Consolidate oak containers protos into one ergonomic file for customer teams, and add relevant build targets

oak_containers/proto/interfaces.proto

@@ -16,65 +16,12 @@
 
 syntax = "proto3";
 
-package oak.containers;
-
-import "google/protobuf/empty.proto";
-import "oak_crypto/proto/v1/crypto.proto";
-import "proto/attestation/endorsement.proto";
-import "proto/attestation/evidence.proto";
-import "proto/session/messages.proto";
-
-// As images can be large (hundreds of megabytes), the launcher chunks up the response into smaller
-// pieces to respect proto/gRPC limits. The image needs to be reassembled in the stage1 or the
-// orchestrator.
-message GetImageResponse {
- bytes image_chunk = 1;
-}
-
-message GetApplicationConfigResponse {
- // Arbitrary config that the container can retrieve from the orchestrator.
- // Included in the attestation measurements conducted by the orchestrator.
- bytes config = 1;
-}
-
-message SendAttestationEvidenceRequest {
- oak.session.v1.AttestationEvidence evidence = 1 [deprecated = true];
- oak.attestation.v1.Evidence dice_evidence = 2;
-}
-
-// Defines the service exposed by the launcher, that can be invoked by the stage1 and the
-// orchestrator.
-service Launcher {
- // Provides stage1 with the Oak system image (which contains the Linux distribution and the
- // orchestrator binary).
- rpc GetOakSystemImage(google.protobuf.Empty) returns (stream GetImageResponse) {}
+// TODO(#4392): Remove this file once the migration is complete.
+// This file is deprecated. The relevant functionality is available in the
+// publicly imported protos instead. Do not add new dependencies on this file.
 
- // Provides orchestrator with the trusted container image.
- rpc GetContainerBundle(google.protobuf.Empty) returns (stream GetImageResponse) {}
-
- // This method is used by the orchestrator to load and measure the trusted
- // application config. The orchestrator will later, separately expose this
- // config to the application.
- rpc GetApplicationConfig(google.protobuf.Empty) returns (GetApplicationConfigResponse) {}
-
- // Sends Attestation Evidence containing the Attestation Report with corresponding measurements
- // and public keys to the Launcher.
- // This API is called exactly once after the Attestation Evidence is generated. Calling this API
- // a second time will result in an error.
- rpc SendAttestationEvidence(SendAttestationEvidenceRequest) returns (google.protobuf.Empty) {}
-
- // Notifies the launcher that the trusted app is ready to serve requests and listening on the
- // pre-arranged port (8080).
- rpc NotifyAppReady(google.protobuf.Empty) returns (google.protobuf.Empty) {}
-}
-
-// Defines the service exposed by the orchestrator, that can be invoked by the application.
-service Orchestrator {
- // Exposes the previously loaded trusted application config to the application,
- // which may choose to retrieve it.
- rpc GetApplicationConfig(google.protobuf.Empty) returns (GetApplicationConfigResponse) {}
+package oak.containers;
 
- // Notifies the orchestrator that the trusted app is ready to serve requests and listening on the
- // pre-arranged port (8080).
- rpc NotifyAppReady(google.protobuf.Empty) returns (google.protobuf.Empty) {}
-}
+import public "proto/containers/common.proto";
+import public "proto/containers/launcher.proto";
+import public "proto/containers/application_interfaces.proto";

oak_containers_launcher/build.rs

@@ -19,7 +19,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
  // Generate gRPC code for connecting to the launcher.
  generate_grpc_code(
  &[
- "../oak_containers/proto/interfaces.proto",
+ "../proto/containers/launcher.proto",
  "../oak_crypto/proto/v1/crypto.proto",
  "../proto/key_provisioning/key_provisioning.proto",
  "../proto/containers/hostlib_key_provisioning.proto",

oak_containers_launcher/src/lib.rs

@@ -16,8 +16,6 @@
 pub mod proto {
  pub mod oak {
  pub mod containers {
- #![allow(clippy::return_self_not_must_use)]
- tonic::include_proto!("oak.containers");
  pub mod v1 {
  #![allow(clippy::return_self_not_must_use)]
  tonic::include_proto!("oak.containers.v1");

oak_containers_launcher/src/server.rs

@@ -43,15 +43,11 @@ use tokio_stream::wrappers::TcpListenerStream;
 use tonic::{transport::Server, Request, Response, Status};
 
