azure dcap driver?

[nmwael]

This is in regards to gsc

Hi looking in the config.yaml I see this place:

   - DCAP out-of-tree driver: same as above, use empty values
         Repository: ""
         Branch:     ""

Its a little unclear for me howto specify that it should use the Azure dcap:
https://github.com/microsoft/Azure-DCAP-Client

In advance thanks for helping out.

[nmwael]

looks like this could help:
https://github.com/veenasai2/gsc/tree/veenasai2/gramine-aks-attestation-new

[dimakuv]

Its a little unclear for me howto specify that it should use the Azure dcap:
https://github.com/microsoft/Azure-DCAP-Client

Azure DCAP client has nothing to do with the SGX driver.

There is a historical confusion about DCAP. There are two distinct things that have "DCAP" in its name:

• The DCAP SGX driver -- this was/is the out-of-tree Linux SGX driver, before it was merged in upstream Linux. Why it has DCAP in its name, I have no idea. Bad naming.
• The DCAP attestation (libraries, software infrastructure) -- this is what what Azure DCAP client library is. This is the software used to generate and verify DCAP-based (also called ECDSA-based) SGX quotes.

Basically, don't change these fields in config.yaml. Leave it empty.

[dimakuv]

Replying to your (implied) question: Gramine automatically uses Azure DCAP client as part of its DCAP attestation flows. You just need to install this library, see the README here: https://hub.docker.com/r/gramineproject/gramine

[nmwael]

okay I see, but does this mean I cannot use GSC? As that does not have that part supplied? Or should I install it on the intermediate unsigned image before signing?

[dimakuv]

Ah, I guess your question is: does GSC automatically install the Azure DCAP client libraries, to enable DCAP attestation?

No, GSC doesn't do it. You must prepare an intermediate Docker image (that derives from the original Docker image with the app you want to graminize and that installs all required DCAP libraries, including Azure DCAP client). And then feed this intermediate Docker image as an input to gsc build step.

So yes, if I understood your notes correctly, you're right in what you need to do.

[nmwael]

this is the answer to my question thanks..