gramine icon indicating copy to clipboard operation
gramine copied to clipboard

`ra-tls-mbedtls` and `ra-tls-secret-prov` should use host's mbedTLS

Open dimakuv opened this issue 3 years ago • 2 comments

Description of the problem

ra-tls-mbedtls and ra-tls-secret-prov examples should use the mbedTLS package installed on the platform, not mbedtls_gramine.

For the context, see #740 and #773.

This task should be done after #740 and #773 are merged.

dimakuv avatar Jul 22 '22 08:07 dimakuv

@kailun-qin Maybe you could take this task after the two mentioned PRs are merged (should happen next week)? Otherwise I can do it.

dimakuv avatar Jul 22 '22 08:07 dimakuv

@dimakuv Yes, I can take it, please assign this to me. Thanks!

kailun-qin avatar Jul 22 '22 08:07 kailun-qin

https://github.com/gramineproject/gramine/pull/740 and https://github.com/gramineproject/gramine/pull/773 were merged while the current ra-tls-mbedtls example is only compatible w/ mbedTLS 3.x (see below). https://github.com/gramineproject/gramine/blob/9159702129d5317a0f062ac7d24ea118970adff0/CI-Examples/ra-tls-mbedtls/src/server.c#L10

Package libmbedtls-dev:

bionic (18.04LTS): 2.8.0-1
focal (20.04LTS): 2.16.4-1ubuntu2
impish (21.10): 2.16.9-0.1ubuntu1
jammy (22.04LTS): 2.28.0-1build1
kinetic (22.10): 2.28.1-1

It should be simple to make the sample compatible w/ both mbedTLS v2.26+ and v3.x if we'd like so (but not lower versions). But do we really want to switch to use the mbedTLS package installed on the platform now?

cc @dimakuv

kailun-qin avatar Dec 10 '22 02:12 kailun-qin

Yeah, you're right, this is not reasonable. It's a bit weird that we have examples (= normal Linux applications) relying on our own mbedTLS distribution, but current OS distros are still stuck with 2.x mbedTLS, so let's keep everything as is.

I'm closing this issue for now.

dimakuv avatar Jan 02 '23 15:01 dimakuv