Merge branch 'securefederatedai:develop' into straggler_handling_update

.github/dependabot.yml

@@ -18,9 +18,3 @@ updates:
       interval: "daily"
     ignore:
       - dependency-name: "*"
-  - package-ecosystem: pip
-    directory: /openfl-tutorials/interactive_api
-    schedule:
-      interval: "daily"
-    ignore:
-      - dependency-name: "*"

.github/workflows/task_runner_e2e.yml

@@ -1,3 +1,4 @@
+---
 #---------------------------------------------------------------------------
 # Workflow to run Task Runner end to end tests
 # Authors - Noopur, Payal Chaurasiya
@@ -6,16 +7,16 @@ name: Task Runner E2E
 
 on:
   schedule:
-    - cron: '0 0 * * *' # Run every day at midnight
+    - cron: "0 0 * * *" # Run every day at midnight
   workflow_dispatch:
     inputs:
       num_rounds:
-        description: 'Number of rounds to train'
+        description: "Number of rounds to train"
         required: false
         default: "5"
         type: string
       num_collaborators:
-        description: 'Number of collaborators'
+        description: "Number of collaborators"
         required: false
         default: "2"
         type: string
@@ -29,67 +30,132 @@ env:
   NUM_COLLABORATORS: ${{ inputs.num_collaborators || '2' }}
 
 jobs:
-  test_run:
-    name: test
+  test:
+    name: tr_tls
     runs-on: ubuntu-22.04
     timeout-minutes: 120 # 2 hours
     strategy:
       matrix:
         # There are open issues for some of the models, so excluding them for now:
         # model_name: [ "torch_cnn_mnist", "keras_cnn_mnist", "torch_cnn_histology" ]
-        model_name: [ "torch_cnn_mnist", "keras_cnn_mnist" ]
-        python_version: [ "3.8", "3.9", "3.10" ]
+        model_name: ["torch_cnn_mnist", "keras_cnn_mnist"]
+        python_version: ["3.8", "3.9", "3.10"]
       fail-fast: false # do not immediately fail if one of the combinations fail
 
     env:
       MODEL_NAME: ${{ matrix.model_name }}
       PYTHON_VERSION: ${{ matrix.python_version }}
 
