Building

Build Requirements

• git
• make
• autoconf
• libtool
• libcurl
• gcc
• g++
• openssl-devel / libssl-dev
• cargo (only needed in host mode)
• python, bzip2 (only needed in wasm mode)
• SGX driver, Intel SGX SDK & PSW: Please refer to this guide to install.
  • Requires Intel SGX SDK and PSW version >= 2.18
• SGX DCAP: please download and install the packages from this page.
  • ubuntu 18.04: libsgx-dcap-quote-verify-dev, libsgx-dcap-ql-dev, libsgx-uae-service
  • Requires Intel DCAP version >= 1.15
• For TDX, please see the README in TDX MVP Stack. You need to download the packages and following TDX_E2E_attestation_software_stack_Installation_README-dcap-2021XXXX.txt to do step 2 & step 3 to setup build and dependence libraries.

Build and Install

Please follow the command to build librats from the latested source code on your system.

1. Download the latest source code of librats

mkdir -p "$WORKSPACE"
cd "$WORKSPACE"
git clone https://github.com/inclavare-containers/librats

2. Build and install librats

cd librats
cmake -DBUILD_SAMPLES=on -H. -Bbuild
make -C build install

cert-app will be installed to /usr/share/librats/samples/cert-app on your system. All instances are placed in /usr/local/lib/librats/.

If you want to build instances related to sgx(sgx_ecdsa, sgx_ecdsa_qve, sgx_la), please type the following command.

cmake -DRATS_BUILD_MODE="sgx" -DBUILD_SAMPLES=on -H. -Bbuild
make -C build install

If you want to run instances on libos occlum, please type the following command.

cmake -DRATS_BUILD_MODE="occlum" -DBUILD_SAMPLES=on -H. -Bbuild
make -C build install

If you want to run TDX instances, please type the following command.

cmake -DRATS_BUILD_MODE="tdx" -DBUILD_SAMPLES=on -H. -Bbuild
make -C build install

Note that SGX LVI mitigation is enabled by default. You can set macro SGX_LVI_MITIGATION to 0 to disable SGX LVI mitigation.

3. Wasm support

Librats provides support for WebAssembly, which enables it to run in the browser and WAMR.

If you want to run it in browser, please read this document.

If you want to run it in WAMR, please type the following command.

# install librats in host mode first
cmake -H. -Bbuild
make -C build install

# export librats APIs to wamr
cd wasm/wamr
cmake -H. -Bbuild
make -C build

# run the sample
cd build
./iwasm --native-lib=librats_wamr.so sample/test.wasm

RUN

Right now, Librats supports the following instance types:

Priority	Attester instances	Verifier instances
0	nullattester	nullverifier
15	sgx_la	sgx_la
20	csv	csv
35	sev	sev
42	sev_snp	sev_snp
42	tdx_ecdsa	tdx_ecdsa
52	sgx_ecdsa	sgx_ecdsa
53	sgx_ecdsa	sgx_ecdsa_qve

For instance priority, the higher, the stronger. By default, Librats will select the highest priority instance to use.

Notice: special prerequisites for TDX remote attestation in bios configuration and hardware capability.

Check msr 0x503, return value must be 0:

sudo rdmsr 0x503s

Note that if you want to run SEV-SNP remote attestation, please refer to link to set up the host and guest Linux kernel, qemu and ovmf bios used for launching SEV-SNP guest.

Notice: special prerequisites for SEV(-ES) remote attestation in software capability.

• Kernel support SEV(-ES) runtime attestation, please manually apply these patches.
• Start the attestation evidence broker service in host.

Notice: special prerequisites for CSV(2) remote attestation in software capability.

• Kernel support CSV(2) runtime attestation, please manually apply theses patches.

Enable bootstrap debugging

In the early bootstrap of librats, the debug message is mute by default. In order to enable it, please explicitly set the environment variable RATS_GLOBAL_LOG_LEVEL=<log_level>, where <log_level> is same as the values of the option -l.

Third Party Dependencies

Direct Dependencies

Name	Repo URL	Licenses
linux-sgx	https://github.com/intel/linux-sgx	BSD-3-clause
SGXDataCenterAttestationPrimitives	https://github.com/intel/SGXDataCenterAttestationPrimitives	BSD-3-clause
GNU C library	C library	GNU General Public License version 3