project-oak · jul-sh · Jan 17, 2024 · Jan 17, 2024 · Jan 17, 2024 · Jan 17, 2024
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/oak_containers/README.md b/oak_containers/README.md
diff --git a/oak_containers_launcher/build.rs b/oak_containers_launcher/build.rs
@@ -19,7 +19,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Generate gRPC code for connecting to the launcher.
     generate_grpc_code(
         &[
-            "../oak_containers/proto/interfaces.proto",
+            "../proto/containers/launcher.proto",
             "../oak_crypto/proto/v1/crypto.proto",
             "../proto/key_provisioning/key_provisioning.proto",
             "../proto/containers/hostlib_key_provisioning.proto",

diff --git a/oak_containers_launcher/src/lib.rs b/oak_containers_launcher/src/lib.rs
@@ -16,8 +16,6 @@
 pub mod proto {
     pub mod oak {
         pub mod containers {
-            #![allow(clippy::return_self_not_must_use)]
-            tonic::include_proto!("oak.containers");
             pub mod v1 {
                 #![allow(clippy::return_self_not_must_use)]
                 tonic::include_proto!("oak.containers.v1");

diff --git a/oak_containers_launcher/src/server.rs b/oak_containers_launcher/src/server.rs
@@ -43,15 +43,11 @@ use tokio_stream::wrappers::TcpListenerStream;
 use tonic::{transport::Server, Request, Response, Status};
 
 use crate::proto::oak::{
-    containers::{
+    containers::v1::{
+        hostlib_key_provisioning_server::{HostlibKeyProvisioning, HostlibKeyProvisioningServer},
         launcher_server::{Launcher, LauncherServer},
-        v1::{
-            hostlib_key_provisioning_server::{
-                HostlibKeyProvisioning, HostlibKeyProvisioningServer,
-            },
-            GetGroupKeysResponse, GetKeyProvisioningRoleResponse, KeyProvisioningRole,
-        },
-        GetApplicationConfigResponse, GetImageResponse, SendAttestationEvidenceRequest,
+        GetApplicationConfigResponse, GetGroupKeysResponse, GetImageResponse,
+        GetKeyProvisioningRoleResponse, KeyProvisioningRole, SendAttestationEvidenceRequest,
     },
     session::v1::AttestationEvidence,
 };

diff --git a/oak_containers_orchestrator/build.rs b/oak_containers_orchestrator/build.rs
@@ -19,9 +19,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Generate gRPC code for Orchestrator services.
     generate_grpc_code(
         &[
-            "../oak_containers/proto/interfaces.proto",
             "../proto/key_provisioning/key_provisioning.proto",
-            "../proto/containers/orchestrator_crypto.proto",
+            "../proto/containers/application_interfaces.proto",
+            "../proto/containers/launcher.proto",
             "../proto/containers/hostlib_key_provisioning.proto",
             "../proto/session/messages.proto",
         ],

diff --git a/oak_containers_orchestrator/src/ipc_server.rs b/oak_containers_orchestrator/src/ipc_server.rs
@@ -24,9 +24,9 @@ use tonic::{transport::Server, Request, Response};
 use crate::{
     crypto::{CryptoService, KeyStore},
     launcher_client::LauncherClient,
-    proto::oak::containers::{
+    proto::oak::containers::v1::{
+        orchestrator_crypto_server::OrchestratorCryptoServer,
         orchestrator_server::{Orchestrator, OrchestratorServer},
-        v1::orchestrator_crypto_server::OrchestratorCryptoServer,
         GetApplicationConfigResponse,
     },
 };

diff --git a/oak_containers_orchestrator/src/launcher_client.rs b/oak_containers_orchestrator/src/launcher_client.rs
@@ -19,9 +19,9 @@ use tonic::transport::Channel;
 
