This commit mainly accomplish two things:
1. Use makefile to manage dependencies for `occlum build`, which can save lots of time
2. Take dirs `build`, `run` outside from `.occlum`. Remove env var "OCCLUM_INSTANCE_DIR"
Occlum-compatible executable binaries must be Position-Independent
Executable (PIE). Previously, to build such binaries, the users need to
explicitly give `-buildmode=pie` flag to `occlum-go`. Apparently, this
is error-prone. This commit sets `-buildmode=pie` by default for `occlum-go`.
In addition, this commit upgrades the Go version to 1.13.7.
Rlimit are now on the same page of memory space limits defined in Occlum.json. Specific
memory size configuration can be set to child process with `prlimit` syscall or using `ulimit`
command in shell script.
This commits consists of three major changes:
1. Support a new interface to get the base64 quote only.
This is useful in the case that application sends the quote
to service provider server and get the final IAS report there.
The application itself doesn't depend on IAS in this case.
2. Improve the C++ programming style. Now, we only provide
C++ classes and limited C APIs(for configuration and sgx device).
3. Use the more general keywords as names prefix.
Signed-off-by: Junxian Xiao <junxian.xjx@antfin.com>
Update the occlum.json to align with the gen_enclave_conf design.
Below is the two updated structures:
"metadata": {
"product_id": 0,
"version_number": 0,
"debuggable": true
},
"resource_limits": {
"max_num_of_threads": 32,
"kernel_space_heap_size": "32MB",
"kernel_space_stack_size": "1MB",
"user_space_size": "256MB"
}
This commit provides a modified Go runtime in Docker image.
Now we can build a Go program using `occlum-go`, then run it
in SGX enclaves by Occlum.
The Golang demo demonstrates how to build and run a web server
program written in Go.
Some demos based on CMake may search installed packages out of
Occlum toolchain's directory, this could cause some building
errors sometimes. By setting the $PKG_CONFIG_LIBDIR, we can make
CMake searching for packages in Occlum toolchain's directory only.
1. Disable zlib _explictly_ when building libcurl in remote attestaion demo.
The reason for this is that zlib may be implictly linked by the build system of
libcurl but not the zlib library is not copied into the Occlum FS image.
2. Use `make -j$(nproc)`
3. Fix typos
This demo consists of
1. An user-friendly library for getting Intel Attestation Service (IAS) report.
2. A application that uses this library to get IAS report.
This demo requires obtaining service provider certificate/ID from Intel.
This commit makes the toolchain easier to use in two folds:
1. When compiling C/C++ source files, no need to add "-fPIC -pie" flags manually;
2. When running executables generated by the Occlum toolchain on Linux, no
need to set the `LD_LIBRARY_PATH` manually.
