Skip to content

NOISSUE - Use attestation-agent config and add Wasmtime cache #219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rodneyosodo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

NOISSUE - Use attestation-agent config and add Wasmtime cache #219

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions hal/ubuntu/qemu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,15 +151,23 @@ write_files:
PROPLET_ENABLE_MONITORING=true
PROPLET_MANAGER_K8S_NAMESPACE=default
PROPLET_KBS_URI=KBS_URI_PLACEHOLDER
PROPLET_AA_CONFIG_PATH=/etc/default/proplet.toml
PROPLET_AA_CONFIG_PATH=/etc/attestation-agent.conf
PROPLET_LAYER_STORE_PATH=/tmp/proplet/layers
permissions: '0644'

- path: /etc/default/proplet.toml
- path: /etc/attestation-agent.conf
content: |
[token_configs]
[token_configs.coco_kbs]

[token_configs.kbs]

@JeffMboya JeffMboya Jun 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kbs renamed from coco_kbs; AA version must support this key.

@rodneyosodo rodneyosodo Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. It does

url = "KBS_URI_PLACEHOLDER"

[eventlog_config]
init_pcr = 17
enable_eventlog = false

[log]
level = "info"
permissions: '0644'

- path: /etc/default/attestation-agent
Expand Down Expand Up @@ -259,7 +267,9 @@ write_files:
Type=simple
EnvironmentFile=/etc/default/proplet
Environment=WASMTIME_HOME=/var/lib/proplet
Environment=WASMTIME_CACHE_DIR=/var/cache/wasmtime

@JeffMboya JeffMboya Jun 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WASMTIME_CACHE_DIR is not recognized by Wasmtime; use WASMTIME_CACHE_CONFIG.

@rodneyosodo rodneyosodo Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wasmtime has neither env variables. It is just unix style https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s05.html

ExecStartPre=/bin/mkdir -p /var/lib/proplet/cache
ExecStartPre=/bin/mkdir -p /var/cache/wasmtime
ExecStartPre=/bin/sh -c 'until nc -z 127.0.0.1 50010 && nc -z 127.0.0.1 50011; do sleep 1; done'
ExecStart=/usr/local/bin/proplet
Restart=on-failure
Expand All @@ -271,7 +281,7 @@ write_files:
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/proplet /tmp
ReadWritePaths=/var/lib/proplet /var/cache/wasmtime /tmp

@drasko drasko Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we hard-coding for only one Wasm runtime? Who is guaranteeing that only Wasmtime will be used? Are we hard-coding this on purpose?

@rodneyosodo rodneyosodo Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are shipping the qemu config with the default wasmtime installed


[Install]
WantedBy=multi-user.target
Expand Down Expand Up @@ -320,6 +330,7 @@ runcmd:
# Create directories
- mkdir -p /etc/attestation-agent/certs
- mkdir -p /var/lib/proplet
- mkdir -p /var/cache/wasmtime
- mkdir -p /etc/proplet
- mkdir -p /run/attestation-agent
- mkdir -p /run/coco-keyprovider
Expand Down