feat: update Seal-Nautilus pattern to new key load workflow

.github/workflows/move.yml

@@ -28,7 +28,7 @@ jobs:
               platform: ubuntu
               arch: x86_64
               extension-matching: true
-              tag: testnet-v1.59.0
+              tag: testnet-v1.61.2
 
       - name: Run move tests
         run: |

.github/workflows/rust.yml

@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: EmbarkStudios/cargo-deny-action@v1
+      - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # pin@v2.0.14
         with:
           command: check
           arguments: --all-features

deny.toml

@@ -38,7 +38,9 @@ ignore = [
     "RUSTSEC-2024-0421",
     # allow unmaintained derivative crate used in transitive dependencies (paste, ark-*, also in Sui)
     "RUSTSEC-2024-0388",
-    "RUSTSEC-2024-0436"
+    "RUSTSEC-2024-0436",
+    # allow unmaintained rustls-pemfile
+    "RUSTSEC-2025-0134"
 ]
 
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score

move/enclave/Move.lock

@@ -43,6 +43,14 @@ dependencies = [
 ]
 
 [move.toolchain-version]
-compiler-version = "1.59.0"
+compiler-version = "1.61.2"
 edition = "2024.beta"
 flavor = "sui"
+
+[env]
+
+[env.testnet]
+chain-id = "4c78adac"
+original-published-id = "0xc664c812bfce5b8ade4243da3d91fc529ac488f79f7f7bf2e0e7c4fd887a2433"
+latest-published-id = "0xc664c812bfce5b8ade4243da3d91fc529ac488f79f7f7bf2e0e7c4fd887a2433"
+published-version = "1"

move/enclave/sources/enclave.move

@@ -171,7 +171,7 @@ fun to_pcrs(document: &NitroAttestationDocument): Pcrs {
     Pcrs(*pcrs[0].value(), *pcrs[1].value(), *pcrs[2].value())
 }
 
-fun create_intent_message<P: drop>(intent: u8, timestamp_ms: u64, payload: P): IntentMessage<P> {
+public fun create_intent_message<P: drop>(intent: u8, timestamp_ms: u64, payload: P): IntentMessage<P> {
     IntentMessage {
         intent,
         timestamp_ms,

move/seal-policy/Move.lock

@@ -14,7 +14,7 @@ dependencies = [
 
 [[move.package]]
 id = "Bridge"
-source = { git = "https://github.com/MystenLabs/sui.git", rev = "61dcfdbe2ddc7ad05d27fc10cd09d4c6cc151acd", subdir = "crates/sui-framework/packages/bridge" }
+source = { git = "https://github.com/MystenLabs/sui.git", rev = "c1f1ae650fb9f9248b39a569400b4420820868db", subdir = "crates/sui-framework/packages/bridge" }
 
 dependencies = [
   { id = "MoveStdlib", name = "MoveStdlib" },
@@ -24,19 +24,19 @@ dependencies = [
 
 [[move.package]]
 id = "MoveStdlib"
-source = { git = "https://github.com/MystenLabs/sui.git", rev = "61dcfdbe2ddc7ad05d27fc10cd09d4c6cc151acd", subdir = "crates/sui-framework/packages/move-stdlib" }
+source = { git = "https://github.com/MystenLabs/sui.git", rev = "c1f1ae650fb9f9248b39a569400b4420820868db", subdir = "crates/sui-framework/packages/move-stdlib" }
 
 [[move.package]]
 id = "Sui"
-source = { git = "https://github.com/MystenLabs/sui.git", rev = "61dcfdbe2ddc7ad05d27fc10cd09d4c6cc151acd", subdir = "crates/sui-framework/packages/sui-framework" }
+source = { git = "https://github.com/MystenLabs/sui.git", rev = "c1f1ae650fb9f9248b39a569400b4420820868db", subdir = "crates/sui-framework/packages/sui-framework" }
 
 dependencies = [
   { id = "MoveStdlib", name = "MoveStdlib" },
 ]
 
