secGear

// intall build require
sudo yum install -y cmake ocaml-dune linux-sgx-driver sgxsdk libsgx-launch libsgx-urts intel-sgx-ssl-devel

// clone secGear repository
git clone https://gitee.com/openeuler/secGear.git

// build secGear and examples
cd secGear
source /opt/intel/sgxsdk/environment && source environment
mkdir debug && cd debug && cmake .. && make && sudo make install

// run helloworld
./examples/helloworld/host/secgear_helloworld

// intall build require
sudo yum install -y cmake ocaml-dune itrustee_sdk-devel openssl-devel

// clone secGear repository
git clone https://gitee.com/openeuler/secGear.git

// build secGear and examples
cd secGear
source environment
mkdir debug && cd debug && cmake -DENCLAVE=GP .. && make && sudo make install

// run helloworld
/vendor/bin/secgear_helloworld

	enclave {
		include "secgear_urts.h"
		from "secgear_tstdc.edl" import *;
		trusted {
			public int get_string([out, size=32]char *buf);
		};
	};

    // 创建enclave
    res = cc_enclave_create(real_p, AUTO_ENCLAVE_TYPE, 0, SECGEAR_DEBUG_FLAG, NULL, 0, context);
    ...

    // 调用ecall函数，对应安全侧函数在enclave/hello.c中
    res = get_string(context, &retval, buf);
    ...

    // 销毁enclave
    res = cc_enclave_destroy(context);

	if(CC_SGX)
		set(AUTO_FILES  ${CMAKE_CURRENT_BINARY_DIR}/${PREFIX}_u.h ${CMAKE_CURRENT_BINARY_DIR}/${PREFIX}_u.c)
		add_custom_command(OUTPUT ${AUTO_FILES}
		DEPENDS ${CURRENT_ROOT_PATH}/${EDL_FILE}
		COMMAND ${CODEGEN} --${CODETYPE} --untrusted ${CURRENT_ROOT_PATH}/${EDL_FILE} --search-path ${LOCAL_ROOT_PATH}/inc/host_inc/sgx  --search-path ${SDK_PATH}/include)
	endif()

if(CC_GP)
    set(CODETYPE trustzone)
    set(UUID f68fd704-6eb1-4d14-b218-722850eb3ef0)  # f68fd704-6eb1-4d14-b218-722850eb3ef0修改为自己申请证书对应的configs.xml中的uuid
    add_definitions(-DPATH="/data/${UUID}.sec")
  endif()

;private key for signing TA
;[private key owned by yourself]
secSignKey = /home/TA_cert/private_key.pem    # 证书对应的私钥路径
;;;
;config file
;[signed config file by Huawei]
configPath = /home/TA_cert/secgear-app1/config  # config开发者证书的路径

gpd.ta.appID:   		f68fd704-6eb1-4d14-b218-722850eb3ef0
gpd.ta.service_name:		rsa-demo
gpd.ta.singleInstance:		true
gpd.ta.multiSession: 		false
gpd.ta.instanceKeepAlive:	false
gpd.ta.dataSize:		819200
gpd.ta.stackSize:		40960

        add_custom_command(TARGET ${PREFIX}
    	      POST_BUILD
	      COMMAND bash ${SIGN_TOOL} -d sign -x trustzone -i ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/lib${PREFIX}.so -c ${CMAKE_CURRENT_SOURCE_DIR}/manifest.txt -m ${CMAKE_CURRENT_SOURCE_DIR}/config_cloud.ini -o ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${OUTPUT})

          install(FILES ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${OUTPUT}  
              DESTINATION /data
              PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_READ GROUP_EXECUTE  WORLD_READ  WORLD_EXECUTE)

typedef struct {
	uint32_t num_uworkers;
	uint32_t num_tworkers;
	uint32_t switchless_calls_pool_size;
	uint32_t retries_before_fallback;
	uint32_t retries_before_sleep;
	uint32_t parameter_num;
	uint32_t workers_policy;
	uint32_t rollback_to_common;
} cc_sl_config_t;

    --features
        all-attester ： 编译所有平台的获取报告agent
        itrustee-attester ： 编译itrustee的获取报告agent
        virtcca-attester ：编译virtcca的获取报告agent

        all-verifier : 编译所有平台的报告验证service
        itrustee-verifier : 编译itrustee的报告验证service
        virtcca-verifier: 编译virtcca的报告验证service

        no_as : 不对接as服务

     cargo build --features no_as,all-attester,itrustee-verifier --lib

    #include <stdlib.h>
    #include <stdio.h>
    #include <string.h>
    #include "rust_attestation_agent.h"

    int main() {
            char *ptr = "f68fd704-6eb1-4d14-b218-722850eb3ef0";
            Vec_uint8_t uuid = {
                    .ptr = (uint8_t *)ptr,
                    .len = strlen(ptr),
                    .cap = strlen(ptr),
            };

            uint8_t nonce[16] = {1};
            Vec_uint8_t challenge = {
                    .ptr = (uint8_t *)&nonce,
                    .len = 16,
                    .cap = 16,
            };

            // 获取报告
            Vec_uint8_t report = get_report(&uuid, &challenge);
            int ret = -1;
            if (report.cap != 0) {
                // 验证报告
                ret = verify_report(&challenge, &report);
            }

            printf("ret:%d\n", ret);
            free_report(report);
            return 0;
    }

. （编译生成data_process.so二进制）
├── data_process.c
└── data_process.h

int compare_num(const int A);

static int B = 20;

int compare_num(const int A) {
    return A >= B;
}

.
├── data_process.edl
├── data_process.h
├── enclave （编译生成enclave.signed.so二进制）
│   └── sec_data_process.c  // 实现ecall_compare_num
└── host （编译生成data_process.so二进制）
    └── data_process.c  // compare_num函数调用ecall_compare_num