 use crate::proto::oak::{
     attestation::v1::Evidence,
-    containers::{
-        launcher_client::LauncherClient as GrpcLauncherClient,
-        v1::{hostlib_key_provisioning_client::HostlibKeyProvisioningClient, KeyProvisioningRole},
+    containers::v1::{
+        hostlib_key_provisioning_client::HostlibKeyProvisioningClient,
+        launcher_client::LauncherClient as GrpcLauncherClient, KeyProvisioningRole,
         SendAttestationEvidenceRequest,
     },
     key_provisioning::v1::GroupKeys,

diff --git a/oak_containers_orchestrator/src/lib.rs b/oak_containers_orchestrator/src/lib.rs
@@ -16,8 +16,6 @@
 pub mod proto {
     pub mod oak {
         pub mod containers {
-            #![allow(clippy::return_self_not_must_use)]
-            tonic::include_proto!("oak.containers");
             pub mod v1 {
                 #![allow(clippy::return_self_not_must_use)]
                 tonic::include_proto!("oak.containers.v1");

diff --git a/oak_containers_sdk/Cargo.toml b/oak_containers_sdk/Cargo.toml
@@ -11,7 +11,6 @@ oak_grpc_utils = { workspace = true }
 [dependencies]
 anyhow = "*"
 async-trait = { version = "*", default-features = false }
-oak_attestation = { workspace = true }
 oak_crypto = { workspace = true }
 prost = "*"
 prost-types = "*"

diff --git a/oak_containers_sdk/build.rs b/oak_containers_sdk/build.rs
@@ -19,10 +19,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Generate gRPC code for connecting to the Orchestrator.
     generate_grpc_code(
         &[
-            "oak_containers/proto/interfaces.proto",
             "oak_crypto/proto/v1/crypto.proto",
             "proto/session/messages.proto",
-            "proto/containers/orchestrator_crypto.proto",
+            "proto/containers/application_interfaces.proto",
         ],
         "..",
         CodegenOptions {

diff --git a/oak_containers_sdk/src/lib.rs b/oak_containers_sdk/src/lib.rs
@@ -16,13 +16,11 @@
 mod proto {
     pub mod oak {
         pub mod containers {
-            tonic::include_proto!("oak.containers");
             pub mod v1 {
                 #![allow(clippy::return_self_not_must_use)]
                 tonic::include_proto!("oak.containers.v1");
             }
         }
-        pub use oak_attestation::proto::oak::{attestation, session};
         pub use oak_crypto::proto::oak::crypto;
     }
 }

diff --git a/oak_containers_sdk/src/orchestrator_client.rs b/oak_containers_sdk/src/orchestrator_client.rs
@@ -17,7 +17,7 @@ use anyhow::{Context, Result};
 use tonic::transport::{Endpoint, Uri};
 use tower::service_fn;
 
-use crate::proto::oak::containers::orchestrator_client::OrchestratorClient as GrpcOrchestratorClient;
+use crate::proto::oak::containers::v1::orchestrator_client::OrchestratorClient as GrpcOrchestratorClient;
 
 // Unix Domain Sockets do not use URIs, hence this URI will never be used.
 // It is defined purely since in order to create a channel, since a URI has to

diff --git a/oak_containers_stage1/Cargo.toml b/oak_containers_stage1/Cargo.toml
@@ -15,7 +15,6 @@ clap = { version = "*", features = ["derive"] }
 coset = { version = "*", features = ["std"] }
 futures-util = "*"
 oak_attestation = { workspace = true }
-oak_crypto = { workspace = true }
 oak_dice = { workspace = true }
 nix = { version = "*", features = ["mman"] }
 p256 = { version = "*" }

diff --git a/oak_containers_stage1/build.rs b/oak_containers_stage1/build.rs
@@ -20,9 +20,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Generate gRPC code for loading the system image.
     generate_grpc_code(
         &[
-            "../oak_containers/proto/interfaces.proto",
             "../oak_crypto/proto/v1/crypto.proto",
             "../proto/session/messages.proto",
+            "../proto/containers/launcher.proto",
         ],
         "..",
         CodegenOptions {