 use crate::proto::oak::{
- containers::{
+ containers::v1::{
+ hostlib_key_provisioning_server::{HostlibKeyProvisioning, HostlibKeyProvisioningServer},
  launcher_server::{Launcher, LauncherServer},
- v1::{
- hostlib_key_provisioning_server::{
- HostlibKeyProvisioning, HostlibKeyProvisioningServer,
- },
- GetGroupKeysResponse, GetKeyProvisioningRoleResponse, KeyProvisioningRole,
- },
- GetApplicationConfigResponse, GetImageResponse, SendAttestationEvidenceRequest,
+ GetApplicationConfigResponse, GetGroupKeysResponse, GetImageResponse,
+ GetKeyProvisioningRoleResponse, KeyProvisioningRole, SendAttestationEvidenceRequest,
  },
  session::v1::AttestationEvidence,
 };

oak_containers_orchestrator/build.rs

@@ -19,9 +19,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
  // Generate gRPC code for Orchestrator services.
  generate_grpc_code(
  &[
- "../oak_containers/proto/interfaces.proto",
  "../proto/key_provisioning/key_provisioning.proto",
- "../proto/containers/orchestrator_crypto.proto",
+ "../proto/containers/application_interfaces.proto",
+ "../proto/containers/launcher.proto",
  "../proto/containers/hostlib_key_provisioning.proto",
  "../proto/session/messages.proto",
  ],

oak_containers_orchestrator/src/ipc_server.rs

@@ -24,9 +24,9 @@ use tonic::{transport::Server, Request, Response};
 use crate::{
  crypto::{CryptoService, KeyStore},
  launcher_client::LauncherClient,
- proto::oak::containers::{
+ proto::oak::containers::v1::{
+ orchestrator_crypto_server::OrchestratorCryptoServer,
  orchestrator_server::{Orchestrator, OrchestratorServer},
- v1::orchestrator_crypto_server::OrchestratorCryptoServer,
  GetApplicationConfigResponse,
  },
 };

oak_containers_orchestrator/src/launcher_client.rs

@@ -19,9 +19,9 @@ use tonic::transport::Channel;
 
 use crate::proto::oak::{
  attestation::v1::Evidence,
- containers::{
- launcher_client::LauncherClient as GrpcLauncherClient,
- v1::{hostlib_key_provisioning_client::HostlibKeyProvisioningClient, KeyProvisioningRole},
+ containers::v1::{
+ hostlib_key_provisioning_client::HostlibKeyProvisioningClient,
+ launcher_client::LauncherClient as GrpcLauncherClient, KeyProvisioningRole,
  SendAttestationEvidenceRequest,
  },
  key_provisioning::v1::GroupKeys,

oak_containers_orchestrator/src/lib.rs

@@ -16,8 +16,6 @@
 pub mod proto {
  pub mod oak {
  pub mod containers {
- #![allow(clippy::return_self_not_must_use)]
- tonic::include_proto!("oak.containers");
  pub mod v1 {
  #![allow(clippy::return_self_not_must_use)]
  tonic::include_proto!("oak.containers.v1");

oak_containers_sdk/Cargo.toml

@@ -11,7 +11,6 @@ oak_grpc_utils = { workspace = true }
 [dependencies]
 anyhow = "*"
 async-trait = { version = "*", default-features = false }
-oak_attestation = { workspace = true }
 oak_crypto = { workspace = true }
 prost = "*"
 prost-types = "*"

oak_containers_sdk/build.rs

@@ -19,10 +19,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
  // Generate gRPC code for connecting to the Orchestrator.
  generate_grpc_code(
  &[
- "../oak_containers/proto/interfaces.proto",
  "../oak_crypto/proto/v1/crypto.proto",
  "../proto/session/messages.proto",
- "../proto/containers/orchestrator_crypto.proto",
+ "../proto/containers/application_interfaces.proto",
  ],
  "..",
  CodegenOptions {

oak_containers_sdk/src/lib.rs

@@ -16,13 +16,11 @@
 mod proto {
  pub mod oak {
  pub mod containers {
- tonic::include_proto!("oak.containers");
  pub mod v1 {
  #![allow(clippy::return_self_not_must_use)]
  tonic::include_proto!("oak.containers.v1");
  }
  }
- pub use oak_attestation::proto::oak::{attestation, session};
  pub use oak_crypto::proto::oak::crypto;
  }
 }

oak_containers_sdk/src/orchestrator_client.rs

@@ -17,7 +17,7 @@ use anyhow::{Context, Result};
 use tonic::transport::{Endpoint, Uri};
 use tower::service_fn;
 
-use crate::proto::oak::containers::orchestrator_client::OrchestratorClient as GrpcOrchestratorClient;
+use crate::proto::oak::containers::v1::orchestrator_client::OrchestratorClient as GrpcOrchestratorClient;
 
