fn sign_enclave(&mut self, signed_enclave: &Path) -> Result<(), Error> {
        // Write the configuration file if one isn't provided
        let config_xml = if let Some(config_xml) = &self.config_xml {
            rerun_if_changed!(config_xml
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in config_xml pathbuf"));
            config_xml.clone()
        } else {
            let mut config_xml = self.out_dir.join(&self.name);
            config_xml.set_extension("config.xml");
            self.config_builder.write_to_file(&config_xml);
            config_xml
        };

        let mut enclave_rebuilt = false;

        // Link the static archive into an enclave lib if one doesn't exist already
        let unsigned_enclave = if let Some(unsigned_enclave) = &self.unsigned_enclave {
            rerun_if_changed!(unsigned_enclave
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in unsigned enclave path"));
            unsigned_enclave.clone()
        } else {
            warning!("Unsigned enclave not provided, trying to link a new one...");
            let mut name = "lib".to_owned();
            name.push_str(&self.name);
            let mut unsigned_enclave = self.out_dir.join(&name);
            unsigned_enclave.set_extension("so");
            self.link_unsigned(&unsigned_enclave)?;
            enclave_rebuilt = true;
            unsigned_enclave
        };

        // Re-create the gendata from the unsigned enclave
        let mut gendata = self.out_dir.join(&self.name);
        gendata.set_extension("dat");
        if !self
            .signer
            .gendata(&unsigned_enclave, &config_xml, &gendata)
            .status()?
            .success()
        {
            return Err(Error::SgxSignGendata);
        }

        // The generated data is an artifact, so copy it to our target profile dir
        let mut gendata_artifact = self.profile_target_dir.join(&self.name);
        gendata_artifact.set_extension("dat");
        fs::copy(&gendata, gendata_artifact)?;

        // The signed enclave is also an artifact, so we will copy it to the target profile dir
        let mut signed_artifact = self.profile_target_dir.join(
            unsigned_enclave
                .file_name()
                .expect("Unsigned enclave has no file name"),
        );
        signed_artifact.set_extension("signed.so");

        // If we have been given a private key to use, just sign the enclave in the insecure,
        // one-shot mode
        if let Some(private_key) = &self.privkey.clone() {
            self.oneshot(
                &unsigned_enclave,
                &config_xml,
                &private_key,
                &signed_enclave,
            )?;
        } else if enclave_rebuilt || (self.pubkey.is_none() && self.signature.is_none()) {
            warning!("Generating single-use key for insecure, one-shot signature");

            let mut csprng = ThreadRngForMbedTls {};

            let mut privkey =
                Pk::generate_rsa(&mut csprng, 3072, 3).expect("Could not generate privkey");

            let mut private_key = self.out_dir.join(&self.name);
            private_key.set_extension("key");

            fs::write(
                &private_key,
                privkey
                    .write_private_pem_string()
                    .expect("Could not write PEM string for private key"),
            )
            .expect("Could not write PEM string to private key file");

            self.oneshot(
                &unsigned_enclave,
                &config_xml,
                &private_key,
                &signed_enclave,
            )?;
        } else {
            let pubkey = self.pubkey.as_ref().unwrap();
            let signature = self.signature.as_ref().unwrap();
            rerun_if_changed!(signature
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in signature path"));
            rerun_if_changed!(pubkey
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in pubkey path"));

            if !self
                .signer
                .catsig(
                    &unsigned_enclave,
                    &config_xml,
                    &pubkey,
                    &gendata,
                    &signature,
                    signed_enclave,
                )
                .status()?
                .success()
            {
                return Err(Error::SgxSignCatsig);
            }
        }

