Skip to content

Commit 64c0fc5

Browse files
Hsy-Intelshui1RodgerZhuElliot Jonesgopadas
authored
Add the RAG (retrieval-augmented generation) with Intel TDX solution. (#251)
* Add grpc RA-TLS backend support for Azure TDX and Azure SGX (#252) * Add grpc RA-TLS backend support for Azure TDX and Azure SGX * Update index.md * Remove cczoo/grpc-ra-tls/grpc/grpc_ratls.patch and add to .gitignore * Enable support for Microsoft Azure Attestation * Update index.md * Update requirements.txt * Add HFL support for Azure TDX (#253) * Add HFL support for Azure TDX * Update tdx-hfl.md * Enable support for Microsoft Azure Attestation * Update tdx-hfl.md * Update .readthedocs.yaml * Update .readthedocs.yaml * docs: Fix typos and styling (#254) Fixes typos and grammar. Standardizes paragraph padding, punctuation usage, code formatting, and multi-line code language for syntax highlighting. Formats references to other files as links. * docs: Fix grammar and styling (#256) Fixes grammar, typos and rewords some sections for readability. Standardizes paragraph padding, punctuation usage, code formatting, and multi-line code language for syntax highlighting. * docs: Fix file seperators and add clarifying details (#257) Fixes backslashes to forward slashes per unix convention for file path seperation and adds clarification that "parameter server" corresponds to `ps0`. * Add grpc RA-TLS backend support for Google Cloud TDX (#258) * Core changes for enabling grpc-ra-tls WL on GC Signed-off-by: Gopa Das <gopa.das@intel.com> * Updated sgx_ra_tls_tdx.cc for GCP TDX * Updated index.md for Google Cloud * Fix items from code review --------- Signed-off-by: Gopa Das <gopa.das@intel.com> Co-authored-by: Hui, Sammy <sammy.hui@intel.com> * Add rag with Intel TDX solutions * Update dcap package * Polish dockerfile * Polish frontend dockerfile --------- Signed-off-by: Gopa Das <gopa.das@intel.com> Co-authored-by: shui1 <sammy.hui@intel.com> Co-authored-by: Zhu Yunge <yunge.zhu@intel.com> Co-authored-by: Elliot Jones <elliotx.jones@intel.com> Co-authored-by: gopadas <74206306+gopadas@users.noreply.github.com>
1 parent 56e2f19 commit 64c0fc5

File tree

91 files changed

+14371
-559
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+14371
-559
lines changed

‎.readthedocs.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
1+
# .readthedocs.yml
2+
# Read the Docs configuration file
3+
# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
4+
5+
# Required
16
version: 2
27

8+
build:
9+
os: ubuntu-20.04
10+
tools:
11+
python: "3.8"
12+
313
sphinx:
414
configuration: documents/readthedoc/docs/source/conf.py
515

‎cczoo/common/docker/gramine/build_docker_image.azure.sh

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#
2+
# Copyright (c) 2022 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
#!/bin/bash
17+
set -e
18+
19+
function usage() {
20+
echo -e "usage:"
21+
echo -e ' ./build_docker_image.azure.sh ${tag}'
22+
echo -e " {tag}"
23+
echo -e " custom image tag, default: latest"
24+
}
25+
26+
usage
27+
28+
if [ -n "$1" ] ; then
29+
tag=$1
30+
else
31+
tag=latest
32+
fi
33+
34+
docker build \
35+
--build-arg no_proxy=${no_proxy} \
36+
--build-arg http_proxy=${http_proxy} \
37+
--build-arg https_proxy=${https_proxy} \
38+
-f gramine-sgx-dev.azure.dockerfile \
39+
-t gramine-sgx-dev-azure:${tag} \
40+
.

