Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
132 commits
Select commit Hold shift + click to select a range
028e578
remaned ta10 to tarzan
iolivergithub Jul 6, 2024
de795d5
Merge pull request #1 from iolivergithub/tarzan
iolivergithub Jul 6, 2024
fd8d96f
updated tarzan documentation
iolivergithub Jul 6, 2024
4cbc0ac
Merge pull request #2 from iolivergithub/tarzan
iolivergithub Jul 6, 2024
7a0a872
Fix tpm typo in intents.md
deeglaze Oct 4, 2024
793f45c
Merge pull request #3 from deeglaze/patch-1
iolivergithub Oct 5, 2024
de4f91e
updated new element form
Nov 7, 2024
f829b79
updated Dockerfile
Nov 7, 2024
0bccea3
updated the new element stuff
Nov 7, 2024
8d03835
added loadstandardintents and some documentation updates
Nov 8, 2024
c382d63
fixed loading of standard intents
Nov 9, 2024
9c9932e
A minor minor typos and updates
Nov 9, 2024
95f214b
bug fixes and added more standard intents
Nov 9, 2024
ade8203
updates
Nov 9, 2024
b477194
New EV works, but not quite yet
Nov 10, 2024
4af9de9
working new EVs page
Nov 10, 2024
0e336e0
Opaque objects working, webpages and update to the standard intents
Nov 10, 2024
3742183
update
Nov 10, 2024
7f52d07
minor things- no big fixes
Nov 15, 2024
9a890c9
fixed small but in results order on elements page
iolivergithub Nov 18, 2024
8070c60
fixed encoding issue with claims PCRDigest and Expected Values - now …
iolivergithub Nov 19, 2024
628979d
various updates and tweaks
iolivergithub Nov 19, 2024
2b64226
added some scripting ideas
Nov 19, 2024
089f62c
added some more help and updated a few internal pages
iolivergithub Nov 20, 2024
6650be5
Update gettingstarted.md
iolivergithub Nov 20, 2024
d2916de
Update codeql-analysis.yml
iolivergithub Nov 20, 2024
a422c9f
Update codeql-analysis.yml
iolivergithub Nov 20, 2024
b176c48
not much
Nov 20, 2024
4266d08
various
Nov 21, 2024
3f6e7bc
some updates to the claim page
Nov 21, 2024
d40c799
fixed some things in tarzan else elsewhere
Nov 21, 2024
93059f6
some python stuff and a fixed standard intent
Nov 21, 2024
af8628a
added a attest and verify to s.py script - good night
Nov 21, 2024
9055d76
added opaque objcet descriptions to PCRs and Quote firmware
iolivergithub Nov 22, 2024
df0553e
whatever
iolivergithub Nov 22, 2024
d39a5b5
added efivars
Nov 29, 2024
6659000
got efivars working
Nov 29, 2024
1187990
refactored out the loading of standard intents
Nov 29, 2024
608b927
Added deb building stuff; need to add the systemd stuff to that
Dec 1, 2024
2665808
fixed many things with debbuild
Dec 1, 2024
fad17e9
added some makefiles
Dec 1, 2024
e847d06
formatting
Dec 1, 2024
92ca9c7
final update of the evening with a minor change to the Makefile and t…
Dec 1, 2024
8018e7b
some clearing up after go vet
Dec 1, 2024
14f4c73
updates to makefiles and debbuild to make them consistent
iolivergithub Dec 2, 2024
3ab9efc
updated docs, Dockerfile and added alient to make rpms
Dec 2, 2024
1ab3192
fixed but in log file location in debbuild
Dec 7, 2024
63968e1
big update to allow multple endpoints per element
Dec 11, 2024
b95f244
Merge pull request #6 from iolivergithub/newendpoints
iolivergithub Dec 11, 2024
460ede1
updated template for element
Dec 11, 2024
e6f90c8
Merge pull request #7 from iolivergithub/newendpoints
iolivergithub Dec 11, 2024
13615b1
updated a few typos and removed a call to a nonexistant function in a…
Dec 12, 2024
bc0a4e2
Merge pull request #8 from iolivergithub/newendpoints
iolivergithub Dec 12, 2024
236d128
Bump golang.org/x/crypto from 0.30.0 to 0.31.0 in /tarzan
dependabot[bot] Dec 12, 2024
cb50839
some changes after running go vet
Dec 12, 2024
d199210
Merge pull request #9 from iolivergithub/dependabot/go_modules/tarzan…
iolivergithub Dec 12, 2024
d5b3c6e
added tpmtest as go-tpm test stuff
Dec 16, 2024
609e472
Started adding Tantor agent
Dec 17, 2024
05c7328
some tpmtest stuff
Dec 17, 2024
2c1042f
got tpmtest working wiht the EK, AK and evictcontol
Dec 18, 2024
8a8039e
Merge branch 'main' into newendpoints
iolivergithub Dec 18, 2024
e81a32e
Merge pull request #10 from iolivergithub/newendpoints
iolivergithub Dec 18, 2024
d93ac37
working TPM provisioning in Tantor
Dec 18, 2024
499ff5f
updates to tantor
Dec 18, 2024
74ed13a
Merge pull request #11 from iolivergithub/newendpoints
iolivergithub Dec 18, 2024
