/x/crypto/sha3"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 )

 const (
-	stopWaitTime = 5 * time.Second
+	stopWaitTime  = 5 * time.Second
+	organization  = "Ultraviolet"
+	country       = "Serbia"
+	province      = ""
+	locality      = "Belgrade"
+	streetAddress = "Bulevar Arsenija Carnojevica 103"
+	postalCode    = "11000"
+	notAfterYear  = 1
+	notAfterMonth = 0
+	notAfterDay   = 0
 )

 type Server struct {
 	server.BaseServer
 	server          *grpc.Server
 	registerService serviceRegister
+	agent           *agent.Service
 }

 type serviceRegister func(srv *grpc.Server)

 var _ server.Server = (*Server)(nil)

-func New(ctx context.Context, cancel context.CancelFunc, name string, config server.Config, registerService serviceRegister, logger *slog.Logger) server.Server {
+func New(ctx context.Context, cancel context.CancelFunc, name string, config server.Config, registerService serviceRegister, logger *slog.Logger, agentSvc *agent.Service) server.Server {
 	listenFullAddress := fmt.Sprintf("%s:%s", config.Host, config.Port)
 	return &Server{
 		BaseServer: server.BaseServer{
@@ -46,6 +65,7 @@ func New(ctx context.Context, cancel context.CancelFunc, name string, config ser
 			Logger:  logger,
 		},
 		registerService: registerService,
+		agent:           agentSvc,
 	}
 }

@@ -62,6 +82,24 @@ func (s *Server) Start() error {
 	creds := grpc.Creds(insecure.NewCredentials())

 	switch {
+	case s.Config.AttestedTLS:
+		certificateBytes, privateKeyBytes, err := generateCertificatesForATLS(s.agent)
+		if err != nil {
+			return fmt.Errorf("failed to create certificate: %w", err)
+		}
+
+		certificate, err := tls.X509KeyPair(certificateBytes, privateKeyBytes)
+		if err != nil {
+			return fmt.Errorf("falied due to invalid key pair: %w", err)
+		}
+
+		tlsConfig := &tls.Config{
+			ClientAuth:   tls.NoClientCert,
+			Certificates: []tls.Certificate{certificate},
+		}
+
+		creds = grpc.Creds(credentials.NewTLS(tlsConfig))
+		s.Logger.Info(fmt.Sprintf("%s service gRPC server listening at %s with Attested TLS", s.Name, s.Address))
 	case s.Config.CertFile != "" || s.Config.KeyFile != "":
 		certificate, err := loadX509KeyPair(s.Config.CertFile, s.Config.KeyFile)
 		if err != nil {
@@ -179,3 +217,68 @@ func loadX509KeyPair(certfile, keyfile string) (tls.Certificate, error) {
 	}
 	return tls.X509KeyPair(cert, key)
 }
+
+func generateCertificatesForATLS(svc *agent.Service) ([]byte, []byte, error) {
+	curve := elliptic.P256()
+	privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to generate private/public key: %w", err)
+	}
+
+	publicKeyBytes, err := x509.MarshalPKIXPublicKey(&privateKey.PublicKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to marshal the public key: %w", err)
+	}
+
+	// The Attestation Report will be added as an X.509 certificate extension
+	attestationReport, err := (*svc).Attestation(context.Background(), sha3.Sum512(publicKeyBytes))
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to fetch the attestation report: %w", err)
+	}
+
+	certTemplate := &x509.Certificate{
+		SerialNumber: big.NewInt(202403311),
+		Subject: pkix.Name{
+			Organization:  []string{organization},
+			Country:       []string{country},
+			Province:      []string{province},
+			Locality:      []string{locality},
+			StreetAddress: []string{streetAddress},
+			PostalCode:    []string{postalCode},
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().AddDate(notAfterYear, notAfterMonth, notAfterDay),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		ExtraExtensions: []pkix.Extension{
+			{
+				Id:       asn1.ObjectIdentifier{1, 2, 3, 4, 5, 6},
+				Critical: false,
+				Value:    attestationReport,
+			},
+		},
+	}
+
+	certDERBytes, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+	}
+
+	certBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certDERBytes,
+	})
+
+	privateKeyBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to marshal the private key: %w", err)
+	}
+
+	keyBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: privateKeyBytes,
+	})
+
+	return certBytes, keyBytes, nil
+}
@@ -17,12 +17,13 @@ type Server interface {
 }

