Prove subsets of transcript ranges #1864
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: | |
| - dev | |
| tags: | |
| - "[v]?[0-9]+.[0-9]+.[0-9]+*" | |
| pull_request: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| attestations: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse | |
| # We need a higher number of parallel rayon tasks than the default (which is 4) | |
| # in order to prevent a deadlock, c.f. | |
| # - https://github.com/tlsnotary/tlsn/issues/548 | |
| # - https://github.com/privacy-scaling-explorations/mpz/issues/178 | |
| # 32 seems to be big enough for the foreseeable future | |
| RAYON_NUM_THREADS: 32 | |
| GIT_COMMIT_HASH: ${{ github.event.pull_request.head.sha || github.sha }} | |
| RUST_VERSION: 1.88.0 | |
| jobs: | |
| clippy: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| components: clippy | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Clippy | |
| run: cargo clippy --keep-going --all-features --all-targets --locked -- -D warnings | |
| fmt: | |
| name: Check formatting | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # We use nightly to support `imports_granularity` feature | |
| - name: Install nightly rust toolchain with rustfmt | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: nightly | |
| components: rustfmt | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Check formatting | |
| run: cargo +nightly fmt --check --all | |
| build-and-test: | |
| name: Build and test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Build | |
| run: cargo build --all-targets --locked | |
| - name: Test | |
| run: cargo test --no-fail-fast --locked | |
| wasm: | |
| name: Build and Test wasm | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Install nightly rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown,x86_64-unknown-linux-gnu | |
| toolchain: nightly | |
| components: rust-src | |
| - name: Install chromedriver | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y chromium-chromedriver | |
| - name: Install wasm-pack | |
| # we install a specific version which supports custom profiles | |
| run: cargo install --git https://github.com/rustwasm/wasm-pack.git --rev 32e52ca | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Build harness | |
| working-directory: crates/harness | |
| run: ./build.sh | |
| - name: Run tests | |
| working-directory: crates/harness | |
| run: | | |
| ./bin/runner setup | |
| ./bin/runner --target browser test | |
| - name: Run build | |
| working-directory: crates/wasm | |
| run: ./build.sh | |
| - name: Dry Run NPM Publish | |
| working-directory: crates/wasm/pkg | |
| run: npm publish --dry-run | |
| - name: Save tlsn-wasm package for tagged builds | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ github.ref_name }}-tlsn-wasm-pkg | |
| path: ./crates/wasm/pkg | |
| if-no-files-found: error | |
| tests-integration: | |
| name: Run tests release build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Add custom DNS entry to /etc/hosts for notary TLS test | |
| run: echo "127.0.0.1 tlsnotaryserver.io" | sudo tee -a /etc/hosts | |
| - name: Run integration tests | |
| run: cargo test --locked --profile tests-integration --workspace --exclude tlsn-tls-client --exclude tlsn-tls-core --no-fail-fast -- --include-ignored | |
| coverage: | |
| runs-on: ubuntu-latest | |
| env: | |
| CARGO_TERM_COLOR: always | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@cargo-llvm-cov | |
| - name: Generate code coverage | |
| run: cargo llvm-cov --all-features --workspace --locked --lcov --output-path lcov.info | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: lcov.info | |
| fail_ci_if_error: true | |
| build-sgx: | |
| runs-on: ubuntu-latest | |
| needs: build-and-test | |
| container: | |
| image: rust:latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Clang | |
| run: | | |
| apt update | |
| apt install -y clang | |
| - name: Use caching | |
| uses: Swatinem/rust-cache@v2.7.7 | |
| - name: Build Rust Binary | |
| run: | | |
| cargo build --locked --bin notary-server --release --features tee_quote | |
| cp --verbose target/release/notary-server $GITHUB_WORKSPACE | |
| - name: Upload Binary for use in the Gramine Job | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: notary-server | |
| path: notary-server | |
| if-no-files-found: error | |
| gramine-sgx: | |
| runs-on: ubuntu-latest | |
| needs: build-sgx | |
| container: | |
| image: gramineproject/gramine:latest | |
| if: github.ref == 'refs/heads/dev' || (startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.')) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Restore SGX signing key from secrets | |
| run: | | |
| mkdir -p "${HOME}/.config/gramine/" | |
| echo "${{ secrets.SGX_SIGNING_KEY }}" > "${HOME}/.config/gramine/enclave-key.pem" | |