        fs::copy(signed_enclave, &signed_artifact)?;
        Ok(())
    }
/// Create the signed enclave binary by applying a signature to an unsigned binary
Create the signed enclave binary by applying a signature to an unsigned binary
Create the signed enclave binary by applying a signature to an unsigned binary
fn sign_enclave(&mut self, signed_enclave: &Path) -> Result<(), Error> {
        // Write the configuration file if one isn't provided
        let config_xml = if let Some(config_xml) = &self.config_xml {
            rerun_if_changed!(config_xml
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in config_xml pathbuf"));
            config_xml.clone()
        } else {
            let mut config_xml = self.out_dir.join(&self.name);
            config_xml.set_extension("config.xml");
            self.config_builder.write_to_file(&config_xml);
            config_xml
        };
        let mut enclave_rebuilt = false;
        // Link the static archive into an enclave lib if one doesn't exist already
        let unsigned_enclave = if let Some(unsigned_enclave) = &self.unsigned_enclave {
            rerun_if_changed!(unsigned_enclave
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in unsigned enclave path"));
            unsigned_enclave.clone()
        } else {
            warning!("Unsigned enclave not provided, trying to link a new one...");
            let mut name = "lib".to_owned();
            name.push_str(&self.name);
            let mut unsigned_enclave = self.out_dir.join(&name);
            unsigned_enclave.set_extension("so");
            self.link_unsigned(&unsigned_enclave)?;
            enclave_rebuilt = true;
            unsigned_enclave
        };
        // Re-create the gendata from the unsigned enclave
        let mut gendata = self.out_dir.join(&self.name);
        gendata.set_extension("dat");
        if !self
            .signer
            .gendata(&unsigned_enclave, &config_xml, &gendata)
            .status()?
            .success()
        {
            return Err(Error::SgxSignGendata);
        }
        // The generated data is an artifact, so copy it to our target profile dir
        let mut gendata_artifact = self.profile_target_dir.join(&self.name);
        gendata_artifact.set_extension("dat");
        fs::copy(&gendata, gendata_artifact)?;
        // The signed enclave is also an artifact, so we will copy it to the target profile dir
        let mut signed_artifact = self.profile_target_dir.join(
            unsigned_enclave
                .file_name()
                .expect("Unsigned enclave has no file name"),
        );
        signed_artifact.set_extension("signed.so");
        // If we have been given a private key to use, just sign the enclave in the insecure,
        // one-shot mode
        if let Some(private_key) = &self.privkey.clone() {
            self.oneshot(
                &unsigned_enclave,
                &config_xml,
                &private_key,
                &signed_enclave,
            )?;
        } else if enclave_rebuilt || (self.pubkey.is_none() && self.signature.is_none()) {
            warning!("Generating single-use key for insecure, one-shot signature");
            let mut csprng = ThreadRngForMbedTls {};
            let mut privkey =
                Pk::generate_rsa(&mut csprng, 3072, 3).expect("Could not generate privkey");
            let mut private_key = self.out_dir.join(&self.name);
            private_key.set_extension("key");
            fs::write(
                &private_key,
                privkey
                    .write_private_pem_string()
                    .expect("Could not write PEM string for private key"),
            )
            .expect("Could not write PEM string to private key file");
            self.oneshot(
                &unsigned_enclave,
                &config_xml,
                &private_key,
                &signed_enclave,
            )?;
        } else {
            let pubkey = self.pubkey.as_ref().unwrap();
            let signature = self.signature.as_ref().unwrap();
            rerun_if_changed!(signature