‎cczoo/common/docker/gramine/gramine-sgx-dev.azure.dockerfile

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
#
2+
# Copyright (c) 2023 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# https://github.com/oscarlab/graphene/blob/master/Tools/gsc/images/graphene_aks.latest.dockerfile
17+
18+
FROM ubuntu:20.04
19+
20+
ENV DEBIAN_FRONTEND=noninteractive
21+
ENV INSTALL_PREFIX=/usr/local
22+
ENV LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib:${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${LD_LIBRARY_PATH}
23+
ENV PATH=${INSTALL_PREFIX}/bin:${LD_LIBRARY_PATH}:${PATH}
24+
ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
25+
26+
# Install initial dependencies
27+
RUN apt-get update && apt-get install -y --no-install-recommends \
28+
wget \
29+
ca-certificates \
30+
&& apt-get clean && rm -rf /var/lib/apt/lists/*
31+
32+
WORKDIR /dcap
33+
RUN wget -q https://download.01.org/intel-sgx/sgx-dcap/1.19/linux/distro/ubuntu20.04-server/sgx_debian_local_repo.tgz \
34+
&& tar -xvf sgx_debian_local_repo.tgz
35+
RUN ["/bin/bash", "-c", "set -o pipefail && echo 'deb [trusted=yes arch=amd64] file:/dcap/sgx_debian_local_repo focal main' | tee /etc/apt/sources.list.d/intel-sgx.list"]
36+
37+
RUN apt-get update && apt-get install -y --no-install-recommends \
38+
apt-utils \
39+
build-essential \
40+
autoconf \
41+
libtool \
42+
python3-pip \
43+
python3-dev \
44+
git \
45+
zlib1g-dev \
46+
unzip \
47+
vim \
48+
jq \
49+
gawk bison python3-click python3-jinja2 golang ninja-build \
50+
libprotobuf-c-dev python3-protobuf protobuf-c-compiler protobuf-compiler\
51+
libgmp-dev libmpfr-dev libmpc-dev libisl-dev nasm \
52+
# Install SGX PSW
53+
libsgx-pce-logic libsgx-ae-qve libsgx-quote-ex libsgx-quote-ex-dev libsgx-qe3-logic sgx-aesm-service \
54+
# Install SGX DCAP
55+
libsgx-dcap-ql-dev libsgx-dcap-quote-verify-dev \
56+
# Install dependencies for Azure DCAP Client
57+
libssl-dev libcurl4-openssl-dev pkg-config nlohmann-json3-dev \
58+
&& apt-get clean && rm -rf /var/lib/apt/lists/*
59+
60+
# Build and install the Azure DCAP Client (Release 1.12.1)
61+
WORKDIR /azure
62+
ARG AZUREDIR=/azure
63+
RUN git clone https://github.com/microsoft/Azure-DCAP-Client ${AZUREDIR} \
64+
&& git checkout bc7b484e5fa9a8daa684032c7270f76800b7007d \
65+
&& git submodule update --recursive --init
66+
67+
WORKDIR /azure/src/Linux
68+
RUN ./configure \
69+
&& make DEBUG=1 \
70+
&& make install \
71+
&& cp libdcap_quoteprov.so /usr/lib/x86_64-linux-gnu/
72+
73+
# Gramine
74+
ENV GRAMINEDIR=/gramine
75+
ENV SGX_DCAP_VERSION=DCAP_1.11
76+
ENV GRAMINE_VERSION=v1.2
77+
ENV ISGX_DRIVER_PATH=${GRAMINEDIR}/driver
78+
ENV WERROR=1
79+
ENV SGX=1
80+
81+
RUN pip3 install --no-cache-dir 'toml==0.10.2' 'meson==1.2.2' 'cryptography==41.0.4'
82+
83+
WORKDIR ${GRAMINEDIR}
84+
RUN git clone https://github.com/gramineproject/gramine.git ${GRAMINEDIR} \
85+
&& git checkout ${GRAMINE_VERSION}
86+
87+
WORKDIR ${ISGX_DRIVER_PATH}
88+
RUN git clone https://github.com/intel/SGXDataCenterAttestationPrimitives.git ${ISGX_DRIVER_PATH} \
89+
&& git checkout ${SGX_DCAP_VERSION}
90+
91+
ARG BUILD_TYPE=release
92+
WORKDIR ${GRAMINEDIR}
93+
RUN LD_LIBRARY_PATH="" meson setup build/ --buildtype=${BUILD_TYPE} -Dprefix=${INSTALL_PREFIX} -Ddirect=enabled -Dsgx=enabled -Ddcap=enabled -Dsgx_driver=dcap1.10 -Dsgx_driver_include_path=${ISGX_DRIVER_PATH}/driver/linux/include \
94+
&& LD_LIBRARY_PATH="" ninja -C build/ \
95+
&& LD_LIBRARY_PATH="" ninja -C build/ install
96+
97+
# Install mbedtls
98+
RUN cd ${GRAMINEDIR}/build/subprojects/mbedtls-mbedtls* \
99+
&& cp -r -- *_gramine.a ${INSTALL_PREFIX}/lib \
100+
&& cd ${GRAMINEDIR}/subprojects/mbedtls-mbedtls*/mbedtls-mbedtls* \
101+
&& cp -r include/mbedtls ${INSTALL_PREFIX}/include
102+
103+
# Install cJSON
104+
RUN cd ${GRAMINEDIR}/subprojects/cJSON*/ \
105+
&& make static \
106+
&& cp -r -- *.a ${INSTALL_PREFIX}/lib \
107+
&& mkdir -p ${INSTALL_PREFIX}/include/cjson \
108+
&& cp -r -- *.h ${INSTALL_PREFIX}/include/cjson
109+
110+
RUN echo "enabled=0" > /etc/default/apport \
111+
&& echo "exit 0" > /usr/sbin/policy-rc.d
112+
113+
# Clean tmp files
114+
RUN apt-get clean all \
115+
&& rm -rf /var/lib/apt/lists/* \
116+
&& rm -rf ~/.cache/* \
117+
&& rm -rf /tmp/*
118+
119+
RUN gramine-sgx-gen-private-key
120+
121+
COPY configs /
122+
123+
# Workspace
124+
ENV WORK_SPACE_PATH=${GRAMINEDIR}
125+
WORKDIR ${WORK_SPACE_PATH}