     steps:
-    - name: Checkout OpenFL repository
-      id: checkout_openfl
-      uses: actions/[email protected]
-      with:
-        fetch-depth: 2 # needed for detecting changes
-        submodules: "true"
-        token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Set up Python
-      id: setup_python
-      uses: actions/setup-python@v3
-      with:
-        python-version: ${{ env.PYTHON_VERSION }}
-
-    - name: Install dependencies
-      id: install_dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install .
-        pip install -r test-requirements.txt
-
-    - name: Run Task Runner E2E tests
-      id: run_task_runner_tests
-      run: |
-        python -m pytest -s tests/end_to_end/test_suites/task_runner_tests.py -m ${{ env.MODEL_NAME }} --num_rounds $NUM_ROUNDS --num_collaborators $NUM_COLLABORATORS --model_name ${{ env.MODEL_NAME }}
-        echo "Task runner end to end test run completed"
-
-    - name: Print test summary # Print the test summary only if the tests were run
-      id: print_test_summary
-      if: steps.run_task_runner_tests.outcome == 'success' || steps.run_task_runner_tests.outcome == 'failure'
-      run: |
-        export PYTHONPATH="$PYTHONPATH:."
-        python tests/end_to_end/utils/xml_helper.py
-        echo "Test summary printed"
-
-    - name: Tar files # Tar the test results only if the tests were run
-      id: tar_files
-      if: steps.run_task_runner_tests.outcome == 'success' || steps.run_task_runner_tests.outcome == 'failure'
-      run: tar -cvf result.tar results
-
-    - name: Upload Artifacts # Upload the test results only if the tar was created
-      id: upload_artifacts
-      uses: actions/upload-artifact@v4
-      if: steps.tar_files.outcome == 'success'
-      with:
-        name: task_runner_${{ env.MODEL_NAME }}_python${{ env.PYTHON_VERSION }}_${{ github.run_id }}
-        path: result.tar
+      - name: Checkout OpenFL repository
+        id: checkout_openfl
+        uses: actions/[email protected]
+        with:
+          fetch-depth: 2 # needed for detecting changes
+          submodules: "true"
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        id: setup_python
+        uses: actions/setup-python@v3
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        id: install_dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+          pip install -r test-requirements.txt
+
+      - name: Run Task Runner E2E tests with TLS
+        id: run_tests
+        run: |
+          python -m pytest -s tests/end_to_end/test_suites/task_runner_tests.py -m ${{ env.MODEL_NAME }} --num_rounds $NUM_ROUNDS --num_collaborators $NUM_COLLABORATORS --model_name ${{ env.MODEL_NAME }}
+          echo "Task runner end to end test run completed"
+
+      - name: Print test summary # Print the test summary only if the tests were run
+        id: print_test_summary
+        if: steps.run_tests.outcome == 'success' || steps.run_tests.outcome == 'failure'
+        run: |
+          export PYTHONPATH="$PYTHONPATH:."
+          python tests/end_to_end/utils/summary_helper.py
+          echo "Test summary printed"
+
+      - name: Tar files # Tar the test results only if the tests were run
+        id: tar_files
+        if: steps.run_tests.outcome == 'success' || steps.run_tests.outcome == 'failure'
+        run: tar -cvf result.tar results
+
+      - name: Upload Artifacts # Upload the test results only if the tar was created
+        id: upload_artifacts
+        uses: actions/upload-artifact@v4
+        if: steps.tar_files.outcome == 'success'
+        with:
+          name: task_runner_tls_${{ env.MODEL_NAME }}_python${{ env.PYTHON_VERSION }}_${{ github.run_id }}
+          path: result.tar
+
+  test_with_non_tls:
+    name: tr_non_tls
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120 # 2 hours
+    strategy:
+      matrix:
+        # Testing non TLS scenario only for torch_cnn_mnist model and python 3.10
+        # If required, this can be extended to other models and python versions
+        model_name: ["torch_cnn_mnist"]
+        python_version: ["3.10"]
+      fail-fast: false # do not immediately fail if one of the combinations fail
+
+    env:
+      MODEL_NAME: ${{ matrix.model_name }}
+      PYTHON_VERSION: ${{ matrix.python_version }}
+
+    steps:
+      - name: Checkout OpenFL repository
+        id: checkout_openfl
+        uses: actions/[email protected]
+        with:
+          fetch-depth: 2 # needed for detecting changes
+          submodules: "true"
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        id: setup_python
+        uses: actions/setup-python@v3
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        id: install_dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+          pip install -r test-requirements.txt
+
+      - name: Run Task Runner E2E tests without TLS
+        id: run_tests
+        run: |
+          python -m pytest -s tests/end_to_end/test_suites/task_runner_tests.py -m ${{ env.MODEL_NAME }} --num_rounds $NUM_ROUNDS --num_collaborators $NUM_COLLABORATORS --disable_tls
+          echo "Task runner end to end test run completed"
+
+      - name: Print test summary # Print the test summary only if the tests were run
+        id: print_test_summary
+        if: steps.run_tests.outcome == 'success' || steps.run_tests.outcome == 'failure'
+        run: |
+          export PYTHONPATH="$PYTHONPATH:."
+          python tests/end_to_end/utils/summary_helper.py
+          echo "Test summary printed"
+
+      - name: Tar files # Tar the test results only if the tests were run
+        id: tar_files
+        if: steps.run_tests.outcome == 'success' || steps.run_tests.outcome == 'failure'
+        run: tar -cvf result.tar results
+
+      - name: Upload Artifacts # Upload the test results only if the tar was created
+        id: upload_artifacts
+        uses: actions/upload-artifact@v4
+        if: steps.tar_files.outcome == 'success'
+        with:
+          name: task_runner_non_tls_${{ env.MODEL_NAME }}_python${{ env.PYTHON_VERSION }}_${{ github.run_id }}
+          path: result.tar

