9
2
Fork
You've already forked platform
2

integrate locksmith #136

Manually merged
anton merged 6 commits from integrate-locksmith into main 2026年04月03日 00:50:12 +02:00
Owner
Copy link
No description provided.
anton force-pushed integrate-locksmith from 6712e97f90 to 89e63d30cf 2026年04月01日 20:10:45 +02:00 Compare
anton force-pushed integrate-locksmith from 89e63d30cf to 18f756835c 2026年04月01日 21:08:57 +02:00 Compare
@ -492,2 +501,4 @@
}
// Port 8084 is reserved for locksmith when locksmith is enabled
iflocksmith.unwrap_or(false)&&ports.contains(&8084){

8084 is removed from ports regardless of whether locksmith is enabled or not. this should only check for the user specifying port 8084.

8084 is removed from ports regardless of whether locksmith is enabled or not. this should _only_ check for the user specifying port 8084.
anton marked this conversation as resolved
@ -574,7 +583,7 @@ fn render_templates(request: &BuildRequest) -> (String, String) {
};
letcustom_port_proxies: String =request.ports.iter()
.filter(|&&p|p!=8080&&p!=8081&&p!=8082)

we should probably error if the user provides any of these ports, but we plan to override them. see other comment for how this can accidentally be a silent error.

we should probably error if the user provides any of these ports, but we plan to override them. see other comment for how this can accidentally be a silent error.
anton marked this conversation as resolved
@ -4909,0 +4988,4 @@
letaddress=format!("{}:8084",public_ip);
eprintln!("Sending shard to enclave at {}...",address);
// Invoke locksmith binary to send the shard

why not pull in the crate?

why not pull in the crate?
Author
Owner
Copy link

the resolver u included there doesn't work with my current setup, and keymaker-models doesn't seem to be exported properly for the crate

the resolver u included there doesn't work with my current setup, and keymaker-models doesn't seem to be exported properly for the crate
@ -174,7 +184,7 @@ async fn render_run_sh_template(
letcustom_port_proxies: String =ports
.iter()
.filter(|&&port|port!=8080&&port!=8081&&port!=8082)

same as above, these should raise errors of some sort

same as above, these should raise errors of some sort
anton marked this conversation as resolved
@ -3732,0 +3752,4 @@
"pcr2": remote_pcrs.pcr2,
"verified_at": chrono::Utc::now().to_rfc3339(),
});
lethashes_path=PathBuf::from(".caution/trusted_hashes.json");
Author
Owner
Copy link

these hashes should be added via explicit instruction, not automatically

these hashes should be added via explicit instruction, not automatically

flag this under --save-pcrs ?

flag this under `--save-pcrs` ?
@ -556,0 +567,4 @@
anyhow::bail!("Port {} is reserved for {}",port,service);
}
}
ifrequest.locksmith&&request.ports.contains(&8084){

we should deny it unconditionally

we should deny it unconditionally
@ -575,3 +599,3 @@
letcustom_port_proxies: String =request.ports.iter()
.filter(|&&p|p!=8080&&p!=8081&&p!=8082)
.filter(|&&p|p!=8080&&p!=8081&&p!=8082&&!(request.locksmith&&p==8084))

just realized, is this missing steve? port 8083?

just realized, is this missing steve? port 8083?

oh disregard, STEVE forwards to 8083.

oh disregard, STEVE forwards to 8083.
anton marked this conversation as resolved
anton manually merged commit 5bedc6a637 into main 2026年04月03日 00:50:11 +02:00
Sign in to join this conversation.
No reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Component/Enclave-Builder
This issue affects Enclave Builder (git-push and CLI)
Component/Infrastructure
This issue affects generic Caution hosted infra components
Deploy/BYOC
Relates to Caution Bring-your-own-compute
Deploy/Full-managed
Relates to Caution fully managed cloud
Deploy/Self-hosted
Relates to Caution deployed on self-hosted infra
Interface/API
This issue affects the API
Interface/CLI
This issue affects the command line interface
Interface/Git
This issue affects the Git `push` interface
Interface/Web
This issue affects the web dashboard
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
 The priority is critical
Priority
High
 The priority is high
Priority
Low
 The priority is low
Priority
Medium
 The priority is medium
Reviewed
Confirmed
 Issue has been confirmed
Reviewed
Duplicate
 This issue or pull request already exists
Reviewed
Invalid
 Invalid issue
Reviewed
Won't Fix
 This issue won't be fixed
Status
Abandoned
 Somebody has started to work on this but abandoned work
Status
Blocked
 Something is blocking this issue or pull request
Status
Need More Info
 Feedback is required to reproduce issue or to continue work
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
caution/platform!136
Reference in a new issue
caution/platform
No description provided.
Delete branch "integrate-locksmith"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?