Add support for Azure Cleanroom based CCF

scripts/ccf/az-cleanroom-aci/down.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+az-cleanroom-aci-down() {
+    set -e
+
+    # REPO_ROOT="$(realpath "$(dirname "$(realpath "${BASH_SOURCE[0]}")")/../../..")"
+    # docker compose -f $REPO_ROOT/services/docker-compose.yml down ccf-sandbox --remove-orphans
+
+    unset KMS_URL
+    unset KMS_SERVICE_CERT_PATH
+    unset KMS_MEMBER_CERT_PATH
+    unset KMS_MEMBER_PRIVK_PATH
+
+    set +e
+}
+
+az-cleanroom-aci-down

scripts/ccf/az-cleanroom-aci/setup.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+az-cleanroom-aci-setup() {
+    az extension add -y --allow-preview true \
+    --source https://cleanroomazcli.blob.core.windows.net/azcli/cleanroom-0.0.7-py2.py3-none-any.whl
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    az-cleanroom-aci-setup "$@"
+fi

scripts/ccf/az-cleanroom-aci/up.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+THIS_DIR="$(realpath "$(dirname "$(realpath "${BASH_SOURCE[0]}")")")"
+REPO_ROOT="$(realpath "$THIS_DIR/../../..")"
+
+az-cleanroom-aci-up() {
+    set -e
+
+    source $REPO_ROOT/services/cacitesting.env
+    DEPLOYMENT_NAME=${DEPLOYMENT_NAME:-$1}
+    az cleanroom ccf network up \
+        --subscription $SUBSCRIPTION \
+        --resource-group $RESOURCE_GROUP \
+        --name $DEPLOYMENT_NAME
+
+    export WORKSPACE=~/$DEPLOYMENT_NAME.ccfworkspace
+    export KMS_URL=$( \
+        az cleanroom ccf network show \
+            --name ${DEPLOYMENT_NAME} \
+            --provider-config $WORKSPACE/providerConfig.json \
+            | jq -r '.endpoint' \
+    )
+
+    export KMS_SERVICE_CERT_PATH="$WORKSPACE/service_cert.pem"
+    export KMS_MEMBER_CERT_PATH="$WORKSPACE/ccf-operator_cert.pem"
+    export KMS_MEMBER_PRIVK_PATH="$WORKSPACE/ccf-operator_privk.pem"
+
+    sudo cp $KMS_SERVICE_CERT_PATH /usr/local/share/ca-certificates/kms_ca.crt
+    sudo update-ca-certificates
+
+    set +e
+}
+
+source $THIS_DIR/setup.sh
+az-cleanroom-aci-setup
+az-cleanroom-aci-up "$@"
+
+jq -n '{
+    WORKSPACE: env.WORKSPACE,
+    KMS_URL: env.KMS_URL,
+    KMS_SERVICE_CERT_PATH: env.KMS_SERVICE_CERT_PATH,
+    KMS_MEMBER_CERT_PATH: env.KMS_MEMBER_CERT_PATH,
+    KMS_MEMBER_PRIVK_PATH: env.KMS_MEMBER_PRIVK_PATH
+}'

scripts/ccf/propose.sh

@@ -16,7 +16,7 @@ ccf-propose() {
         --signing-key ${KMS_MEMBER_PRIVK_PATH} \
         --ccf-gov-msg-type proposal \
         --ccf-gov-msg-created_at $(date -Is) \
-            | curl $KMS_URL/gov/proposals -k -H "Content-Type: application/cose" \
+            | curl -k $KMS_URL/gov/proposals -k -H "Content-Type: application/cose" \
             --data-binary @- \
             -s \
             --cacert $KMS_SERVICE_CERT_PATH -w '\n' \

scripts/kms/endpoints/heartbeat.sh

@@ -4,7 +4,7 @@
 # Licensed under the MIT license.
 
 heartbeat() {
-    curl $KMS_URL/app/heartbeat \
+    curl -k $KMS_URL/app/heartbeat \
         --cacert $KMS_SERVICE_CERT_PATH \
         -w '\n%{http_code}\n'
 }

scripts/kms/endpoints/key.sh

@@ -52,7 +52,7 @@ key() {
         auth_arg=(-H "Authorization: Bearer $(curl -X POST $JWT_ISSUER | jq -r '.access_token')")
     fi
 
-    curl $KMS_URL/app/key${query_string} \
+    curl -k $KMS_URL/app/key${query_string} \
         -X POST \
         --cacert $KMS_SERVICE_CERT_PATH \
         "${auth_arg[@]}" \

scripts/kms/endpoints/keyReleasePolicy.sh

@@ -4,7 +4,7 @@
 # Licensed under the MIT license.
 
 keyReleasePolicy() {
-    curl $KMS_URL/app/keyReleasePolicy \
+    curl -k $KMS_URL/app/keyReleasePolicy \
         --cacert $KMS_SERVICE_CERT_PATH \
         --cert $KMS_MEMBER_CERT_PATH \
         --key $KMS_MEMBER_PRIVK_PATH \

scripts/kms/endpoints/listpubkeys.sh

@@ -4,7 +4,7 @@
 # Licensed under the MIT license.
 
 listpubkeys() {
-    curl $KMS_URL/app/listpubkeys \
+    curl -k $KMS_URL/app/listpubkeys \
         --cacert $KMS_SERVICE_CERT_PATH \
         -w '\n%{http_code}\n'
 }

scripts/kms/endpoints/pubkey.sh

@@ -30,7 +30,7 @@ pubkey() {
         query_string="?"$(IFS='&'; echo "${params[*]}")
     fi
 
-    curl $KMS_URL/app/pubkey${query_string} \
+    curl -k $KMS_URL/app/pubkey${query_string} \
         --cacert $KMS_SERVICE_CERT_PATH \
         --cert $KMS_MEMBER_CERT_PATH \
         --key $KMS_MEMBER_PRIVK_PATH \

scripts/kms/endpoints/refresh.sh

@@ -4,7 +4,7 @@
 # Licensed under the MIT license.
 
 refresh() {
-    curl $KMS_URL/app/refresh \
+    curl -k $KMS_URL/app/refresh \
         -X POST \
         --cacert $KMS_SERVICE_CERT_PATH \
         -w '\n%{http_code}\n'

test/system-test/conftest.py

@@ -3,6 +3,8 @@
 import subprocess
 import pytest
 from utils import deploy_app_code
+import string
+import random
 
 REPO_ROOT = os.path.realpath(os.path.join(os.path.dirname(__file__), "..", ".."))
 TEST_ENVIRONMENT = os.getenv("TEST_ENVIRONMENT", "ccf/sandbox-local")
@@ -11,13 +13,19 @@
 @pytest.fixture()
 def setup_kms():
 
+    os.environ["DEPLOYMENT_NAME"] = os.getenv(
+        "DEPLOYMENT_NAME",
+        f"kms-{''.join(random.choices(string.ascii_letters + string.digits, k=8))}"
+    )
+
     # Setup the CCF backend and set the environment accordingly
-    setup_vars = json.loads(subprocess.run(
+    res = subprocess.run(
             f"scripts/{TEST_ENVIRONMENT}/up.sh",
             cwd=REPO_ROOT,
             check=True,
             stdout=subprocess.PIPE,
-        ).stdout.decode())
+        ).stdout.decode()
+    setup_vars = json.loads(res[res.rfind("{"):])
     os.environ.update(setup_vars)
 
     subprocess.run(