go/runtime/host: Introduce QuotePolicyProvider interface

This enables us to get rid of the consensus dependency.

Author: martintomazic

go/runtime/host/provisioner/provisioner.go

@@ -20,6 +20,7 @@ import (
 	hostProtocol "github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
 	hostSandbox "github.com/oasisprotocol/oasis-core/go/runtime/host/sandbox"
 	hostSgx "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx"
+	sgxCommon "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx/common"
 	hostTdx "github.com/oasisprotocol/oasis-core/go/runtime/host/tdx"
 )
 
@@ -47,8 +48,10 @@ func New(
 		return nil, err
 	}
 
+	policyProvider := sgxCommon.NewQuotePolicyProvider(consensus)
+
 	// Create runtime provisioner.
-	return createProvisioner(dataDir, commonStore, identity, consensus, hostInfo, qs)
+	return createProvisioner(dataDir, commonStore, identity, hostInfo, qs, policyProvider)
 }
 
 func createHostInfo(genesisDoc *genesisAPI.Document) (*hostProtocol.HostInfo, error) {
@@ -76,9 +79,9 @@ func createProvisioner(
 	dataDir string,
 	commonStore *persistent.CommonStore,
 	identity *identity.Identity,
-	consensus consensus.Service,
 	hostInfo *hostProtocol.HostInfo,
 	qs pcs.QuoteService,
+	policyProvider sgxCommon.QuotePolicyProvider,
 ) (runtimeHost.Provisioner, error) {
 	var err error
 	var insecureNoSandbox bool
@@ -144,7 +147,7 @@ func createProvisioner(
 			CommonStore:           commonStore,
 			LoaderPath:            sgxLoader,
 			PCS:                   qs,
-			Consensus:             consensus,
+			QuotePolicy:           policyProvider,
 			Identity:              identity,
 			SandboxBinaryPath:     sandboxBinary,
 			InsecureNoSandbox:     insecureNoSandbox,
@@ -173,7 +176,7 @@ func createProvisioner(
 		HostInfo:              hostInfo,
 		CommonStore:           commonStore,
 		PCS:                   qs,
-		Consensus:             consensus,
+		QuotePolicy:           policyProvider,
 		Identity:              identity,
 		CidPool:               cidPool,
 		RuntimeAttestInterval: attestInterval,

go/runtime/host/sgx/common/common.go

@@ -24,16 +24,23 @@ import (
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/sandbox"
 )
 
-// GetQuotePolicy fetches the quote policy for the specified RONL deployment.
-//
-// Returns nil if the policy is not available.
-func GetQuotePolicy(
-	ctx context.Context,
-	runtimeID common.Namespace,
-	version version.Version,
-	cs consensus.Service,
-) (*sgxQuote.Policy, error) {
-	rt, err := cs.Registry().GetRuntime(ctx, &registry.GetRuntimeQuery{
+// QuotePolicyProvider provides quote policies.
+type QuotePolicyProvider interface {
+	// Get fetches the quote policy for the specified RONL deployment.
+	Get(ctx context.Context, runtimeID common.Namespace, version version.Version) (*sgxQuote.Policy, error)
+}
+
+type quotePolicyProvider struct {
+	cs consensus.Service
+}
+
+// NewQuotePolicyProvider returns a QuotePolicyProvider backed by the consensus.
+func NewQuotePolicyProvider(cs consensus.Service) QuotePolicyProvider {
+	return &quotePolicyProvider{cs: cs}
+}
+
+func (p *quotePolicyProvider) Get(ctx context.Context, runtimeID common.Namespace, version version.Version) (*sgxQuote.Policy, error) {
+	rt, err := p.cs.Registry().GetRuntime(ctx, &registry.GetRuntimeQuery{
 		Height:           consensus.HeightLatest,
 		ID:               runtimeID,
 		IncludeSuspended: true,

go/runtime/host/sgx/ecdsa.go

@@ -57,7 +57,7 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 	var pcsQuotePolicy *pcs.QuotePolicy
 	switch ec.cfg.Component.Kind {
 	case component.RONL:
-		quotePolicy, err := sgxCommon.GetQuotePolicy(ctx, ec.cfg.ID, ec.cfg.Component.Version, sp.consensus)
+		quotePolicy, err := sp.policyProvider.Get(ctx, ec.cfg.ID, ec.cfg.Component.Version)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
 		}

go/runtime/host/sgx/provisioner.go

@@ -19,7 +19,6 @@ import (
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/aesm"
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/sigstruct"
-	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
 	cmdFlags "github.com/oasisprotocol/oasis-core/go/oasis-node/cmd/common/flags"
 	"github.com/oasisprotocol/oasis-core/go/runtime/bundle"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host"
@@ -59,8 +58,8 @@ type Config struct {
 