 // Unix Domain Sockets do not use URIs, hence this URI will never be used.
 // It is defined purely since in order to create a channel, since a URI has to

oak_containers_stage1/Cargo.toml

@@ -15,7 +15,6 @@ clap = { version = "*", features = ["derive"] }
 coset = { version = "*", features = ["std"] }
 futures-util = "*"
 oak_attestation = { workspace = true }
-oak_crypto = { workspace = true }
 oak_dice = { workspace = true }
 nix = { version = "*", features = ["mman"] }
 p256 = { version = "*" }

oak_containers_stage1/build.rs

@@ -20,9 +20,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
  // Generate gRPC code for loading the system image.
  generate_grpc_code(
  &[
- "../oak_containers/proto/interfaces.proto",
  "../oak_crypto/proto/v1/crypto.proto",
  "../proto/session/messages.proto",
+ "../proto/containers/launcher.proto",
  ],
  "..",
  CodegenOptions {

oak_containers_stage1/src/client.rs

@@ -17,14 +17,17 @@
 mod proto {
  pub mod oak {
  pub mod containers {
- tonic::include_proto!("oak.containers");
+ pub mod v1 {
+ #![allow(clippy::return_self_not_must_use)]
+ tonic::include_proto!("oak.containers.v1");
+ }
  }
  pub use oak_attestation::proto::oak::{attestation, session};
  }
 }
 
 use anyhow::{Context, Result};
-use proto::oak::containers::launcher_client::LauncherClient as GrpcLauncherClient;
+use proto::oak::containers::v1::launcher_client::LauncherClient as GrpcLauncherClient;
 use tonic::transport::{Channel, Uri};
 
 pub struct LauncherClient {

oak_functions_containers_app/build.rs

@@ -38,7 +38,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
  generate_grpc_code(
  &[
- "../oak_containers/proto/interfaces.proto",
+ "../oak_crypto/proto/v1/crypto.proto",
+ "../proto/containers/application_interfaces.proto",
  "../proto/session/messages.proto",
  ],
  "..",

oak_functions_containers_app/src/lib.rs

@@ -53,8 +53,10 @@ pub mod proto {
  tonic::include_proto!("oak.functions");
  }
  pub mod containers {
- #![allow(clippy::return_self_not_must_use)]
- tonic::include_proto!("oak.containers");
+ pub mod v1 {
+ #![allow(clippy::return_self_not_must_use)]
+ tonic::include_proto!("oak.containers.v1");
+ }
  }
  pub use oak_attestation::proto::oak::{attestation, session};
  pub use oak_crypto::proto::oak::crypto;

proto/containers/BUILD

@@ -16,6 +16,7 @@
 
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
 load("@com_github_grpc_grpc//bazel:cc_grpc_library.bzl", "cc_grpc_library")
+load("@com_github_grpc_grpc//bazel:python_rules.bzl", "py_grpc_library", "py_proto_library")
 load("@rules_cc//cc:defs.bzl", "cc_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
 
@@ -25,10 +26,50 @@ package(
 )
 
 proto_library(
- name = "orchestrator_crypto_proto",
- srcs = ["orchestrator_crypto.proto"],
+ name = "common_proto",
+ srcs = ["common.proto"],
+)
+
+proto_library(
+ name = "application_interfaces_proto",
+ srcs = ["application_interfaces.proto"],
  deps = [
+ ":common_proto",
  "//oak_crypto/proto/v1:crypto_proto",
+ "//oak_remote_attestation/proto/v1:messages_proto",
+ "@com_google_protobuf//:empty_proto",
+ ],
+)
+
+cc_proto_library(
+ name = "application_interfaces_cc_proto",
+ deps = [":application_interfaces_proto"],
+)
+
+cc_grpc_library(
+ name = "application_interfaces_cc_grpc",
+ srcs = [":application_interfaces_proto"],
+ grpc_only = True,
+ generate_mocks = True,
+ deps = [":application_interfaces_proto"],
+)
+
+py_proto_library(
+ name = "application_interfaces_py_proto",
+ deps = [":application_interfaces_proto"],
+)
+
+py_grpc_library(
+ name = "application_interfaces_py_grpc",
+ srcs = [":application_interfaces_proto"],
+ deps = [":application_interfaces_py_proto"],
+)
+
+proto_library(
+ name = "launcher_proto",
+ srcs = ["launcher.proto"],
+ deps = [
+ ":common_proto",
  ],
 )
 
@@ -52,10 +93,20 @@ proto_library(
  ],
 )
 
+# TODO(#4392): Remove once the migration is complete.
+proto_library(
+ name = "orchestrator_crypto_proto",
+ srcs = ["orchestrator_crypto.proto"],
+ deps = [
+ "//oak_crypto/proto/v1:crypto_proto",
+ ],
+)
+
 build_test(
  name = "build_test",
  targets = [
  ":hostlib_key_provisioning_proto",
- ":orchestrator_crypto_proto",
+ ":application_interfaces_proto",
+ ":launcher_proto",
  ],
 )