 type Config struct {
-	Host         string `env:"HOST"            envDefault:""`
-	Port         string `env:"PORT"            envDefault:""`
-	CertFile     string `env:"SERVER_CERT"     envDefault:""`
-	KeyFile      string `env:"SERVER_KEY"      envDefault:""`
-	ServerCAFile string `env:"SERVER_CA_CERTS" envDefault:""`
-	ClientCAFile string `env:"CLIENT_CA_CERTS" envDefault:""`
+	Host         string `env:"HOST"               envDefault:""`
+	Port         string `env:"PORT"               envDefault:""`
+	CertFile     string `env:"SERVER_CERT"        envDefault:""`
+	KeyFile      string `env:"SERVER_KEY"         envDefault:""`
+	ServerCAFile string `env:"SERVER_CA_CERTS"    envDefault:""`
+	ClientCAFile string `env:"CLIENT_CA_CERTS"    envDefault:""`
+	AttestedTLS  bool   `env:"ATTESTED_TLS"       envDefault:"false"`
 }

 type BaseServer struct {
@@ -176,6 +176,8 @@ MANAGER_QEMU_SEV_CBITPOS=51 \

 The kernel hash feature might not work with the current build of OVMF and QEMU. If so, build the host kernel, QEMU, and OVMF from the [AMD SEV GitHub](https://github.com/AMDESE/AMDSEV/tree/snp-latest) repository.

+To build the OVMF with the kernel hash capability, we must build the AmdSev package of OVMF. The result of the build should be a single `OVMF.fd` file (unlike the regular two OVFM files). The OVMF package is located at `OvmfPkg/AmdSev/AmdSevX64.dsc`.
+
 To enable [AMD SEV-SNP](https://www.amd.com/en/developer/sev.html) support, start manager like this 

 ```sh
@@ -185,7 +187,7 @@ MANAGER_QEMU_ENABLE_SEV=false \
 MANAGER_QEMU_ENABLE_SEV_SNP=true \
 MANAGER_QEMU_SEV_CBITPOS=51 \
 MANAGER_QEMU_BIN_PATH=<path to QEMU binary> \
-MANAGER_QEMU_QEMU_OVMF_CODE_FILE=<path to OVMF Amd Sev built package> \
+MANAGER_QEMU_QEMU_OVMF_CODE_FILE=<path to OVMF.fd Amd Sev built package> \
 ./build/cocos-manager
 ```

@@ -203,10 +205,10 @@ MANAGER_QEMU_KERNEL_HASH=true \

 ### Verifying VM launch

-NB: To verify that the manager successfully launched the VM, you need to open three terminals on the same machine. In one terminal, you need to launch the Manager test server by executing (with the environment variables of choice):
+NB: To verify that the manager successfully launched the VM, you need to open three terminals on the same machine. In one terminal, you need to launch the computations server by executing (with the environment variables of choice):

 ```bash
-go run ./test/manager-server/main.go
+go run ./test/computations/main.go <dataset path> <algo path>
 ```