 	// PCS is the Intel Provisioning Certification Service quote service.
 	PCS pcs.QuoteService
-	// Consensus is the consensus layer backend.
-	Consensus consensus.Service
+	// QuotePolicy provides the quote policy for RONL deployments.
+	QuotePolicy sgxCommon.QuotePolicyProvider
 	// Identity is the node identity.
 	Identity *identity.Identity
 
@@ -86,12 +85,12 @@ type sgxProvisioner struct {
 
 	cfg Config
 
-	sandbox   host.Provisioner
-	pcs       pcs.QuoteService
-	aesm      *aesm.Client
-	consensus consensus.Service
-	identity  *identity.Identity
-	store     *persistent.CommonStore
+	sandbox        host.Provisioner
+	pcs            pcs.QuoteService
+	aesm           *aesm.Client
+	policyProvider sgxCommon.QuotePolicyProvider
+	identity       *identity.Identity
+	store          *persistent.CommonStore
 
 	logger *logging.Logger
 }
@@ -106,13 +105,13 @@ func NewProvisioner(cfg Config) (host.Provisioner, error) {
 	sgxCommon.InitMetrics()
 
 	p := &sgxProvisioner{
-		cfg:       cfg,
-		pcs:       cfg.PCS,
-		aesm:      aesm.NewClient(aesmdSocketPath),
-		consensus: cfg.Consensus,
-		identity:  cfg.Identity,
-		store:     cfg.CommonStore,
-		logger:    logging.GetLogger("runtime/host/sgx"),
+		cfg:            cfg,
+		pcs:            cfg.PCS,
+		aesm:           aesm.NewClient(aesmdSocketPath),
+		policyProvider: cfg.QuotePolicy,
+		identity:       cfg.Identity,
+		store:          cfg.CommonStore,
+		logger:         logging.GetLogger("runtime/host/sgx"),
 	}
 	sp, err := sandbox.NewProvisioner(sandbox.Config{
 		GetSandboxConfig:  p.getSandboxConfig,

go/runtime/host/tdx/qemu.go

@@ -20,7 +20,6 @@ import (
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
 	sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
 	"github.com/oasisprotocol/oasis-core/go/config"
-	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
 	"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
@@ -56,8 +55,8 @@ type QemuConfig struct {
 
 	// PCS is the Intel Provisioning Certification Service quote service.
 	PCS pcs.QuoteService
-	// Consensus is the consensus layer backend.
-	Consensus consensus.Service
+	// QuotePolicy provides the quote policy for RONL deployments.
+	QuotePolicy sgxCommon.QuotePolicyProvider
 	// Identity is the node identity.
 	Identity *identity.Identity
 
@@ -78,11 +77,11 @@ type QemuExtraConfig struct {
 type qemuProvisioner struct {
 	cfg QemuConfig
 
-	sandbox   host.Provisioner
-	pcs       pcs.QuoteService
-	consensus consensus.Service
-	identity  *identity.Identity
-	cidPool   *CidPool
+	sandbox     host.Provisioner
+	pcs         pcs.QuoteService
+	quotePolicy sgxCommon.QuotePolicyProvider
+	identity    *identity.Identity
+	cidPool     *CidPool
 
 	logger *logging.Logger
 }
@@ -97,12 +96,12 @@ func NewQemuProvisioner(cfg QemuConfig) (host.Provisioner, error) {
 	sgxCommon.InitMetrics()
 
 	p := &qemuProvisioner{
-		cfg:       cfg,
-		pcs:       cfg.PCS,
-		consensus: cfg.Consensus,
-		identity:  cfg.Identity,
-		cidPool:   cfg.CidPool,
-		logger:    logging.GetLogger("runtime/host/tdx/qemu"),
+		cfg:         cfg,
+		pcs:         cfg.PCS,
+		quotePolicy: cfg.QuotePolicy,
+		identity:    cfg.Identity,
+		cidPool:     cfg.CidPool,
+		logger:      logging.GetLogger("runtime/host/tdx/qemu"),
 	}
 	sp, err := sandbox.NewProvisioner(sandbox.Config{
 		Connector:         newVsockConnector,
@@ -437,7 +436,7 @@ func (p *qemuProvisioner) updateCapabilityTEE(ctx context.Context, hp *sandbox.H
 	var quotePolicy *sgxQuote.Policy
 	switch hp.Config.Component.Kind {
 	case component.RONL:
-		quotePolicy, err = sgxCommon.GetQuotePolicy(ctx, hp.Config.ID, hp.Config.Component.Version, p.consensus)
+		quotePolicy, err = p.quotePolicy.Get(ctx, hp.Config.ID, hp.Config.Component.Version)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
 		}