sgx.nonpie_binary option causes failure in Gramine but passes in GSC

[anjalirai-intel]

Description of the problem

Gramine has deprecated the sgx.nonpie_binary manifest option and introduced a manifest check tool that flags any unsupported entries in the manifest file.

gramineproject/gramine@970b62f
gramineproject/gramine@f1258cc

Steps to reproduce

We updated the helloworld example to include the sgx.nonpie_binary option in the manifest file. When running the make SGX=1 command, build fails:

$ make SGX=1
cc -Wall -Wextra -O3   -c -o helloworld.o helloworld.c
cc   helloworld.o   -o helloworld
gramine-manifest \
        -Dlog_level=error \
        helloworld.manifest.template helloworld.manifest
WARNING: error in manifest (after rendering): extra keys not allowed @ data['sgx']['nonpie_binary']
gramine-manifest-check helloworld.manifest
error in manifest: extra keys not allowed @ data['sgx']['nonpie_binary']
make: *** [Makefile:26: helloworld.manifest] Error 1

As expected, the make command fails during the gramine-manifest-check step with the error extra keys not allowed. However, this check is not integrated into GSC (Gramine Shielded Containers), which uses a different logic for generating the manifest file.

When we add sgx.nonpie_binary=true to the GSC test and build the workload, the build completes successfully without any errors and workload is running successfully.

GSC Log attached
gsc_nopie.log

Expected results

gramine-manifest-check tool should be integrated into gsc

Actual results

GSC build completes successfully without throwing any errors

[dimakuv]

As expected, the make command fails during the gramine-manifest-check step with the error extra keys not allowed. However, this check is not integrated into GSC (Gramine Shielded Containers), which uses a different logic for generating the manifest file.

True.

I think the fix would be to add the following line somewhere around here:

gsc/templates/Dockerfile.common.sign.template

Line 12 in e57a501

+RUN {% block path %}{% endblock %} gramine-manifest-check /gramine/app_files/entrypoint.manifest

Any volunteers for this change?