.github/workflows/tr_docker_gramine_direct.yml

@@ -0,0 +1,97 @@
+# Tests an FL experiment in a Dockerized environment.
+name: TaskRunner (docker/gramine-direct)
+
+on:
+  pull_request:
+    branches: [ develop ]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v3
+      with:
+        python-version: "3.8"
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install .
+
+    - name: Create workspace image
+      run: |
+        fx workspace create --prefix example_workspace --template keras_cnn_mnist
+        cd example_workspace
+        fx plan initialize -a localhost
+        fx workspace dockerize --save --revision https://github.com/${GITHUB_REPOSITORY}.git@${{ github.event.pull_request.head.sha }}
+
+    - name: Create certificate authority for workspace
+      run: |
+        cd example_workspace
+        fx workspace certify
+
+    - name: Create signed cert for collaborator
+      run: |
+        cd example_workspace
+        fx collaborator create -d 1 -n charlie --silent
+        fx collaborator generate-cert-request -n charlie --silent
+        fx collaborator certify --request-pkg col_charlie_to_agg_cert_request.zip --silent
+        
+        # Pack the collaborator's private key, signed cert, and data.yaml into a tarball
+        tarfiles="plan/data.yaml agg_to_col_charlie_signed_cert.zip"
+        for entry in cert/client/*; do
+            if [[ "$entry" == *.key ]]; then
+                tarfiles="$tarfiles $entry"
+            fi
+        done
+
+        tar -cf cert_col_charlie.tar $tarfiles
+
+        # Clean up
+        rm -f $tarfiles
+        rm -f col_charlie_to_agg_cert_request.zip
+
+    - name: Create signed cert for aggregator
+      run: |
+        cd example_workspace
+        fx aggregator generate-cert-request --fqdn localhost
+        fx aggregator certify --fqdn localhost --silent
+
+        # Pack all files that aggregator needs to start training
+        tar -cf cert_agg.tar plan cert save
+
+        # Remove the directories after archiving
+        rm -rf plan cert save
+
+    - name: Load workspace image
+      run: |
+        cd example_workspace
+        docker load -i example_workspace.tar
+
+    - name: Run aggregator and collaborator
+      run: |
+        cd example_workspace
+
+        set -x
+        docker run --rm \
+          --network host \
+          --security-opt seccomp=unconfined \
+          --mount type=bind,source=./cert_agg.tar,target=/certs.tar \
+          --env KERAS_HOME=/tmp \
+          example_workspace bash -c "tar -xf /certs.tar && gramine-direct fx aggregator start" &
+
+        # TODO: Run with two collaborators instead.
+        docker run --rm \
+          --network host \
+          --security-opt seccomp=unconfined \
+          --mount type=bind,source=./cert_col_charlie.tar,target=/certs.tar \
+          --env KERAS_HOME=/tmp \
+          example_workspace bash -c "tar -xf /certs.tar && fx collaborator certify --import agg_to_col_charlie_signed_cert.zip && gramine-direct fx collaborator start -n charlie"

.github/workflows/dockerization.yml → .github/workflows/tr_docker_native.yml

@@ -1,5 +1,5 @@
 # Tests an FL experiment in a Dockerized environment.
-name: Dockerization
+name: TaskRunner (docker/native)
 
 on:
   pull_request:

.github/workflows/trivy.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+      actions: read #  only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     name: Build
     runs-on: ubuntu-22.04
     steps:
@@ -23,11 +23,13 @@ jobs:
           docker build --pull -t docker.io/securefederatedai/openfl:${{ github.sha }} -f openfl-docker/Dockerfile.base .
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: 'docker.io/securefederatedai/openfl:${{ github.sha }}'
           format: 'sarif'
           output: 'trivy-results.sarif'
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db'
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v2
@@ -56,7 +58,7 @@ jobs:
           path: trivy-code-results.json
 
       - name: Run Trivy vulnerability scanner for Docker image (JSON Output)
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: 'docker.io/securefederatedai/openfl:${{ github.sha }}'
           format: 'json'
@@ -65,6 +67,8 @@ jobs:
           ignore-unfixed: true
           vuln-type: 'os,library'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db'
 
       - name: Upload Docker Vulnerability Scan
         uses: actions/upload-artifact@v3
@@ -90,7 +94,7 @@ jobs:
           path: trivy-code-spdx-results.json
 
       - name: Run Trivy vulnerability scanner for Docker image (SPDX-JSON Output)
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: 'docker.io/securefederatedai/openfl:${{ github.sha }}'
           format: 'spdx-json'
@@ -99,6 +103,8 @@ jobs:
           ignore-unfixed: true
           vuln-type: 'os,library'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db'
 
       - name: Upload Docker Vulnerability Scan
         uses: actions/upload-artifact@v3