Skip to main content

Verify Enclave Integrity

Enclave verification involves two separate checks:

  1. Base Image Verification (PCR0, PCR1, PCR2): Confirms the enclave uses the official Oyster blue base image
  2. Application Verification (PCR16/imageId): Confirms the exact application code running in the enclave

Verify Base Image (PCR0, PCR1, PCR2)​

Rebuild the Oyster base image from source and compare PCR values to confirm you're running the canonical blue base image.

# Launch Nix environment in Docker (no local installation needed)
docker run -it nixos/nix bash

# Inside the container, clone and build the Oyster base image
git clone https://github.com/marlinprotocol/oyster-monorepo.git
cd oyster-monorepo && git checkout base-blue-v3.0.0

# Build the enclave image reproducibly
nix build -vL \
  --extra-experimental-features nix-command \
  --extra-experimental-features flakes \
  --accept-flake-config \
  .#default.enclaves.blue.default

# View PCR values from the reproducible build
cat result/pcr.json

Compare the PCR0, PCR1, and PCR2 values in result/pcr.json with those from oyster-cvm verify --enclave-ip $PUBLIC_IP.

Verify Application Code (PCR16/imageId)​

Rebuild the application Docker image and verify it matches the deployed enclave.

Step 1: Build the Docker image reproducibly

# Pick implementation + architecture
./nix.sh build-rust-arm64    # or build-rust-amd64
./nix.sh build-node-arm64    # or build-node-amd64
./nix.sh build-python-arm64  # or build-python-amd64

# Load the image into Docker (example for Rust/arm64)
docker load < ./rust-arm64-image.tar.gz

# Get the image digest
docker images --digests --format '{{.Digest}}' sui-price-oracle:rust-reproducible-arm64

Step 2: Verify the image hash matches docker-compose.yml

The digest from the previous step should match the hash specified in enclave_rust/docker-compose.yml (or enclave_node/docker-compose.yml, enclave_python/docker-compose.yml for other implementations). This confirms the image was built from the source code in the repository.

note

Builds are reproducible for both arm64 and amd64. Use the artifact that matches your deployment architecture.

Step 3: Compute and compare imageId

# Calculate the expected imageId from docker-compose.yml
oyster-cvm compute-image-id --docker-compose ./enclave_rust/docker-compose.yml

# Compare with the imageId from the running enclave
oyster-cvm verify --enclave-ip $PUBLIC_IP

If both imageId values match, you have cryptographic proof that the deployed enclave is running the exact code you inspected and built locally.