diff --git a/oak_containers_stage1/src/client.rs b/oak_containers_stage1/src/client.rs
@@ -17,14 +17,17 @@
 mod proto {
     pub mod oak {
         pub mod containers {
-            tonic::include_proto!("oak.containers");
+            pub mod v1 {
+                #![allow(clippy::return_self_not_must_use)]
+                tonic::include_proto!("oak.containers.v1");
+            }
         }
         pub use oak_attestation::proto::oak::{attestation, session};
     }
 }
 
 use anyhow::{Context, Result};
-use proto::oak::containers::launcher_client::LauncherClient as GrpcLauncherClient;
+use proto::oak::containers::v1::launcher_client::LauncherClient as GrpcLauncherClient;
 use tonic::transport::{Channel, Uri};
 
 pub struct LauncherClient {

diff --git a/oak_functions_containers_app/build.rs b/oak_functions_containers_app/build.rs
@@ -38,7 +38,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     generate_grpc_code(
         &[
-            "../oak_containers/proto/interfaces.proto",
+            "../oak_crypto/proto/v1/crypto.proto",
+            "../proto/containers/application_interfaces.proto",
             "../proto/session/messages.proto",
         ],
         "..",

diff --git a/oak_functions_containers_app/src/lib.rs b/oak_functions_containers_app/src/lib.rs
@@ -52,8 +52,10 @@ pub mod proto {
             tonic::include_proto!("oak.functions");
         }
         pub mod containers {
-            #![allow(clippy::return_self_not_must_use)]
-            tonic::include_proto!("oak.containers");
+            pub mod v1 {
+                #![allow(clippy::return_self_not_must_use)]
+                tonic::include_proto!("oak.containers.v1");
+            }
         }
         pub use oak_attestation::proto::oak::{attestation, session};
         pub use oak_crypto::proto::oak::crypto;

diff --git a/proto/containers/BUILD b/proto/containers/BUILD
@@ -16,17 +16,52 @@
 
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
 load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
+load("@com_github_grpc_grpc//bazel:python_rules.bzl", "py_grpc_library", "py_proto_library")
 
 package(
     default_visibility = ["//visibility:public"],
     licenses = ["notice"],
 )
 
 proto_library(
-    name = "orchestrator_crypto_proto",
-    srcs = ["orchestrator_crypto.proto"],
+    name = "common_proto",
+    srcs = ["common.proto"],
+)
+
+proto_library(
+    name = "application_interfaces_proto",
+    srcs = ["application_interfaces.proto"],
     deps = [
         "//oak_crypto/proto/v1:crypto_proto",
+        "//oak_remote_attestation/proto/v1:messages_proto",
+        "@com_google_protobuf//:empty_proto",
+        ":common_proto"
+    ],
+)
+
+cc_proto_library(
+    name = "application_interfaces_cc_proto",
+    deps = [":application_interfaces_proto"],
+)
+
+
+py_proto_library(
+    name = "application_interfaces_py_proto",
+    deps = [":application_interfaces_proto"],
+)
+
+py_grpc_library(
+    name = "application_interfaces_py_grpc",
+    srcs = [":application_interfaces_proto"],
+    deps = [":application_interfaces_py_proto"],
+)
+
+proto_library(
+    name = "launcher_proto",
+    srcs = ["launcher.proto"],
+    deps = [
+        ":common_proto",
     ],
 )
 
@@ -42,6 +77,7 @@ build_test(
     name = "build_test",
     targets = [
         ":hostlib_key_provisioning_proto",
-        ":orchestrator_crypto_proto",
+        ":application_interfaces_proto",
+        ":launcher_proto"
     ],
 )
diff --git a/proto/containers/orchestrator_crypto.proto → ...o/containers/application_interfaces.proto b/proto/containers/orchestrator_crypto.proto → ...o/containers/application_interfaces.proto
@@ -14,11 +14,27 @@
 // limitations under the License.
 //
 
