diff --git a/finalize_manifest.py b/finalize_manifest.py index bae7f5d7..d5e0d4ff 100755 --- a/finalize_manifest.py +++ b/finalize_manifest.py @@ -23,28 +23,6 @@ def is_utf8(filename_bytes): except UnicodeError: return False -def uri2path(uri): - if not uri.startswith('file:'): - raise ManifestError(f'Unsupported URI type: {uri}') - return pathlib.Path(uri[len('file:'):]) - -def compute_sha256(filename): - sha256 = hashlib.sha256() - with open(filename, 'rb') as f: - for byte_block in iter(lambda: f.read(128 * sha256.block_size), b''): - sha256.update(byte_block) - return sha256.hexdigest() - -def expand_trusted_files(trusted_files): - expanded_files = [] - for uri in trusted_files: - file_path = uri2path(uri) - if file_path.exists(): - expanded_files.append({'uri': uri, 'sha256': compute_sha256(file_path)}) - else: - raise ManifestError(f'File not found: {file_path}') - return expanded_files - def extract_files_from_user_manifest(manifest): files = [] @@ -163,7 +141,7 @@ def main(args=None): if 'allow_all_but_log' not in rendered_manifest_dict['sgx'].get('file_check_policy', ''): trusted_files = generate_trusted_files(args.dir, already_added_files) - rendered_manifest_dict['sgx']['trusted_files'] = expand_trusted_files(trusted_files + already_added_files) + rendered_manifest_dict['sgx'].setdefault('trusted_files', []).extend(trusted_files) else: print(f'\t[from inside Docker container] Skipping trusted files generation. This image must not be used in production.') diff --git a/templates/Dockerfile.common.build.template b/templates/Dockerfile.common.build.template index 7b36c3b0..feb4b26d 100644 --- a/templates/Dockerfile.common.build.template +++ b/templates/Dockerfile.common.build.template @@ -62,7 +62,8 @@ RUN chmod u+x /gramine/app_files/apploader.sh \ && rm -f /gramine/app_files/finalize_manifest.py RUN {% block path %}{% endblock %} \ - && gramine-manifest-check /gramine/app_files/entrypoint.manifest + && gramine-manifest /gramine/app_files/entrypoint.manifest \ + /gramine/app_files/entrypoint.manifest # Define default command ENTRYPOINT ["/bin/bash", "/gramine/app_files/apploader.sh"]