f53fc46
update???
Jan 4, 2025
ae89d2c
lcars update
Jan 4, 2025
733d109
figured out ajax and lcars
Jan 4, 2025
eb902f6
added stardate calculation and XML return for RESTI API
Jan 5, 2025
edd6a71
some more tantor stuff
Jan 6, 2025
b33111f
trantor is poo. Need to seriously refactor
Jan 6, 2025
27679e6
updated shellscripts to work with the new schemas
iolivergithub Jan 7, 2025
23e2387
things
Jan 8, 2025
f30987e
added ratds support
Jan 15, 2025
a5c524d
updated standard intents for ratsd test
Jan 15, 2025
9ac7b65
typos
Jan 17, 2025
d6ff50c
newpcrs
iolivergithub Jan 31, 2025
3674005
working NewPCRs
iolivergithub Jan 31, 2025
d8a532f
update
iolivergithub Jan 31, 2025
d2f3368
newpcrs are now working
Mar 27, 2025
fafce0f
Quote almost working
Mar 27, 2025
a093277
updated and working tarzan pcr collector when certain banks, eg: SHA3…
Mar 28, 2025
b648b5a
ok, quoting now works...need to return it
Mar 28, 2025
f0a7e94
stuff in protools/a10httprestv2 regaridng quotes needs to be modified…
Mar 28, 2025
7767da4
quote now works almost...rules need to be rewritten and the whole str…
Apr 3, 2025
8fe1e4a
fixed attestation rules....messy but works
Apr 11, 2025
1e282a0
pcrselections in quotes work I think. Code is freaklingly messy ... w…
Apr 12, 2025
3617e84
TPM2 rules almost working...should move to base64 encoding in Tarzan
Apr 13, 2025
9de0c0a
quote working and displaying
Apr 13, 2025
892b10b
added messages
Apr 14, 2025
5a6ab05
removed messaging - not a needed feature
Apr 15, 2025
a4a19b9
some experimental stuff added
Apr 15, 2025
b376d45
updated rima...maybe the scripts might work one day
Apr 16, 2025
3d4608e
added database for rima
Apr 19, 2025
8c0ff0f
finished for tonight
Apr 19, 2025
c73f6d3
Fixed rima
Apr 23, 2025
9aad514
added an endpoint to rima and updated debbuild scripts
May 31, 2025
8f09f58
make some bug fixes to rima and the deb installation script for rima
Jun 1, 2025
6a69722
refactoring rima
Jun 3, 2025
233495e
finished refactoring rima
Jun 3, 2025
8427fb3
removed gzip middleware from webui to ease nginx url rewriting
Jul 17, 2025
0da1a2d
Added code to handle /etc/machine-id and its attestation
Jul 22, 2025
360013f
minor updates to documentation
Jul 22, 2025
a0bc980
closed some issues
Jul 25, 2025
843deaa
working Quote see github.com/google/go-tpm/issues/407
Jul 29, 2025
3fcb93c
Added error check to PCRSelection processing
Jul 29, 2025
95cb41a
bug fixed, ran go vet at fixed those errors, some file renaming in ta…
Jul 29, 2025
61b1f23
updates to UI. Discovered an error in verification handling, See issues
Jul 29, 2025
2315512
fixed odd error with GetExpectedValues ... err.Error() segfaults when…
Jul 31, 2025
8f16722
added time duration to session.html
Jul 31, 2025
6bae9fd
fixed base64 error in the tpm2rules
Jul 31, 2025
89d546b
minor update to ratds protocols
Aug 28, 2025
d36bc4a
Working nonce for chares call in ratsd protocol
Aug 29, 2025
7f67f8a
Added provisioner code
Sep 3, 2025
572d900
working buggy provisioner
iolivergithub Sep 11, 2025
78009b5
added files to provisioner to make it work with python zipapp
iolivergithub Sep 19, 2025
7356924
updates to provisioner script
Sep 19, 2025
dc5109c
fixes to the provisioner
Sep 19, 2025
c759c9e
Added get elements by tag to RESI API
Sep 19, 2025
3a2114e
graceful shutdown works, almost...well...gracefully
Sep 19, 2025
a01666d
Updates to debbuild for building of the provisioner
Sep 20, 2025
81290da
Added initial archiving structure
Sep 22, 2025
862bdf9
Updated archival to record history, modified element and ev operation…
Sep 23, 2025
ef24600
typos
Sep 23, 2025
65b09d0
Fixed zipapp generation, a few typos etc
Sep 24, 2025
765567a
Fixed typos, fixed zipapp generation
Sep 24, 2025
1979d86
Update codeql-analysis.yml
iolivergithub Sep 24, 2025
1ecb090
fixed annoying machine id comparision issue in the sys rules...it was…
Sep 25, 2025
294bf6c
Update codeql-analysis.yml
iolivergithub Sep 25, 2025
059b354
quick update with modified restapi for getting evs correctly and prov…
Oct 16, 2025
031f9e4
safety things for the provisioner
Oct 16, 2025
7dd0ffe
debduild scripts, split provisioner build away
Oct 16, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 0 additions & 23 deletions .github/workflows/a10rest-docker-image.yml

