Sign EIFs separately

src/common/commands_parser.rs

@@ -259,6 +259,32 @@ impl PcrArgs {
     }
 }
 
+/// The arguments used by `sign-eif` command
+#[derive(Debug, Clone)]
+pub struct SignEifArgs {
+    /// Path to the EIF file needed for signing
+    pub eif_path: String,
+    /// The path to the signing certificate for signed enclaves.
+    pub signing_certificate: Option<String>,
+    /// ARN of the KMS key or path to the local private key for signed enclaves.
+    pub private_key: Option<String>,
+}
+
+impl SignEifArgs {
+    /// Construct a new `SignEifArgs` instance from the given command-line arguments.
+    pub fn new_with(args: &ArgMatches) -> NitroCliResult<Self> {
+        let signing_certificate = parse_signing_certificate(args);
+        let private_key = parse_private_key(args);
+
+        Ok(SignEifArgs {
+            eif_path: parse_eif_path(args)
+                .map_err(|e| e.add_subaction("Parse EIF path".to_string()))?,
+            signing_certificate,
+            private_key,
+        })
+    }
+}
+
 /// Parse file path to hash from the command-line arguments.
 fn parse_file_path(args: &ArgMatches, val_name: &str) -> NitroCliResult<String> {
     let path = args.get_one::<String>(val_name).ok_or_else(|| {

src/common/document_errors.rs

@@ -68,6 +68,7 @@ lazy_static! {
             (NitroCliErrorEnum::HasherError, "E57"),
             (NitroCliErrorEnum::EnclaveNamingError, "E58"),
             (NitroCliErrorEnum::EIFSignatureCheckerError, "E59"),
+            (NitroCliErrorEnum::EIFSigningError, "E60"),
         ].iter().cloned().collect();
 }
 
@@ -333,6 +334,9 @@ pub fn get_detailed_info(error_code_str: String, additional_info: &[String]) ->
         "E59" => {
             ret.push_str("EIF signature checker error. Such error appears when validation of the signing certificate fails.");
         }
+        "E60" => {
+            ret.push_str("Signing error. Such error appears if incorrect key or certificate paths are provided, or when AWS credenrials need to be refreshed to use a KMS key.");
+        }
         _ => {
             ret.push_str(format!("No such error code {}", error_code_str).as_str());
         }
@@ -543,6 +547,9 @@ pub fn explain_error(error_code_str: String) {
         "E56" => {
             eprintln!("Logger error. Such error appears when attempting to initialize the underlying logging system fails.");
         }
+        "E60" => {
+            eprintln!("Signing error. Such error appears if incorrect key or certificate paths are provided, or when AWS credenrials need to be refreshed to use a KMS key.");
+        }
         _ => {
             eprintln!("No such error code {}", error_code_str);
         }

src/common/mod.rs

@@ -179,6 +179,8 @@ pub enum NitroCliErrorEnum {
     EnclaveNamingError,
     /// Signature checker error
     EIFSignatureCheckerError,
+    /// Signing error
+    EIFSigningError,
 }
 
 impl Eq for NitroCliErrorEnum {}

src/lib.rs

@@ -17,6 +17,8 @@ pub mod utils;
 
 use aws_nitro_enclaves_image_format::defs::eif_hasher::EifHasher;
 use aws_nitro_enclaves_image_format::utils::eif_reader::EifReader;
+use aws_nitro_enclaves_image_format::utils::eif_signer::EifSigner;
+use aws_nitro_enclaves_image_format::utils::SignKeyData;
 use aws_nitro_enclaves_image_format::{generate_build_info, utils::get_pcrs};
 use log::{debug, info};
 use sha2::{Digest, Sha384};
@@ -25,9 +27,9 @@ use std::convert::TryFrom;
 use std::fs::{File, OpenOptions};
 use std::io::{self, Read, Write};
 use std::os::unix::net::UnixStream;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
-use common::commands_parser::{BuildEnclavesArgs, EmptyArgs, RunEnclavesArgs};
+use common::commands_parser::{BuildEnclavesArgs, EmptyArgs, RunEnclavesArgs, SignEifArgs};
 use common::json_output::{
     EifDescribeInfo, EnclaveBuildInfo, EnclaveTerminateInfo, MetadataDescribeInfo,
 };
@@ -292,6 +294,62 @@ pub fn describe_eif(eif_path: String) -> NitroCliResult<EifDescribeInfo> {
     Ok(info)
 }
 