 and in the second the manager by executing (with the environment variables of choice):
@@ -215,7 +217,7 @@ and in the second the manager by executing (with the environment variables of ch
 go run ./cmd/manager/main.go
 ```

-Ensure that the Manager can connect to the Manager test server by setting the MANAGER_GRPC_PORT with the port value of the Manager test server. The Manager test server is listening on the default value of the MANAGER_GRPC_PORT. In the last one, you can run the verification commands.
+Ensure that the Manager can connect to the Manager test server by setting the MANAGER_GRPC_PORT with the port value of the Manager test server. In the last terminal, you can run the verification commands.

 To verify that the manager launched the VM successfully, run the following command:

@@ -47,7 +47,7 @@ message ComputationRunReq {
  string name = 2;
  string description = 3;
  repeated Dataset datasets = 4;
-  repeated Algorithm algorithms = 5;
+  Algorithm algorithm = 5;
  repeated string result_consumers = 6;
  AgentConfig agent_config = 7;
 }
@@ -72,4 +72,5 @@ message AgentConfig {
  string client_ca_file = 5;
  string server_ca_file = 6;
  string log_level = 7;
+  bool   attested_tls = 8;
 }
@@ -18,7 +18,7 @@ const (
 )

 func CreateVM(ctx context.Context, cfg Config) (*exec.Cmd, error) {
-	// Create unique emu device identifiers.
+	// Create unique emu device identifiers
 	id, err := uuid.NewV4()
 	if err != nil {
 		return &exec.Cmd{}, err
@@ -27,18 +27,20 @@ func CreateVM(ctx context.Context, cfg Config) (*exec.Cmd, error) {
 	qemuCfg.NetDevConfig.ID = fmt.Sprintf("%s-%s", qemuCfg.NetDevConfig.ID, id)
 	qemuCfg.SevConfig.ID = fmt.Sprintf("%s-%s", qemuCfg.SevConfig.ID, id)

-	// Copy firmware vars file.
-	srcFile := qemuCfg.OVMFVarsConfig.File
-	dstFile := fmt.Sprintf("%s/%s-%s.fd", cfg.TmpFileLoc, firmwareVars, id)
-	err = internal.CopyFile(srcFile, dstFile)
-	if err != nil {
-		return &exec.Cmd{}, err
+	if !cfg.KernelHash {
+		// Copy firmware vars file
+		srcFile := qemuCfg.OVMFVarsConfig.File
+		dstFile := fmt.Sprintf("%s/%s-%s.fd", cfg.TmpFileLoc, firmwareVars, id)
+		err = internal.CopyFile(srcFile, dstFile)
+		if err != nil {
+			return &exec.Cmd{}, err
+		}
+		qemuCfg.OVMFVarsConfig.File = dstFile
 	}
-	qemuCfg.OVMFVarsConfig.File = dstFile

-	// Copy img files.
-	srcFile = qemuCfg.DiskImgConfig.KernelFile
-	dstFile = fmt.Sprintf("%s/%s-%s", cfg.TmpFileLoc, KernelFile, id)
+	// Copy img files
+	srcFile := qemuCfg.DiskImgConfig.KernelFile
+	dstFile := fmt.Sprintf("%s/%s-%s", cfg.TmpFileLoc, KernelFile, id)
 	err = internal.CopyFile(srcFile, dstFile)
 	if err != nil {
 		return &exec.Cmd{}, err
@@ -84,13 +84,8 @@ func (ms *managerService) Run(ctx context.Context, c *manager.ComputationRunReq)
 			LogLevel:     c.AgentConfig.LogLevel,
 		},
 	}
-	for _, algo := range c.Algorithms {
-		if len(algo.Hash) != hashLength {
-			ms.publishEvent("vm-provision", c.Id, "failed", json.RawMessage{})
-			return "", errInvalidHashLength
-		}
-		ac.Algorithms = append(ac.Algorithms, agent.Algorithm{ID: algo.Id, Provider: algo.Provider, Hash: [hashLength]byte(algo.Hash)})
-	}
+	ac.Algorithm = agent.Algorithm{ID: c.Algorithm.Id, Provider: c.Algorithm.Provider, Hash: [hashLength]byte(c.Algorithm.Hash)}
+
 	for _, data := range c.Datasets {
 		if len(data.Hash) != hashLength {
 			ms.publishEvent("vm-provision", c.Id, "failed", json.RawMessage{})
@@ -5,12 +5,20 @@ package grpc
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/asn1"
+	"encoding/json"
 	"fmt"
 	"os"
 	"time"

 	"github.com/absmach/magistrala/pkg/errors"
+	"github.com/google/go-sev-guest/abi"
+	"github.com/google/go-sev-guest/proto/check"
+	"github.com/google/go-sev-guest/validate"
+	"github.com/google/go-sev-guest/verify"
+	"github.com/google/go-sev-guest/verify/trust"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"golang.org/x/crypto/sha3"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
@@ -25,8 +33,22 @@ const (
 )

 var (
-	errGrpcConnect = errors.New("failed to connect to grpc server")
-	errGrpcClose   = errors.New("failed to close grpc connection")
+	errGrpcConnect      = errors.New("failed to connect to grpc server")
+	errGrpcClose        = errors.New("failed to close grpc connection")
+	errManifestOpen     = errors.New("failed to open Manifest")
+	errManifestMissing  = errors.New("failed due to missing Manifest")
+	errManifestDecode   = errors.New("failed to decode Manifest json")
+	errCertificateParse = errors.New("failed to parse x509 certificate")
+	errAttVerification  = errors.New("attestation verification failed")
+	errAttValidation    = errors.New("attestation validation failed")
+	errCustomExtension  = errors.New("failed due to missing custom extension")
+)
+
+var (
+	customSEVSNPExtensionOID = asn1.ObjectIdentifier{1, 2, 3, 4, 5, 6}
+	attestationConfiguration = AttestationConfiguration{}
+	timeout                  = time.Minute * 2
+	maxTryDelay              = time.Second * 30
 )

 type Config struct {
@@ -35,6 +57,13 @@ type Config struct {
 	ServerCAFile string        `env:"SERVER_CA_CERTS" envDefault:""`
 	URL          string        `env:"URL"             envDefault:"localhost:7001"`