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in signature path"));
            rerun_if_changed!(pubkey
                .as_os_str()
                .to_str()
                .expect("Invalid UTF-8 in pubkey path"));
            if !self
                .signer
                .catsig(
                    &unsigned_enclave,
                    &config_xml,
                    &pubkey,
                    &gendata,
                    &signature,
                    signed_enclave,
                )
                .status()?
                .success()
            {
                return Err(Error::SgxSignCatsig);
            }
        }
        fs::copy(signed_enclave, &signed_artifact)?;
        Ok(())
    }
fn sign_enclave ( & mut self , signed_enclave : & Path ) -> Result < ( ) , Error > { // Write the configuration file if one isn't provided let config_xml = if let Some ( config_xml ) = & self . config_xml { rerun_if_changed ! ( config_xml as_os_str ( ) to_str ( ) expect ( " " ) ) ; config_xml . clone ( ) } else { let mut config_xml = self . out_dir . join ( & self . name ) ; config_xml . set_extension ( " " ) ; self . config_builder . write_to_file ( & config_xml ) ; config_xml } ; let mut enclave_rebuilt = false ; // Link the static archive into an enclave lib if one doesn't exist already let unsigned_enclave = if let Some ( unsigned_enclave ) = & self . unsigned_enclave { rerun_if_changed ! ( unsigned_enclave as_os_str ( ) to_str ( ) expect ( " " ) ) ; unsigned_enclave . clone ( ) } else { warning ! ( " " ) ; let mut name = " " . to_owned ( ) ; name . push_str ( & self . name ) ; let mut unsigned_enclave = self . out_dir . join ( & name ) ; unsigned_enclave . set_extension ( " " ) ; self . link_unsigned ( & unsigned_enclave ) ? ; enclave_rebuilt = true ; unsigned_enclave } ; // Re-create the gendata from the unsigned enclave let mut gendata = self . out_dir . join ( & self . name ) ; gendata . set_extension ( " " ) ; if ! self . signer . gendata ( & unsigned_enclave , & config_xml , & gendata ) . status ( ) ? . success ( ) { return Err ( Error :: SgxSignGendata ) ; } // The generated data is an artifact, so copy it to our target profile dir let mut gendata_artifact = self . profile_target_dir . join ( & self . name ) ; gendata_artifact . set_extension ( " " ) ; fs :: copy ( & gendata , gendata_artifact ) ? ; // The signed enclave is also an artifact, so we will copy it to the target profile dir let mut signed_artifact = self . profile_target_dir . join ( unsigned_enclave . file_name ( ) . expect ( " " ) , ) ; signed_artifact . set_extension ( " " ) ; // If we have been given a private key to use, just sign the enclave in the insecure, // one-shot mode if let Some ( private_key ) = & self . privkey . clone ( ) { self . oneshot ( & unsigned_enclave , & config_xml , & private_key , & signed_enclave , ) ? ; } else if enclave_rebuilt || ( self . pubkey . is_none ( ) && self . signature . is_none ( ) ) { warning ! ( " " ) ; let mut csprng = ThreadRngForMbedTls { } ; let mut privkey = Pk :: generate_rsa ( & mut csprng , 3072 , 3 ) . expect ( " " ) ; let mut private_key = self . out_dir . join ( & self . name ) ; private_key . set_extension ( " " ) ; fs :: write ( & private_key , privkey . write_private_pem_string ( ) . expect ( " " ) , ) . expect ( " " ) ; self . oneshot ( & unsigned_enclave , & config_xml , & private_key , & signed_enclave , ) ? ; } else { let pubkey = self . pubkey . as_ref ( ) . unwrap ( ) ; let signature = self . signature . as_ref ( ) . unwrap ( ) ; rerun_if_changed ! ( signature as_os_str ( ) to_str ( ) expect ( " " ) ) ; rerun_if_changed ! ( pubkey as_os_str ( ) to_str ( ) expect ( " " ) ) ; if ! self . signer . catsig ( & unsigned_enclave , & config_xml , & pubkey , & gendata , & signature , signed_enclave , ) . status ( ) ? . success ( ) { return Err ( Error :: SgxSignCatsig ) ; } } fs :: copy ( signed_enclave , & signed_artifact ) ? ; Ok ( ( ) ) }
Create the signed enclave binary by applying a signature to an unsigned binary
Create the signed enclave binary by applying a signature to an unsigned binary
&mut self
signed_enclave
&Path
&mut self
signed_enclave
&Path