 [[move.package]]
 id = "SuiSystem"
-source = { git = "https://github.com/MystenLabs/sui.git", rev = "61dcfdbe2ddc7ad05d27fc10cd09d4c6cc151acd", subdir = "crates/sui-framework/packages/sui-system" }
+source = { git = "https://github.com/MystenLabs/sui.git", rev = "c1f1ae650fb9f9248b39a569400b4420820868db", subdir = "crates/sui-framework/packages/sui-system" }
 
 dependencies = [
   { id = "MoveStdlib", name = "MoveStdlib" },
@@ -55,6 +55,14 @@ dependencies = [
 ]
 
 [move.toolchain-version]
-compiler-version = "1.59.0"
+compiler-version = "1.61.2"
 edition = "2024.beta"
 flavor = "sui"
+
+[env]
+
+[env.testnet]
+chain-id = "4c78adac"
+original-published-id = "0x2080f9c370ddb22c48d6377f8aa64883c3a1c61d3febbcc18b6bf70553ae45a0"
+latest-published-id = "0x2080f9c370ddb22c48d6377f8aa64883c3a1c61d3febbcc18b6bf70553ae45a0"
+published-version = "1"

move/seal-policy/sources/seal_policy.move

@@ -2,20 +2,53 @@
 // SPDX-License-Identifier: Apache-2.0
 
 module seal_policy_example::seal_policy {
-    use enclave::enclave::Enclave;
+    use enclave::enclave::{Enclave, create_intent_message};
     use seal_policy_example::weather::WEATHER;
-    use sui::hash::blake2b256;
+    use sui::{bcs, ed25519, hash::blake2b256};
 
     const ENoAccess: u64 = 0;
+    const WalletPKIntent: u8 = 1;
 
-    entry fun seal_approve(_id: vector<u8>, enclave: &Enclave<WEATHER>, ctx: &TxContext) {
-        // In this example whether the enclave is the latest version is not checked. One
-        // can pass EnclaveConfig as an argument and check config_version if needed.
-        assert!(ctx.sender().to_bytes() == pk_to_address(enclave.pk()), ENoAccess);
+    /// Signing payload struct signed by the enclave keypair.
+    public struct WalletPK has drop {
+        pk: vector<u8>,
     }
 
+    /// Seal approve policy that checks: 
+    /// 1) The ID used to derive Seal key is always vector[0]. 
+    /// 2) The sender matches the wallet PK hash. 
+    /// 3) The signature is verified against the enclave's registered ephemeral pk and its payload 
+    /// (the bcs bytes of the intent message of the wallet PK and the timestamp).
+    /// 
+    /// In this example policy, whether the enclave is the latest version is not checked. One may 
+    /// pass EnclaveConfig as an argument and check config_version if needed. In addition, the 
+    /// timestamp is not checked, since it's already checked during Seal session key validation. One
+    /// may add additional checks against the clock object. 
+    entry fun seal_approve(
+        id: vector<u8>,
+        signature: vector<u8>,
+        wallet_pk: vector<u8>,
+        timestamp: u64,
+        enclave: &Enclave<WEATHER>,
+        ctx: &TxContext,
+    ) {       
+        assert!(id == vector[0u8], ENoAccess);
+        assert!(ctx.sender().to_bytes() == pk_to_address(&wallet_pk), ENoAccess);
+
+        let signing_payload = create_intent_message(
+            WalletPKIntent,
+            timestamp,
+            WalletPK {
+                pk: wallet_pk,
+            },
+        );
+        let payload = bcs::to_bytes(&signing_payload);
+        assert!(ed25519::ed25519_verify(&signature, enclave.pk(), &payload), ENoAccess);
+    }
+
+    /// Helper function to check the address derived from a public key. Assume ed25519 flag for 
+    /// enclave's ephemeral key and a Sui address is derived as blake2b_hash(flag || pk).
     fun pk_to_address(pk: &vector<u8>): vector<u8> {
-        // Assume ed25519 flag for enclave's ephemeral key. Derive address as blake2b_hash(flag || pk).
         let mut arr = vector[0u8];
         arr.append(*pk);
         let hash = blake2b256(&arr);
@@ -28,4 +61,21 @@ module seal_policy_example::seal_policy {
         let expected_bytes = x"29287d8584fb5b71b8d62e7224b867207d205fb61d42b7cce0deef95bf4e8202";
         assert!(pk_to_address(&eph_pk) == expected_bytes, ENoAccess);
     }
+
+    #[test]
+    fun test_serde() {
+        // A consistency test for intent message serialization with Rust, using test data by running 
+        // Nautilus server locally logged timestamp, wallet pk and serialized signing bytes. 
+        let intent_msg = create_intent_message(
+            WalletPKIntent,
+            1767627884584,
+            WalletPK {
+                pk: x"b8b91c7c3afff7e75e44ce64c11455e60989697a37d16421d727e4d01607cfda",
+            },
+        );
+        let signing_payload = bcs::to_bytes(&intent_msg);
+        let expected =
+            x"012808d58e9b01000020b8b91c7c3afff7e75e44ce64c11455e60989697a37d16421d727e4d01607cfda";
+        assert!(signing_payload == expected);
+    }
 }