 	Timeout      time.Duration `env:"TIMEOUT"         envDefault:"60s"`
+	AttestedTLS  bool          `env:"ATTESTED_TLS"    envDefault:"false"`
+	Manifest     string        `env:"MANIFEST"        envDefault:""`
+}
+
+type AttestationConfiguration struct {
+	SNPPolicy   *check.Policy      `json:"snp_policy,omitempty"`
+	RootOFTrust *check.RootOfTrust `json:"root_of_trust,omitempty"`
 }

 type Client interface {
@@ -102,34 +131,47 @@ func connect(cfg Config) (*grpc.ClientConn, security, error) {
 	secure := withoutTLS
 	tc := insecure.NewCredentials()

-	if cfg.ServerCAFile != "" {
-		tlsConfig := &tls.Config{}
-
-		// Loading root ca certificates file
-		rootCA, err := os.ReadFile(cfg.ServerCAFile)
+	if cfg.AttestedTLS {
+		err := readManifest(cfg)
 		if err != nil {
-			return nil, secure, fmt.Errorf("failed to load root ca file: %w", err)
-		}
-		if len(rootCA) > 0 {
-			capool := x509.NewCertPool()
-			if !capool.AppendCertsFromPEM(rootCA) {
-				return nil, secure, fmt.Errorf("failed to append root ca to tls.Config")
-			}
-			tlsConfig.RootCAs = capool
-			secure = withTLS
+			return nil, secure, fmt.Errorf("failed to read Manifest %w", err)
 		}

-		// Loading mtls certificates file
-		if cfg.ClientCert != "" || cfg.ClientKey != "" {
-			certificate, err := tls.LoadX509KeyPair(cfg.ClientCert, cfg.ClientKey)
-			if err != nil {
-				return nil, secure, fmt.Errorf("failed to client certificate and key %w", err)
-			}
-			tlsConfig.Certificates = []tls.Certificate{certificate}
-			secure = withmTLS
+		tlsConfig := &tls.Config{
+			InsecureSkipVerify:    true,
+			VerifyPeerCertificate: verifyAttestationReportTLS,
 		}
-
 		tc = credentials.NewTLS(tlsConfig)
+	} else {
+		if cfg.ServerCAFile != "" {
+			tlsConfig := &tls.Config{}
+
+			// Loading root ca certificates file
+			rootCA, err := os.ReadFile(cfg.ServerCAFile)
+			if err != nil {
+				return nil, secure, fmt.Errorf("failed to load root ca file: %w", err)
+			}
+			if len(rootCA) > 0 {
+				capool := x509.NewCertPool()
+				if !capool.AppendCertsFromPEM(rootCA) {
+					return nil, secure, fmt.Errorf("failed to append root ca to tls.Config")
+				}
+				tlsConfig.RootCAs = capool
+				secure = withTLS
+			}
+
+			// Loading mTLS certificates file
+			if cfg.ClientCert != "" || cfg.ClientKey != "" {
+				certificate, err := tls.LoadX509KeyPair(cfg.ClientCert, cfg.ClientKey)
+				if err != nil {
+					return nil, secure, fmt.Errorf("failed to client certificate and key %w", err)
+				}
+				tlsConfig.Certificates = []tls.Certificate{certificate}
+				secure = withmTLS
+			}
+
+			tc = credentials.NewTLS(tlsConfig)
+		}
 	}

 	opts = append(opts, grpc.WithTransportCredentials(tc))
@@ -140,3 +182,99 @@ func connect(cfg Config) (*grpc.ClientConn, security, error) {
 	}
 	return conn, secure, nil
 }
+
+func readManifest(cfg Config) error {
+	if cfg.Manifest != "" {
+		manifest, err := os.Open(cfg.Manifest)
+		if err != nil {
+			return errors.Wrap(errManifestOpen, err)
+		}
+		defer manifest.Close()
+
+		decoder := json.NewDecoder(manifest)
+		err = decoder.Decode(&attestationConfiguration)
+		if err != nil {
+			return errors.Wrap(errManifestDecode, err)
+		}
+
+		return nil
+	}
+
+	return errManifestMissing
+}
+
+func verifyAttestationReportTLS(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+	cert, err := x509.ParseCertificate(rawCerts[0])
+	if err != nil {
+		return errors.Wrap(errCertificateParse, err)
+	}
+
+	for _, ext := range cert.Extensions {
+		if ext.Id.Equal(customSEVSNPExtensionOID) {
+			// Check if the certificate is self-signed
+			err := checkIfCertificateSelfSigned(cert)
+			if err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			publicKeyBytes, err := x509.MarshalPKIXPublicKey(cert.PublicKey)
+			if err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			expectedReportData := sha3.Sum512(publicKeyBytes)
+			attestationConfiguration.SNPPolicy.ReportData = expectedReportData[:]
+
+			// Attestation verification and validation
+			sopts, err := verify.RootOfTrustToOptions(attestationConfiguration.RootOFTrust)
+			if err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			sopts.Product = attestationConfiguration.SNPPolicy.Product
+			sopts.Getter = &trust.RetryHTTPSGetter{
+				Timeout:       timeout,
+				MaxRetryDelay: maxTryDelay,
+				Getter:        &trust.SimpleHTTPSGetter{},
+			}
+
+			attestationPB, err := abi.ReportCertsToProto(ext.Value)
+			if err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			if err = verify.SnpAttestation(attestationPB, sopts); err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			opts, err := validate.PolicyToOptions(attestationConfiguration.SNPPolicy)
+			if err != nil {
+				return errors.Wrap(errAttVerification, err)
+			}
+
+			if err = validate.SnpAttestation(attestationPB, opts); err != nil {
+				return errors.Wrap(errAttValidation, err)
+			}
+
+			return nil
+		}
+	}
+
+	return errCustomExtension
+}
+
+func checkIfCertificateSelfSigned(cert *x509.Certificate) error {
+	certPool := x509.NewCertPool()
+	certPool.AddCert(cert)
+
+	opts := x509.VerifyOptions{
+		Roots:       certPool,
+		CurrentTime: time.Now(),
+	}
+
+	if _, err := cert.Verify(opts); err != nil {
