Merge pull request #47 from Cosmian/bump-and-fix

Fix RUSTSEC with some major changes

Author: grydz

.devcontainer/Dockerfile

@@ -1,25 +1,44 @@
-FROM ghcr.io/cosmian/intel-sgx:2.25
+FROM ubuntu:24.04
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-RUN rustup default stable
-
-RUN rustup component add clippy rustfmt
+USER root
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TS=Etc/UTC
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
 
 RUN apt-get update && apt-get install --no-install-recommends -qq -y \
     build-essential \
+    clang \
+    curl \
+    git \
+    gnupg \
+    tzdata\
     pkg-config \
     libssl-dev \
     python3 \
     python3-pip \
     tpm2-tools \
     libtss2-dev \
-    libtdx-attest-dev \
     && apt-get -y -q upgrade \
     && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* \
-    && python3 -m pip install "maturin"
+    && rm -rf /var/lib/apt/lists/*
 
-RUN sed -i 's,https://localhost:8081/sgx/certification/v4/,https://pccs.staging.mse.cosmian.com/sgx/certification/v4/,' /etc/sgx_default_qcnl.conf
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN rustup default stable
+
+RUN rustup component add clippy rustfmt
+
+RUN cargo install --locked cargo-deny
+
+# Intel SGX APT repository
+RUN curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key && \
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" \
+    | tee /etc/apt/sources.list.d/intel-sgx.list
+
+RUN apt-get update && apt-get install --no-install-recommends -qq -y libtdx-attest-dev \
+    && apt-get -y -q upgrade \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*

.github/workflows/ci.yml

@@ -5,52 +5,55 @@ name: Continuous integration
 jobs:
   check:
     name: Check
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/cosmian/intel-sgx:2.25
+    runs-on: ubuntu-24.04
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache dependencies
+        id: cargo-cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ github.ref_name }}
+
       - name: Install dependencies
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
         run: |
-          apt-get update && apt-get install -y libssl-dev tpm2-tools libtss2-dev libtdx-attest-dev
+          sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
+          echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" | sudo tee /etc/apt/sources.list.d/intel-sgx.list
+          sudo apt-get update && sudo apt-get install -y tpm2-tools libtss2-dev libtdx-attest=1.24.100.2-noble1 libtdx-attest-dev=1.24.100.2-noble1
 
-      - uses: actions/checkout@v2
-
-      - name: Rustup setup
-        uses: actions-rs/toolchain@v1
+      - name: Install Rust toolchain and components
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        uses: dtolnay/rust-toolchain@stable
         with:
-          profile: minimal
           toolchain: stable
-          override: true
-
-      - run: rustup component add rustfmt && rustup component add clippy && cargo install cargo-machete
+          components: rustfmt, clippy
 
-      - name: Security Audit
-        uses: EmbarkStudios/cargo-deny-action@v2
+      - name: Install cargo-machete
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-machete
 
       - name: Cargo fmt
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo fmt --all -- --check
 
       - name: Cargo check
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo check
 
       - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: -- -D warnings
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo clippy -- -D warnings
 
       - name: Machete (deps checker)
-        uses: actions-rs/cargo@v1
-        with:
-          command: machete
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo machete
 
       - name: Cargo test
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: -- --nocapture
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo test -- --nocapture
+
+      - name: Cargo build
+        if: steps.cargo-cache.outputs.cache-hit != 'true'
+        run: cargo build --release