| # verify key | |
| openssl rsa -in "${HOME}/.config/gramine/enclave-key.pem" -check -noout | |
| - name: Download notary-server binary from build job | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: notary-server | |
| path: crates/notary/server/tee | |
| - name: Install jq | |
| run: | | |
| apt update | |
| apt install -y jq | |
| - name: Use Gramine to calculate measurements | |
| run: | | |
| cd crates/notary/server/tee | |
| chmod +x notary-server | |
| gramine-manifest \ | |
| -Dlog_level=debug \ | |
| -Darch_libdir=/lib/x86_64-linux-gnu \ | |
| -Dself_exe=notary-server \ | |
| notary-server.manifest.template \ | |
| notary-server.manifest | |
| gramine-sgx-sign \ | |
| --manifest notary-server.manifest \ | |
| --output notary-server.manifest.sgx | |
| gramine-sgx-sigstruct-view --verbose --output-format=json notary-server.sig | tee >> notary-server-sigstruct.json | |
| cat notary-server-sigstruct.json | |
| mr_enclave=$(jq -r '.mr_enclave' notary-server-sigstruct.json) | |
| mr_signer=$(jq -r '.mr_signer' notary-server-sigstruct.json) | |
| echo "mrenclave=$mr_enclave" >>"$GITHUB_OUTPUT" | |
| echo "#### sgx mrenclave" | tee >>$GITHUB_STEP_SUMMARY | |
| echo "\`\`\`mr_enclave: ${mr_enclave}\`\`\`" | tee >>$GITHUB_STEP_SUMMARY | |
| echo "\`\`\`mr_signer: ${mr_signer}\`\`\`" | tee >>$GITHUB_STEP_SUMMARY | |
| - name: Upload notary-server and signatures | |
| id: upload-notary-server-sgx | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: notary-server-sgx.zip | |
| path: | | |
| crates/notary/server/tee/notary-server | |
| crates/notary/server/tee/notary-server-sigstruct.json | |
| crates/notary/server/tee/notary-server.sig | |
| crates/notary/server/tee/notary-server.manifest | |
| crates/notary/server/tee/notary-server.manifest.sgx | |
| crates/notary/server/tee/README.md | |
| if-no-files-found: error | |
| - name: Attest Build Provenance | |
| if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/dev' | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-name: notary-server-sgx.zip | |
| subject-digest: sha256:${{ steps.upload-notary-server-sgx.outputs.artifact-digest }} | |
| - uses: geekyeggo/delete-artifact@v5 # Delete notary-server from the build job, It is part of the zipfile with the signature | |
| with: | |
| name: notary-server | |
| gramine-sgx-docker: | |
| runs-on: ubuntu-latest | |
| needs: gramine-sgx | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| CONTAINER_REGISTRY: ghcr.io | |
| if: github.ref == 'refs/heads/dev' || (startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.')) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| sparse-checkout: './crates/notary/server/tee/notary-server-sgx.Dockerfile' | |
| - name: Download notary-server-sgx.zip from gramine-sgx job | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: notary-server-sgx.zip | |
| path: ./notary-server-sgx | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ${{ env.CONTAINER_REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker image of notary server | |
| id: meta-notary-server-sgx | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: ${{ env.CONTAINER_REGISTRY }}/${{ github.repository }}/notary-server-sgx | |
| - name: Build and push Docker image of notary server | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta-notary-server-sgx.outputs.tags }} | |
| labels: ${{ steps.meta-notary-server-sgx.outputs.labels }} | |
| file: ./crates/notary/server/tee/notary-server-sgx.Dockerfile | |
| build_and_publish_notary_server_image: | |
| name: Build and publish notary server's image | |
| runs-on: ubuntu-latest | |
| needs: build-and-test | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| CONTAINER_REGISTRY: ghcr.io | |
| if: github.ref == 'refs/heads/dev' || (startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.')) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ${{ env.CONTAINER_REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker image of notary server | |
| id: meta-notary-server | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: ${{ env.CONTAINER_REGISTRY }}/${{ github.repository }}/notary-server | |
| - name: Build and push Docker image of notary server | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta-notary-server.outputs.tags }} | |
| labels: ${{ steps.meta-notary-server.outputs.labels }} | |
| file: ./crates/notary/server/notary-server.Dockerfile | |
| create-release-draft: | |
| name: Create Release Draft | |
| needs: build_and_publish_notary_server_image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.') | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Create GitHub Release Draft | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| draft: true | |
| tag_name: ${{ github.ref_name }} | |
| prerelease: true | |
| generate_release_notes: true |