move/seal-policy/sources/weather.move

@@ -70,7 +70,7 @@ module seal_policy_example::weather {
     fun test_weather_flow() {
         use sui::test_scenario::{Self, ctx, next_tx};
         use sui::nitro_attestation;
-        use sui::test_utils::destroy;
+        use std::unit_test::destroy;
         use enclave::enclave::{register_enclave, create_enclave_config, update_pcrs, EnclaveConfig};
 
         let mut scenario = test_scenario::begin(@0x1);

move/twitter-example/Move.lock

@@ -55,7 +55,7 @@ dependencies = [
 ]
 
 [move.toolchain-version]
-compiler-version = "1.59.0"
+compiler-version = "1.61.2"
 edition = "2024.beta"
 flavor = "sui"
 

move/twitter-example/sources/twitter.move

@@ -54,7 +54,6 @@ public fun mint_nft<T>(twitter_name: vector<u8>, timestamp_ms: u64, sig: &vector
 fun test_twitter_flow() {
     use sui::test_scenario::{Self, ctx, next_tx};
     use sui::nitro_attestation;
-    use sui::test_utils::destroy;
     use enclave::enclave::{register_enclave, create_enclave_config, update_pcrs, EnclaveConfig};
 
     let mut scenario = test_scenario::begin(@0x4668aa5963dacfe3e169be3cf824395ab9de3f0a544fc2ca638858a536b5ff4b);
@@ -105,6 +104,6 @@ fun test_twitter_flow() {
     test_scenario::return_shared(config);
     clock.destroy_for_testing();
     enclave.destroy();
-    destroy(cap);
+    transfer::public_transfer(cap, @0x1);
     test_scenario::end(scenario);
 }

move/weather-example/Move.lock

@@ -55,7 +55,7 @@ dependencies = [
 ]
 
 [move.toolchain-version]
-compiler-version = "1.59.0"
+compiler-version = "1.61.2"
 edition = "2024.beta"
 flavor = "sui"
 

move/weather-example/sources/weather.move

@@ -71,7 +71,6 @@ public fun update_weather<T>(
 fun test_weather_flow() {
     use sui::test_scenario::{Self, ctx, next_tx};
     use sui::nitro_attestation;
-    use sui::test_utils::destroy;
     use enclave::enclave::{register_enclave, create_enclave_config, update_pcrs, EnclaveConfig};
 
     let mut scenario = test_scenario::begin(@0x1);
@@ -123,6 +122,6 @@ fun test_weather_flow() {
     test_scenario::return_shared(config);
     clock.destroy_for_testing();
     enclave.destroy();
-    destroy(cap);
+    transfer::public_transfer(cap, @0x1);
     scenario.end();
 }

src/nautilus-server/Cargo.toml

@@ -31,7 +31,7 @@ regex = { version = "1.5", optional = true }
 
 sui-sdk-types = { version = "0.1.0", features = ["serde", "hash"], optional = true }
 sui-crypto = { version = "0.1.0", features = ["ed25519"], optional = true }
-seal-sdk = { git = "https://github.com/MystenLabs/seal", rev = "cdb6ddf104eca6055d69080608da010a83d736bf", package = "seal-sdk", optional = true }
+seal-sdk = { git = "https://github.com/MystenLabs/seal", rev = "cfb29d2e08ff1ae34bfe8dfb6c2f0849eaf84054", package = "seal-sdk", optional = true }
 
 [features]
 weather-example = []