This repo consists of Solidity implementation for an on-chain PCCS (Provisioning Certificate Caching Service) used in Intel DCAP (Data Center Attestation Primitives).
On-chain PCCS provides an open and permissionless service where users can freely contribute and be given easy access to collaterals for quote verification.
ℹ️ Note:
The deployment addresses shown here are currently based on the latest changes made.
To view deployments on the previous version (will be deprecated soon), you may refer to this branch.
There are two sets of contracts, i.e. the Helper and Base.
The Helper contracts provide APIs for parsing collaterals and converting into Solidity structs, i.e. QEIdentity.json, TCBInfo.json, basic DER-decoder for PCK X509 leaf certificate and extensions and X509 CRLs.
The base contracts are libraries that provide the Data Access Object (DAO) APIs with similar designs inspired from the Design Guide for Intel SGX PCCS.
Base contracts are dependent on Helper contracts to parse collaterals, and contains implementation of basic collateral authenticity check functions for upserts. Smart contract developers are encouraged to extend the base contracts to build their own custom implementation of on-chain PCCS.
Our DAO implementation can be found in the automata_pccs directory.
-
Install Foundry
-
Create
.envfile with the provided example.
cp env/.{network}.env.example .env- Compile the contracts
forge build- Run tests
forge testTo view gas report, pass the --gas-report flag.
- Deploy the Helper contracts
./script/helper/deploy.shIf you are having issues running the script, try changing the permission settings.
chmod +x ./script/helper/deploy.shMake sure to update .env file with the appropriate addresses, then run source .env.
- Deploy
automata-pccs
forge script DeployAutomataDao --rpc-url $RPC_URL -vvvv --broadcast --sig "deployAll(bool)" trueMake sure to update .env file with the appropriate addresses, then run source .env.
Once you have deployed all Automata DAOs, you must grant them write access to AutomataDaoStorage by running:
forge script ConfigureAutomataDao -rpc-url $RPC_URL -vvvv --broadcast --sig "updateStorageDao()"