+		return err
+	}
+
+	return nil
+}
@@ -3,7 +3,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.33.0
 // 	protoc        v4.25.3
 // source: manager/manager.proto

@@ -341,7 +341,7 @@ type ComputationRunReq struct {
 	Name            string       `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	Description     string       `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
 	Datasets        []*Dataset   `protobuf:"bytes,4,rep,name=datasets,proto3" json:"datasets,omitempty"`
-	Algorithms      []*Algorithm `protobuf:"bytes,5,rep,name=algorithms,proto3" json:"algorithms,omitempty"`
+	Algorithm       *Algorithm   `protobuf:"bytes,5,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
 	ResultConsumers []string     `protobuf:"bytes,6,rep,name=result_consumers,json=resultConsumers,proto3" json:"result_consumers,omitempty"`
 	AgentConfig     *AgentConfig `protobuf:"bytes,7,opt,name=agent_config,json=agentConfig,proto3" json:"agent_config,omitempty"`
 }
@@ -406,9 +406,9 @@ func (x *ComputationRunReq) GetDatasets() []*Dataset {
 	return nil
 }

-func (x *ComputationRunReq) GetAlgorithms() []*Algorithm {
+func (x *ComputationRunReq) GetAlgorithm() *Algorithm {
 	if x != nil {
-		return x.Algorithms
+		return x.Algorithm
 	}
 	return nil
 }
@@ -565,6 +565,7 @@ type AgentConfig struct {
 	ClientCaFile string `protobuf:"bytes,5,opt,name=client_ca_file,json=clientCaFile,proto3" json:"client_ca_file,omitempty"`
 	ServerCaFile string `protobuf:"bytes,6,opt,name=server_ca_file,json=serverCaFile,proto3" json:"server_ca_file,omitempty"`
 	LogLevel     string `protobuf:"bytes,7,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
+	AttestedTls  bool   `protobuf:"varint,8,opt,name=attested_tls,json=attestedTls,proto3" json:"attested_tls,omitempty"`
 }

 func (x *AgentConfig) Reset() {
@@ -648,6 +649,13 @@ func (x *AgentConfig) GetLogLevel() string {
 	return ""
 }

+func (x *AgentConfig) GetAttestedTls() bool {
+	if x != nil {
+		return x.AttestedTls
+	}
+	return false
+}
+
 var File_manager_manager_proto protoreflect.FileDescriptor

 var file_manager_manager_proto_rawDesc = []byte{
@@ -696,7 +704,7 @@ var file_manager_manager_proto_rawDesc = []byte{
 	0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x72, 0x2e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00,
 	0x52, 0x06, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x73, 0x42, 0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x9f, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74,
+	0x61, 0x67, 0x65, 0x22, 0x9d, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74,
 	0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
 	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a,
@@ -704,47 +712,49 @@ var file_manager_manager_proto_rawDesc = []byte{
 	0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
 	0x2c, 0x0a, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
 	0x0b, 0x32, 0x10, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x44, 0x61, 0x74, 0x61,
-	0x73, 0x65, 0x74, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x12, 0x32, 0x0a,
-	0x0a, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x6c, 0x67, 0x6f,
-	0x72, 0x69, 0x74, 0x68, 0x6d, 0x52, 0x0a, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d,
-	0x73, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6d, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73,
-	0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x73, 0x12, 0x37, 0x0a, 0x0c,
-	0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65,
-	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x49, 0x0a, 0x07, 0x44, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74,
-	0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
-	0x68, 0x61, 0x73, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68,
-	0x22, 0x4b, 0x0a, 0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x1a, 0x0a,
-	0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73,
-	0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x22, 0xd6, 0x01,
-	0x0a, 0x0b, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a,
-	0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x6f, 0x72,
-	0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69,
-	0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74, 0x46, 0x69,
-	0x6c, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a,
-	0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x61, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x61, 0x46,
-	0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61,
-	0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x43, 0x61, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6c, 0x6f, 0x67,
-	0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6c, 0x6f,
-	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x32, 0x5b, 0x0a, 0x0e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x49, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x63,
-	0x65, 0x73, 0x73, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x1a, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6d, 0x70,
-	0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x22, 0x00, 0x28,
