Move steve and locksmith from ENV vars into code level #278

anton commented 2026年06月09日 18:56:57 +02:00

No description provided.

vkobel commented 2026年06月25日 13:13:34 +02:00

We should also publish those values, it's a bit of an edge case I got and a minor one, but I wanted to be able to predict the PCR values of my undeployed enclave locally, THEN check what has been deploy matches (reverse of the current flow, which is totally fine).

Thinking of having the values displayed in the footer (basically the env vars that can be set by .env:

ENCLAVEOS_COMMIT=9582e252...
BOOTPROOF_COMMIT=64dae062...
STEVE_COMMIT=ed38a190...
LOCKSMITH_COMMIT=d16b74c6...

so we could:

1. display these live on the dashboard, like in the footer
2. serve a .well-known/caution-build-inputs.json file with it (see below)
3. in the sources tab when clicking verify on a deployment (widget) since they're part of the manifest

Example .well-known/caution-build-inputs.json

{
 "enclaveos_commit": "9582e252...",
 "bootproof_commit": "78f531a2...",
 "steve_commit": "ed38a190...",
 "locksmith_commit": "d16b74c6...",
 "effective_since": "2026年06月01日T00:00:00Z",
 "source_repos": {
 "bootproof": "https://git.distrust.co/public/bootproof.git",
 "enclaveos": "https://git.distrust.co/public/enclaveos.git",
 "steve": "https://git.distrust.co/public/steve.git",
 "locksmith": "https://codeberg.org/caution/locksmith.git"
 }
}

We should also publish those values, it's a bit of an edge case I got and a minor one, but I wanted to be able to predict the PCR values of my undeployed enclave locally, THEN check what has been deploy matches (reverse of the current flow, which is totally fine). Thinking of having the values displayed in the footer (basically the env vars that can be set by .env: ``` ENCLAVEOS_COMMIT=9582e252... BOOTPROOF_COMMIT=64dae062... STEVE_COMMIT=ed38a190... LOCKSMITH_COMMIT=d16b74c6... ``` so we could: 1. display these live on the dashboard, like in the footer 2. serve a `.well-known/caution-build-inputs.json` file with it (see below) 3. in the sources tab when clicking verify on a deployment (widget) since they're part of the manifest Example `.well-known/caution-build-inputs.json` ```json { "enclaveos_commit": "9582e252...", "bootproof_commit": "78f531a2...", "steve_commit": "ed38a190...", "locksmith_commit": "d16b74c6...", "effective_since": "2026年06月01日T00:00:00Z", "source_repos": { "bootproof": "https://git.distrust.co/public/bootproof.git", "enclaveos": "https://git.distrust.co/public/enclaveos.git", "steve": "https://git.distrust.co/public/steve.git", "locksmith": "https://codeberg.org/caution/locksmith.git" } } ```

vkobel commented 2026年06月25日 16:37:39 +02:00

Here we go, it was a quick one I think #324

Here we go, it was a quick one I think https://codeberg.org/caution/platform/pulls/324

vkobel commented 2026年06月26日 11:24:58 +02:00

I think we close this one: steve/bootproof/locksmith are already code-level defaults (build.rs:13-16), env vars are only as an override that the platform doesn't actually set (but we do in .env)

I think we close this one: steve/bootproof/locksmith are already code-level defaults (build.rs:13-16), env vars are only as an override that the platform doesn't actually set (but we do in .env)