github.com/edgelesssys/marblerun

What's Changed

Additions

• cli: allow users to use a custom nonce for SGX quote verification using --nonce flag by @daniel-weisse in #644

• cli: add --save-sgx-quote flag to save a Coordinator's SGX quote to disk by @daniel-weisse in #647

• Add a public Go API by @daniel-weisse in #658

  • Offers functions to interact with the Coordinator Client API, and implements the same functionality as the CLI
  • documentation: https://pkg.go.dev/github.com/edgelesssys/marblerun/api

• coordinator: Add client API v2, which offers the same endpoints as the previous client API with an updated format by @daniel-weisse in #661

  • API v1 is still available and functional in the Coordinator, but should be considered deprecated
  • The CLI and Go API will default to using the v2 API, falling back to v1 if unavailable
  • API reference is available at https://docs.edgeless.systems/marblerun/reference/coordinator

• coordinator: add a new client API endpoint, /api/v2/sign-quote, to verify and sign SGX quotes by @daniel-weisse in #659

  • Requires setting the new manifest option .Config.FeatureGates to ["SignQuoteEndpoint"] to enable

• cli: allow setting multiple DNS names or IPs using --domain flag in marblerun install by @daniel-weisse in #674

• coordinator: add manifest option to seal with unique key or disable sealing by @thomasten in #677

  • controlled by setting the new manifest option .Config.SealMode:
    • ProductKey: Sealing uses the product key. This is the default if not set.
    • UniqueKey: Sealing uses the unique key.
    • Disabled: If set, the Coordinator won't persist state. This can be useful for ephemeral deployments.

Full Changelog: v1.4.1...v1.5.0

What's Changed

Security

This release includes a critical security fix and a security feature improvement.
Please read this changelog carefully and check whether you're affected.
If you're affected, you should update as soon as possible.
If you're not affected, we still recommend updating for the case that you might be affected in the future by changing the manifest.

• Fixed a critical issue with TTLS. See GHSA-x5r5-2qrx-rqj8 for full details.
• Added the ability to not accept TCB status SWHardeningNeeded during remote attestation
• Update SGX libraries to 2.22 (PSW) and 1.19 (DCAP)
• Updates of other dependencies

Fixes

• Fix webhook certificates always being issued for the marblerun namespace when installing with CLI (#573)

Full Changelog: v1.4.0...v1.4.1