-	0x01, 0x30, 0x01, 0x42, 0x0b, 0x5a, 0x09, 0x2e, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x65, 0x74, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x12, 0x30, 0x0a,
+	0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x6c, 0x67, 0x6f, 0x72,
+	0x69, 0x74, 0x68, 0x6d, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12,
+	0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6d,
+	0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x75, 0x6c,
+	0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x73, 0x12, 0x37, 0x0a, 0x0c, 0x61, 0x67,
+	0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x22, 0x49, 0x0a, 0x07, 0x44, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x12, 0x1a,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61,
+	0x73, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x22, 0x4b,
+	0x0a, 0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x22, 0xf9, 0x01, 0x0a, 0x0b,
+	0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68,
+	0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6c, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65,
+	0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x61, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x61, 0x46, 0x69, 0x6c,
+	0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x5f, 0x66,
+	0x69, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x43, 0x61, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6c, 0x6f, 0x67, 0x5f, 0x6c,
+	0x65, 0x76, 0x65, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6c, 0x6f, 0x67, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x65, 0x64,
+	0x5f, 0x74, 0x6c, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x74, 0x74, 0x65,
+	0x73, 0x74, 0x65, 0x64, 0x54, 0x6c, 0x73, 0x32, 0x5b, 0x0a, 0x0e, 0x4d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x49, 0x0a, 0x07, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x1a, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6d,
+	0x70, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x22, 0x00,
+	0x28, 0x01, 0x30, 0x01, 0x42, 0x0b, 0x5a, 0x09, 0x2e, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -778,7 +788,7 @@ var file_manager_manager_proto_depIdxs = []int32{
 	1, // 3: manager.ClientStreamMessage.agent_event:type_name -> manager.AgentEvent
 	0, // 4: manager.ClientStreamMessage.run_res:type_name -> manager.RunResponse
 	5, // 5: manager.ComputationRunReq.datasets:type_name -> manager.Dataset
-	6, // 6: manager.ComputationRunReq.algorithms:type_name -> manager.Algorithm
+	6, // 6: manager.ComputationRunReq.algorithm:type_name -> manager.Algorithm
 	7, // 7: manager.ComputationRunReq.agent_config:type_name -> manager.AgentConfig
 	3, // 8: manager.ManagerService.Process:input_type -> manager.ClientStreamMessage
 	4, // 9: manager.ManagerService.Process:output_type -> manager.ComputationRunReq
@@ -8,6 +8,7 @@ import (
 	"log"
 	"log/slog"
 	"os"
+	"strconv"

 	mglog "github.com/absmach/magistrala/logger"
 	"github.com/ultravioletrs/cocos/internal/env"
@@ -29,8 +30,9 @@ const (
 )

 var (
-	algoPath = "./test/manual/algo/lin_reg.py"
-	dataPath = "./test/manual/data/iris.csv"
+	algoPath    = "./test/manual/algo/lin_reg.py"
+	dataPath    = "./test/manual/data/iris.csv"
+	attestedTLS = false
 )

 type svc struct {
@@ -56,21 +58,28 @@ func (s *svc) Run(ipAdress string, reqChan chan *manager.ComputationRunReq) {
 		Name:            "sample computation",
 		Description:     "sample descrption",
 		Datasets:        []*manager.Dataset{{Id: "1", Provider: "provider1", Hash: dataHash[:]}},
-		Algorithms:      []*manager.Algorithm{{Id: "1", Provider: "provider1", Hash: algoHash[:]}},
+		Algorithm:       &manager.Algorithm{Id: "1", Provider: "provider1", Hash: algoHash[:]},
 		ResultConsumers: []string{"consumer1"},
 		AgentConfig: &manager.AgentConfig{
-			Port:     "7002",
-			LogLevel: "debug",
+			Port:        "7002",
+			LogLevel:    "debug",
+			AttestedTls: attestedTLS,
 		},
 	}
 }

 func main() {
-	if len(os.Args) < 3 {
-		log.Fatalf("usage: %s <data-path> <algo-path>", os.Args[0])
+	if len(os.Args) < 4 {
+		log.Fatalf("usage: %s <data-path> <algo-path> <attested-tls-bool>", os.Args[0])
 	}
 	dataPath = os.Args[1]
 	algoPath = os.Args[2]
+	attestedTLSParam, err := strconv.ParseBool(os.Args[3])
+	if err != nil {
+		log.Fatalf("usage: %s <data-path> <algo-path> <attested-tls-bool>, <attested-tls-bool> must be a bool value", os.Args[0])
+	}
+	attestedTLS = attestedTLSParam
+
 	ctx, cancel := context.WithCancel(context.Background())
 	g, ctx := errgroup.WithContext(ctx)
 	incomingChan := make(chan *manager.ClientStreamMessage)
@@ -104,7 +113,7 @@ func main() {
 		return
 	}

-	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger)
+	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, nil)

 	g.Go(func() error {
 		return gs.Start()
@@ -2,15 +2,13 @@

 ## CLI

-Throughout the tests, we assume that our current working directory is the root of the `agent` repository, both on the host machine and in the VM.
+Throughout the tests, we assume that our current working directory is the root of the `cocos` repository, both on the host machine and in the VM.

 ### Python requirements

-Do this both on the host machine and in the VM.
+Do this in the VM.