‎cczoo/grpc-ra-tls/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
*.deb
22
*.prm
33
*.tar*
4+
grpc/grpc_ratls.patch

‎cczoo/grpc-ra-tls/azure_tdx/build_docker_image.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) 2023 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
#!/bin/bash
17+
set -e
18+
19+
if [ ! -n "$1" ] ; then
20+
tag=latest
21+
else
22+
tag=$1
23+
fi
24+
25+
DOCKER_BUILDKIT=0 docker build \
26+
-f grpc-ra-tls.azure_tdx.dockerfile .. \
27+
-t grpc-ra-tls:azure_tdx_${tag} \
28+
--build-arg no_proxy=${no_proxy} \
29+
--build-arg http_proxy=${http_proxy} \
30+
--build-arg https_proxy=${https_proxy} \

‎cczoo/grpc-ra-tls/azure_tdx/grpc-ra-tls.azure_tdx.dockerfile

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#
2+
# Copyright (c) 2023 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
FROM ubuntu:20.04
17+
18+
ENV DEBIAN_FRONTEND=noninteractive
19+
ENV INSTALL_PREFIX=/usr/local
20+
ENV LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib:${INSTALL_PREFIX}/lib/x86_64-linux-gnu:${LD_LIBRARY_PATH}
21+
ENV PATH=${INSTALL_PREFIX}/bin:${LD_LIBRARY_PATH}:${PATH}
22+
ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
23+
24+
# Install initial dependencies
25+
RUN apt-get update && apt-get install -y --no-install-recommends \
26+
wget \
27+
ca-certificates \
28+
&& apt-get clean && rm -rf /var/lib/apt/lists/*
29+
30+
WORKDIR /dcap
31+
RUN wget https://download.01.org/intel-sgx/sgx-dcap/1.19/linux/distro/ubuntu20.04-server/sgx_debian_local_repo.tgz \
32+
&& tar -xvf sgx_debian_local_repo.tgz
33+
RUN ["/bin/bash", "-c", "set -o pipefail && echo 'deb [trusted=yes arch=amd64] file:/dcap/sgx_debian_local_repo focal main' | tee /etc/apt/sources.list.d/intel-sgx.list"]
34+
35+
RUN apt-get update && apt-get install -y --no-install-recommends \
36+
apt-utils \
37+
python3-pip \
38+
git \
39+
vim \
40+
# required for gRPC build
41+
build-essential cmake libcurl4-openssl-dev nlohmann-json3-dev \
42+
# SGX PSW packages required for gRPC build
43+
libtdx-attest libtdx-attest-dev \
44+
# required for bazel setup
45+
unzip \
46+
# required for Azure confidential-computing-cvm-guest-attestation
47+
libjsoncpp-dev libboost-all-dev libssl1.1 \
48+
&& apt-get clean && rm -rf /var/lib/apt/lists/*
49+
50+
# Azure confidential-computing-cvm-guest-attestation
51+
WORKDIR /
52+
RUN git clone -b tdx-preview https://github.com/Azure/confidential-computing-cvm-guest-attestation
53+
WORKDIR /confidential-computing-cvm-guest-attestation
54+
RUN git checkout e045e8f52543f823f9a85d1b33338f99dec70397
55+
WORKDIR /confidential-computing-cvm-guest-attestation/tdx-attestation-app