+/// Signs EIF with the given key and certificate. If EIF already has a signature, it will be replaced.
+pub fn sign_eif(args: SignEifArgs) -> NitroCliResult<()> {
+    let sign_info = match (&args.private_key, &args.signing_certificate) {
+        (Some(key), Some(cert)) => SignKeyData::new(key, Path::new(&cert)).map_or_else(
+            |e| {
+                eprintln!("Could not read signing info: {:?}", e);
+                None
+            },
+            Some,
+        ),
+        _ => None,
+    };
+
+    let signer = EifSigner::new(sign_info).ok_or_else(|| {
+        new_nitro_cli_failure!(
+            format!("Failed to create EifSigner"),
+            NitroCliErrorEnum::EIFSigningError
+        )
+    })?;
+
+    signer.sign_image(&args.eif_path).map_err(|e| {
+        new_nitro_cli_failure!(
+            format!("Failed to sign image: {}", e),
+            NitroCliErrorEnum::EIFSigningError
+        )
+    })?;
+
+    eprintln!("Enclave Image successfully signed.");
+
+    let mut eif_reader = EifReader::from_eif(args.eif_path).map_err(|e| {
+        new_nitro_cli_failure!(
+            &format!("Failed to initialize EIF reader: {:?}", e),
+            NitroCliErrorEnum::EifParsingError
+        )
+    })?;
+    eif_reader
+        .get_measurements()
+        .map_err(|e| {
+            new_nitro_cli_failure!(
+                &format!("Failed to get PCR values: {:?}", e),
+                NitroCliErrorEnum::EifParsingError
+            )
+        })
+        .and_then(|measurements| {
+            let info = EnclaveBuildInfo::new(measurements);
+            let printed_info = serde_json::to_string_pretty(&info).map_err(|err| {
+                new_nitro_cli_failure!(
+                    &format!("Failed to display EnclaveBuild data: {:?}", err),
+                    NitroCliErrorEnum::SerdeError
+                )
+            })?;
+            println!("{}", printed_info);
+            Ok(())
+        })
+}
+
 /// Returns the value of the `NITRO_CLI_BLOBS` environment variable.
 ///
 /// This variable specifies where all the blobs necessary for building
@@ -803,5 +861,26 @@ macro_rules! create_app {
                             .required(true),
                     ),
             )
+            .subcommand(
+                Command::new("sign-eif")
+                    .about("Sign EIF with the given key")
+                    .arg(
+                        Arg::new("eif-path")
+                            .long("eif-path")
+                            .help("Path pointing to a prebuilt Eif image")
+                    )
+                    .arg(
+                        Arg::new("signing-certificate")
+                            .long("signing-certificate")
+                            .help("Local path to developer's X509 signing certificate.")
+                            .requires("private-key"),
+                    )
+                    .arg(
+                        Arg::new("private-key")
+                            .long("private-key")
+                            .help("KMS key ARN or local path to developer's Eliptic Curve private key.")
+                            .requires("signing-certificate"),
+                    )
+            )
     };
 }

src/main.rs

@@ -14,7 +14,7 @@ use std::os::unix::net::UnixStream;
 
 use nitro_cli::common::commands_parser::{
     BuildEnclavesArgs, ConsoleArgs, DescribeEnclavesArgs, EmptyArgs, ExplainArgs, PcrArgs,
-    RunEnclavesArgs, TerminateEnclavesArgs,
+    RunEnclavesArgs, SignEifArgs, TerminateEnclavesArgs,
 };
 use nitro_cli::common::document_errors::explain_error;
 use nitro_cli::common::json_output::{EnclaveDescribeInfo, EnclaveRunInfo, EnclaveTerminateInfo};
@@ -29,7 +29,7 @@ use nitro_cli::enclave_proc_comm::{
 };
 use nitro_cli::{
     build_enclaves, console_enclaves, create_app, describe_eif, get_all_enclave_names,
-    get_file_pcr, new_enclave_name, new_nitro_cli_failure, terminate_all_enclaves,
+    get_file_pcr, new_enclave_name, new_nitro_cli_failure, sign_eif, terminate_all_enclaves,
 };
 
 const RUN_ENCLAVE_STR: &str = "Run Enclave";
@@ -42,6 +42,7 @@ const ENCLAVE_CONSOLE_STR: &str = "Enclave Console";
 const EXPLAIN_ERR_STR: &str = "Explain Error";
 const NEW_NAME_STR: &str = "New Enclave Name";
 const FILE_PCR_STR: &str = "File PCR";
+const SIGN_EIF_STR: &str = "Sign EIF";
 
 /// *Nitro CLI* application entry point.
 fn main() {
@@ -301,6 +302,20 @@ fn main() {
                 .ok_or_exit_with_errno(None);
             explain_error(explain_args.error_code_str);
         }
+        Some(("sign-eif", args)) => {
+            let sign_args = SignEifArgs::new_with(args)
+                .map_err(|e| {
+                    e.add_subaction("Failed to construct SignEIF arguments".to_string())
+                        .set_action(SIGN_EIF_STR.to_string())
+                })
+                .ok_or_exit_with_errno(None);
+            sign_eif(sign_args)
+                .map_err(|e| {
+                    e.add_subaction("Failed to sign EIF".to_string())
+                        .set_action(SIGN_EIF_STR.to_string())
+                })
+                .ok_or_exit_with_errno(None);
+        }
         Some((&_, _)) | None => (),
     }
 }

tests/test_nitro_cli_args.rs

@@ -337,6 +337,53 @@ mod test_nitro_cli_args {
         assert!(app.try_get_matches_from(args).is_err())
     }
 
+    #[test]
+    fn sign_enclave_correct_command() {
+        let app = create_app!();
+        let args = vec![
+            "nitro cli",
+            "sign-eif",
+            "--eif-path",
+            "image.eif",
+            "--signing-certificate",
+            "cert.pem",
+            "--private-key",
+            "key.pem",
+        ];
+
+        assert!(app.try_get_matches_from(args).is_ok())
+    }
+
+    #[test]
+    fn sign_enclave_missing_certificate() {
+        let app = create_app!();
+        let args = vec![
+            "nitro cli",
+            "sign-eif",
+            "--eif-path",
+            "image.eif",
+            "--private-key",
+            "key.pem",
+        ];
+
+        assert!(app.try_get_matches_from(args).is_err())
+    }
+
+    #[test]
+    fn sign_enclave_missing_key() {
+        let app = create_app!();
+        let args = vec![
+            "nitro cli",
+            "sign-eif",
+            "--eif-path",
+            "image.eif",
+            "--signing-certificate",
+            "cert.pem",
+        ];
+
+        assert!(app.try_get_matches_from(args).is_err())
+    }
+
     #[test]
     fn build_enclave_with_metadata_correct_command() {
         let app = create_app!();