 ```sh
-apt update
-apt install python3-pip
 pip3 install pandas scikit-learn
 ```

@@ -22,7 +20,10 @@ Open console on the host, and run

 ```sh
 export AGENT_GRPC_URL=localhost:7002
-export MANAGER_GRPC_URL=localhost:7001
+
+# For attested TLS, also define the path to the computation.json that contains reference values for the fields of the attestation report
+export AGENT_GRPC_MANIFEST=./test/manual/computation/computation.json
+export AGENT_GRPC_ATTESTED_TLS=true

 # Retieve Attestation
 go run cmd/cli/main.go attestation get '<report_data>'
@@ -9,6 +9,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"os"
+	"strconv"

 	"github.com/mdlayher/vsock"
 	"github.com/ultravioletrs/cocos/pkg/manager"
@@ -18,12 +20,13 @@ import (
 const VsockConfigPort uint32 = 9999

 type AgentConfig struct {
-	LogLevel   string `json:"log_level"`
-	InstanceID string `json:"instance_id"`
-	Host       string `json:"host"`
-	Port       string `json:"port"`
-	CertFile   string `json:"cert_file"`
-	KeyFile    string `json:"server_key"`
+	LogLevel    string `json:"log_level"`
+	InstanceID  string `json:"instance_id"`
+	Host        string `json:"host"`
+	Port        string `json:"port"`
+	CertFile    string `json:"cert_file"`
+	KeyFile     string `json:"server_key"`
+	AttestedTls bool   `json:"attested_tls"`
 }