56+
RUN dpkg -i package/azguestattestation1_1.0.3_amd64.deb
57+
58+
# bazel
59+
RUN wget -q https://github.com/bazelbuild/bazel/releases/download/3.7.2/bazel-3.7.2-installer-linux-x86_64.sh
60+
RUN bash bazel-3.7.2-installer-linux-x86_64.sh && echo "source /usr/local/lib/bazel/bin/bazel-complete.bash" >> ~/.bashrc
61+
62+
# grpc
63+
ENV GRPC_ROOT=/grpc
64+
ENV GRPC_PATH=${GRPC_ROOT}/src
65+
ENV SGX_RA_TLS_BACKEND=AZURE_TDX
66+
ENV SGX_RA_TLS_SDK=DEFAULT
67+
ENV BUILD_TYPE=Release
68+
69+
ARG GRPC_VERSION=v1.38.1
70+
ARG GRPC_VERSION_PATH=${GRPC_ROOT}/${GRPC_VERSION}
71+
RUN git clone --recurse-submodules -b ${GRPC_VERSION} https://github.com/grpc/grpc ${GRPC_VERSION_PATH}
72+
73+
RUN ln -s ${GRPC_VERSION_PATH} ${GRPC_PATH}
74+
75+
COPY grpc/common ${GRPC_VERSION_PATH}
76+
COPY grpc/${GRPC_VERSION} ${GRPC_VERSION_PATH}
77+
COPY grpc/common/azure_tdx_config.json /etc
78+
79+
# Install Python dependencies
80+
RUN pip3 install --upgrade --no-cache-dir \
81+
'pip==23.1.*' 'certifi==2022.12.7' 'requests==2.31.*' 'urllib3==1.26.*' 'cython==0.29.36'\
82+
&& pip3 install --no-cache-dir -r "${GRPC_PATH}/requirements.txt"
83+
84+
# Build grpc ra-tls example server/client
85+
WORKDIR ${GRPC_PATH}/examples/cpp/ratls
86+
RUN build.sh
87+
WORKDIR ${GRPC_PATH}/examples/python/ratls
88+
RUN build.sh
89+
90+
# Clean tmp files
91+
RUN apt-get clean all \
92+
&& rm -rf /var/lib/apt/lists/* \
93+
&& rm -rf ~/.cache/pip/* \
94+
&& rm -rf /tmp/*
95+
96+
WORKDIR ${GRPC_PATH}/examples/cpp/ratls/build

‎cczoo/grpc-ra-tls/azure_tdx/start_container.sh

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#
2+
# Copyright (c) 2023 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
#!/bin/bash
17+
set -e
18+
19+
usage() {
20+
echo -e "Usage: $0 IMAGE_ID"
21+
echo -e " IMAGE_ID Container image ID;"
22+
}
23+
24+
if [ "$#" -lt 1 ]; then
25+
usage
26+
exit 1
27+
fi
28+
29+
image_id=${1}
30+
31+
docker run -itd \
32+
--privileged=true \
33+
-p 8500:8500 \
34+
--cap-add=SYS_PTRACE \
35+
--security-opt seccomp=unconfined \
36+
-v /dev:/dev \
37+
${image_id} \
38+
bash

‎cczoo/grpc-ra-tls/gcp_tdx/build_docker_image.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) 2023 Intel Corporation
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
#!/bin/bash
17+
set -e
18+
19+
if [ ! -n "$1" ] ; then
20+
tag=latest
21+
else
22+
tag=$1
23+
fi
24+
25+
DOCKER_BUILDKIT=0 docker build \
26+
-f grpc-ra-tls.gcp_tdx.dockerfile .. \
27+
-t grpc-ra-tls:gcp_tdx_${tag} \
28+
--build-arg no_proxy=${no_proxy} \
29+
--build-arg http_proxy=${http_proxy} \
30+
--build-arg https_proxy=${https_proxy} \

0 commit comments

Comments
 (0)