+// Interfaces that may be invoked by the application
+
 syntax = "proto3";
 
 package oak.containers.v1;
 
 import "oak_crypto/proto/v1/crypto.proto";
+import "google/protobuf/empty.proto";
+import "proto/containers/common.proto";
+
+// Defines the service exposed by the orchestrator, that can be invoked by the application.
+service Orchestrator {
+  // Exposes the previously loaded trusted application config to the application,
+  // which may choose to retrieve it.
+  rpc GetApplicationConfig(google.protobuf.Empty) returns (GetApplicationConfigResponse) {}
+
+  // Notifies the orchestrator that the trusted app is ready to serve requests and listening on the
+  // pre-arranged port (8080).
+  rpc NotifyAppReady(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+}
+
 
 // Choice between a key generated by the enclave instance and the key distributed to the enclave
 // group with Key Provisioning.

diff --git a/oak_containers_syslogd/build.rs → proto/containers/common.proto b/oak_containers_syslogd/build.rs → proto/containers/common.proto
@@ -14,19 +14,12 @@
 // limitations under the License.
 //
 
-use oak_grpc_utils::{generate_grpc_code, CodegenOptions};
+syntax = "proto3";
 
-fn main() -> Result<(), Box<dyn std::error::Error>> {
-    // Generate gRPC code for connecting to the launcher.
-    generate_grpc_code(
-        &[
-            "../oak_containers/proto/interfaces.proto",
-            "../oak_crypto/proto/v1/crypto.proto",
-            "../proto/session/messages.proto",
-        ],
-        "..",
-        CodegenOptions::default(),
-    )?;
+package oak.containers.v1;
 
-    Ok(())
+message GetApplicationConfigResponse {
+  // Arbitrary config that the container can retrieve from the orchestrator.
+  // Included in the attestation measurements conducted by the orchestrator.
+  bytes config = 1;
 }
diff --git a/oak_containers/proto/interfaces.proto → proto/containers/launcher.proto b/oak_containers/proto/interfaces.proto → proto/containers/launcher.proto
@@ -16,13 +16,13 @@
 
 syntax = "proto3";
 
-package oak.containers;
+package oak.containers.v1;
 
 import "google/protobuf/empty.proto";
-import "oak_crypto/proto/v1/crypto.proto";
-import "proto/attestation/endorsement.proto";
 import "proto/attestation/evidence.proto";
 import "proto/session/messages.proto";
+import "proto/containers/common.proto";
+
 
 // As images can be large (hundreds of megabytes), the launcher chunks up the response into smaller
 // pieces to respect proto/gRPC limits. The image needs to be reassembled in the stage1 or the
@@ -31,12 +31,6 @@ message GetImageResponse {
   bytes image_chunk = 1;
 }
 
-message GetApplicationConfigResponse {
-  // Arbitrary config that the container can retrieve from the orchestrator.
-  // Included in the attestation measurements conducted by the orchestrator.
-  bytes config = 1;
-}
-
 message SendAttestationEvidenceRequest {
   oak.session.v1.AttestationEvidence evidence = 1 [deprecated = true];
   oak.attestation.v1.Evidence dice_evidence = 2;
@@ -67,14 +61,3 @@ service Launcher {
   // pre-arranged port (8080).
   rpc NotifyAppReady(google.protobuf.Empty) returns (google.protobuf.Empty) {}
 }
-
-// Defines the service exposed by the orchestrator, that can be invoked by the application.
-service Orchestrator {
-  // Exposes the previously loaded trusted application config to the application,
-  // which may choose to retrieve it.
-  rpc GetApplicationConfig(google.protobuf.Empty) returns (GetApplicationConfigResponse) {}
-
-  // Notifies the orchestrator that the trusted app is ready to serve requests and listening on the
-  // pre-arranged port (8080).
-  rpc NotifyAppReady(google.protobuf.Empty) returns (google.protobuf.Empty) {}
-}