This file was deleted.

75 changes: 0 additions & 75 deletions .github/workflows/android.yml

This file was deleted.

70 changes: 0 additions & 70 deletions .github/workflows/codeql-analysis.yml

This file was deleted.

8 changes: 8 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,14 @@

############################################################# GO

# For jane and tarzan
/janeserver/janeserver
/janeserver/ga10

/tarzan/tarzan
/tarzan/ta10



# Binaries for programs and plugins
*.exe
Expand Down
File renamed without changes.
28 changes: 14 additions & 14 deletions docs/automaticStartup.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ In this section we present an example distribution for use in a systemd environm

## Example File Layout (Linux/BSD)

One possible layout is to put everything in `/opt/jane`. Note, `janeserver` and `ta10` are put together just for convenience. Set permissions accordingly.
One possible layout is to put everything in `/opt/jane`. Note, `janeserver` and `tarzan` are put together just for convenience. Set permissions accordingly.

```bash
$ pwd
Expand All @@ -13,7 +13,7 @@ $ ls -l
total 27364
-rw-rw-r-- 1 ian ian 706 tammi 21 13:01 config.yaml
-rwxrwxr-x 1 ian ian 19448208 tammi 21 13:00 janeserver
-rwxrwxr-x 1 ian ian 8554460 tammi 21 13:02 ta10
-rwxrwxr-x 1 ian ian 8554460 tammi 21 13:02 tarzan
-rw-rw-r-- 1 ian ian 1440 tammi 21 13:01 temporary.crt
-rw-rw-r-- 1 ian ian 1704 tammi 21 13:01 temporary.key
```
Expand Down Expand Up @@ -44,19 +44,19 @@ Ensure the `config.yaml` is properly configured for your system and installation
Start with `systemctl start jane.service` and enable with `systemctl enable jane.service`. Use `journalctl -xe` to check startup and possible errors.


## TA10 and
## Tarzan

This is how to start ta10. It works on BSDs, Linux, Windows and quite a few others depending upon the binary. Instructions here for starting with systemd and rc.3 which'll probably transfer between many Linux and BSD installations. Windows seems to work too
This is how to start tarzan. It works on BSDs, Linux, Windows and quite a few others depending upon the binary. Instructions here for starting with systemd and rc.3 which'll probably transfer between many Linux and BSD installations. Windows seems to work too

### Linxu with Systemd
### Linux with Systemd

Place the following systemd configuration in `/etc/systemd/system` as `ta10.service`
Place the following systemd configuration in `/etc/systemd/system` as `tarzan.service`

Note ta10 may require root to run. Take note of any security aspects.
Note tarzan may require root to run. Take note of any security aspects. Ensure that tarzan starts the correct services - these are all made on the command line, see [here](running.md)!!

```
[Unit]
Description=TA10 Trust Agent
Description=Tarzan Trust Agent
After=network.target
StartLimitIntervalSec=0

Expand All @@ -65,28 +65,28 @@ Type=simple
Restart=always
RestartSec=1
User=root
ExecStart=/opt/jane/ta10
ExecStart=/opt/jane/tarzan --tpm2 --sys

[Install]
WantedBy=multi-user.target
```

Start with `systemctl start ta10.service` and enable with `systemctl enable ta10.service`. Use `journalctl -xe` to check startup and possible errors.
Start with `systemctl start tarzan.service` and enable with `systemctl enable tarzan.service`. Use `journalctl -xe` to check startup and possible errors.