 type Computation struct {
@@ -69,6 +72,19 @@ type Algorithm struct {
 type Algorithms []Algorithm

 func main() {
+	attestedTLS := false
+
+	if len(os.Args) == 2 {
+		attestedTLSParam, err := strconv.ParseBool(os.Args[1])
+		if err != nil {
+			log.Fatalf("usage: %s <attested-tls> - <attested-tls> must be true or false", os.Args[0])
+		}
+
+		attestedTLS = attestedTLSParam
+	} else if len(os.Args) > 2 {
+		log.Fatalf("usage: %s <attested-tls>", os.Args[0])
+	}
+
 	l, err := vsock.Listen(9997, nil)
 	if err != nil {
 		log.Fatal(err)
@@ -79,8 +95,9 @@ func main() {
 		Algorithms:      Algorithms{Algorithm{ID: "1", Provider: "pr1"}},
 		ResultConsumers: []string{"1"},
 		AgentConfig: AgentConfig{
-			LogLevel: "debug",
-			Port:     "7002",
+			LogLevel:    "debug",
+			Port:        "7002",
+			AttestedTls: attestedTLS,
 		},
 	}
 	fmt.Println(SendAgentConfig(3, ac))
@@ -0,0 +1,15 @@
+{
+  "snp_policy": {
+      "minimum_guest_svn": 0,
+      "policy": 196608,
+      "minimum_tcb": 1,
+      "minimum_version": "1.0",
+      "minimum_launch_tcb": 1,
+      "measurement": [232, 141, 188, 114, 162, 221, 214, 6, 150, 248, 3, 173, 230, 39, 48, 120, 105, 243, 15, 242, 79, 67, 112, 128, 44, 119, 216, 226, 170, 255, 212, 154, 58, 68, 231, 30, 20, 235, 228, 42, 43, 1, 95, 191, 51, 113, 19, 72],
+      "minimum_build": 1
+    },
+  "root_of_trust": {
+      "product": "Milan",
+      "check_crl": true
+  }
+}
Author	SHA1	Message	Date
Sammy Kerata Oina	64f7e7f7fd	NOISSUE - Refactor single algorithm processing (#117 ) * Refactor single algorithm processing Simplified the agent service's algorithm handling logic to process a single algorithm instead of multiple. This change: - Removed the `Algorithms` type and associated stringer implementation. - Updated the state machine and service logic to expect a singular algorithm, aligning the agent's internal state transitions with the new model. - Adjusted the manager service and computations test server to mirror these changes in their respective payload structures, ensuring API and test consistency. - Altered README files to reflect the simplified interaction model and removed outdated descriptions. - Reverted the protoc-gen-go version used for generating protobuf files to maintain compatibility with the rest of the codebase. The single-algorithm approach streamlines the computation running process, reducing complexity and potential error conditions. It directly impacts how external services will construct and send computation requests. Signed-off-by: SammyOina <sammyoina@gmail.com> * Update protoc-gen-go version to v1.33.0 Signed-off-by: SammyOina <sammyoina@gmail.com> * Refactor variable name in computations.go and grpc.go Signed-off-by: SammyOina <sammyoina@gmail.com> --------- Signed-off-by: SammyOina <sammyoina@gmail.com>	2024-04-17 13:34:54 +02:00
Danko Miladinovic	3a14896555	NOISSUE - Attested TLS (#99 ) * added initial code for attested TLS * added client validation and verification * fixed bugs for attested TLS * updated README for manual testing * fixed CI errors * removed SNP pollicy from agent config * added attested TLS config param to AgentConfig * generated manager.pb.go for protoc v25.2 * updated proto-gen-go version on CI * generated agent.pb.go to match newest proto gen version * define errors for error handling * fixed comments	2024-04-16 15:19:19 +02:00
Drasko DRASKOVIC	b57bafd310	Fix usage (#114 ) Signed-off-by: Drasko Draskovic <drasko.draskovic@gmail.com>	2024-04-16 00:42:47 +02:00
Drasko DRASKOVIC	9e6fb31d90	Fix links and add features (#113 ) Signed-off-by: Drasko Draskovic <drasko.draskovic@gmail.com>	2024-04-15 22:26:41 +02:00