### Windows

This is possible. In the respository in `dist` is a file `ta10TrustAgent.xml` which provides some hints on this.
This is possible. In the respository in `dist` is a file `TarzanTrustAgent.xml` which provides some hints on this.

### BSD (rc.d)

Yes too. This script placed in `/etc/rc.d` called `ta10` works for startup, at least on my OpenBSD VM:
Yes too. This script placed in `/etc/rc.d` called `tarzan` works for startup, at least on my OpenBSD VM:

```
#!/bin/sh
#
# $OpenBSD: ta10
# $OpenBSD: tarzan

daemon="/opt/jane/ta10"
daemon="/opt/jane/tarzan"

. /etc/rc.d/rc.subr

Expand Down
57 changes: 28 additions & 29 deletions docs/compiling.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The instructions presented here have been tested in Ubuntu 22.04 om AMD64.
+ [Install SGX SDK and Edgeless libraries](#install-sgx-sdk-and-edgeless-libraries)
+ [Building ](#building)
+ [Optional BUILD flag](#optional-build-flag)
* [Compiling TA10](#compiling-ta10)
* [Compiling tarzan](#compiling-tarzan)


<!-- TOC --><a name="compiling"></a>
Expand All @@ -31,7 +31,8 @@ wget -q https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key -O /
echo "deb [signed-by=/etc/apt/keyrings/intel-sgx-keyring.asc arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" > /etc/apt/sources.list.d/intel-sgx.list
apt update
wget https://github.com/edgelesssys/edgelessrt/releases/download/v0.4.1/edgelessrt_0.4.1_amd64_ubuntu-22.04.deb
apt-get install -y ./$ERT_DEB build-essential cmake libssl-dev libsgx-dcap-default-qpl libsgx-dcap-ql libsgx-dcap-quote-verify
apt-get install -y build-essential cmake libssl-dev libsgx-dcap-default-qpl libsgx-dcap-ql libsgx-dcap-quote-verify
dpkg -i ./edgelessrt_0.4.1_amd64_ubuntu-22.04.deb
```

<!-- TOC --><a name="building"></a>
Expand All @@ -40,48 +41,46 @@ apt-get install -y ./$ERT_DEB build-essential cmake libssl-dev libsgx-dcap-defau
Once SGX and Edgeless have been installed then you can just run this part every time you need to recompile. *MAKE SURE* you are in the `janeserver` directory when you run these commands:

```bash
go get -u
go mod tidy
. /opt/edgelessrt/share/openenclave/openenclaverc && GOOS=linux GOARCH=amd64 go build -o janeserver
make build
```

You will now get a file called `janeserver` which is your executable.

If you wish to reduce the size of the binary, run `strip janeserver`
You will now get a file called `janeserver` which is your executable. The Makefile also sets BUILD and VERSION flags. Further the Makefile also genates a PIE binary for security reasons.

<!-- TOC --><a name="optional-build-flag"></a>
### Optional BUILD flag
### Optional BUILD and VERSION flags

If you wish to set a build flag, then specify as part of the `ldflags -X` option as in the example command to compile below. Set the value `123` to whatever you want (within reason - a short string is fine). If you don't do this, and it is completely optional, then default value for the build flag will be `not set`.
If you wish to set build and version flag, then specify as part of the `ldflags -X` option as in the example command to compile below. Set the value `123` to whatever you want (within reason - a short string is fine). If you don't do this, and it is completely optional, then default value for the build flag will be `not set`.

```bash
. /opt/edgelessrt/share/openenclave/openenclaverc && GOOS=linux GOARCH=amd64 go build -ldflags="-X 'main.BUILD=123'" -o janeserver
. /opt/edgelessrt/share/openenclave/openenclaverc && GOOS=linux GOARCH=amd64 go build -ldflags="-X 'main.BUILD=123 main.VERSION=0.9'" -o janeserver
```

<!-- TOC --><a name="compiling-ta10"></a>
## Compiling TA10
<!-- TOC --><a name="compiling-tarzan"></a>
## Compiling tarzan
Tarzan is a reference trust agent implementation that responds to the A10HTTPREST protocol. Tarzan is only required if you want to use this protocol - it is useful for debugging and building interesting tests.

*MAKE SURE* you are in the `ta10` directory. TA10 is much simpler than janeserver and requires just compilation. For your local operating system and architecture you can remove the `GOOS` and `GOARCH` variables, for example as shown below. The `strip` command is optional but it does reduce the binary size a little.
*MAKE SURE* you are in the `tarzan` directory. tarzan is much simpler than janeserver and requires just compilation.

```bash
go get -u
go mod tidy
go build -o ta10
strip ta10
Make build
```

For other architectures, use `go tool dist list` for a list of operating system and architecture options. Listed below are a few common options - and we like to append this to the binary name when we're generating a few of these for the devices we have (remeber amd64 is 64-bit Intel/AMD x86 based chips, eg: Xeons, i9's, i7's, Threaripper etc etc)
This generates a PIE binary with BUILD and VERSION tags set for amd64 linux.

BUILD and VERSION flags are similar to janeserver.

For other architectures you can build tarzan manually: use `go tool dist list` for a list of operating system and architecture options. Listed below are a few common options - and we like to append this to the binary name when we're generating a few of these for the devices we have (remeber amd64 is 64-bit Intel/AMD x86 based chips, eg: Xeons, i9's, i7's, Threaripper etc etc)

```bash
GOOS=linux GOARCH=arm go build -o ta10_arm # eg: Pi 3s
GOOS=linux GOARCH=arm64 go build -o ta10_arm64 # eg: Pi 4, 5s in 64-bit mode (also 3's I think)
GOOS=windows GOARCH=amd64 go build -o ta10_win # eg: Pretty much every Win10, Win11 machine
GOOS=plan9 GOARCH=386 go build -o ta10_belllabs # Because I was in Bell Labs and plan9 was freaking cool! The real Unix next!
GOOS=linux GOARCH=s390x go build -o ta10_mainframe # Because you either have an z-Series in the basement or Hercules
GOOS=solaris GOARCH=amd64 go build -o ta10_solaris # I still mourn the lost of the SparcStation and UltraSparcs, RIP Sun.
GOOS=opebsd GOARCH=amd64 go build -o ta10_openbsd # BSD for security (netbsd and freebsd are supported too)
GOOS=darmin GOARCH=arm64 go build -o ta10_mac # For the Apple people out there...no TPM, but if you figure out attesting a T2 let me know
GOOS=aix GOARCH=ppc64 go build -o ta10_aix # If you have an AIX box, again let me know...DRTM is supported during boot and a TPM too?
GOOS=wasip1 GOARCH=wasm go build -o ta10_aix # Web Assembly works too...never tried this myself, so I wonder how it works
GOOS=linux GOARCH=arm go build -o tarzan_arm # eg: Pi 3s
GOOS=linux GOARCH=arm64 go build -o tarzan_arm64 # eg: Pi 4, 5s in 64-bit mode (also 3's I think)
GOOS=windows GOARCH=amd64 go build -o tarzan_win # eg: Pretty much every Win10, Win11 machine
GOOS=plan9 GOARCH=386 go build -o tarzan_belllabs # Because I was in Bell Labs and plan9 was freaking cool! The real Unix next!
GOOS=linux GOARCH=s390x go build -o tarzan_mainframe # Because you either have an z-Series in the basement or Hercules
GOOS=solaris GOARCH=amd64 go build -o tarzan_solaris # I still mourn the lost of the SparcStation and UltraSparcs, RIP Sun.
GOOS=opebsd GOARCH=amd64 go build -o tarzan_openbsd # BSD for security (netbsd and freebsd are supported too)
GOOS=darmin GOARCH=arm64 go build -o tarzan_mac # For the Apple people out there...no TPM, but if you figure out attesting a T2 let me know
GOOS=aix GOARCH=ppc64 go build -o tarzan_aix # If you have an AIX box, again let me know...DRTM is supported during boot and a TPM too?
GOOS=wasip1 GOARCH=wasm go build -o tarzan_aix # Web Assembly works too...never tried this myself, so I wonder how it works
```

15 changes: 6 additions & 9 deletions docs/contents.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,22 @@

## Basics

How do do things manually...
How to do things manually...

* [Compiling](compiling.md)
* [Running](running.md)
* [Automatic Startup](automaticStartup.md)
* [Security and Running in a Production Environment](security.md)

How do do things with Docker...
How to do things with Docker and other things...

* [Building and Running with Docker](docker.md)
* [Building and Instasllating with DEB and RPM](deb.md)

## Getting Started
How do I get started?

* Creating an element
* Loading the standard intents
* Your first attestation
* Creating and expected value
* Verification
* More attestation and verification
* [Getting Started](gettingstarted.md)
* [UI, if on the local machine and default port](http://127.0.0.1:8540)

## Structures

Expand Down
Loading
Loading