DKG Validator 가이드

ls /dev/sgx_enclave && echo "SGX available" || echo "SGX NOT available"

sudo mkdir -p /etc/apt/keyrings
wget -qO- https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key \
  | sudo tee /etc/apt/keyrings/intel-sgx-keyring.asc > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/intel-sgx-keyring.asc arch=amd64]\
  https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" \
  | sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt update
sudo apt install -y build-essential cmake libssl-dev \
  libsgx-dcap-default-qpl libsgx-enclave-common libsgx-quote-ex

{
  "pccs_url": "https://global.acccache.azure.net/sgx/certification/v4/",
  "collateral_service": "https://global.acccache.azure.net/sgx/certification/v4/"
}

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg \
  https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg]\
  https://packages.gramineproject.io/ noble main" \
  | sudo tee /etc/apt/sources.list.d/gramine.list

sudo apt update
sudo apt install -y gramine=1.9

git clone https://github.com/piplabs/story-kernel.git
cd story-kernel
git checkout <release-tag>    # 업그레이드 공지의 태그 사용

make setup-cbmpc              # 최초 1회만
make build-with-cpp
make all-gramine

Code Commitment:     mr_enclave: <64-char hex>

sudo mkdir -p /opt/story-kernel
sudo chown $USER:$USER /opt/story-kernel

gramine-sgx story-kernel init --home /opt/story-kernel

log-level = "info"

[grpc]
listen_addr = ":50051"

[light_client]
chain_id = "devnet-1"
rpc_addr = "http://localhost:26657"
primary_addr = "http://localhost:26657"
witness_addrs = ["http://<other_validator_1>:26657", "http://<other_validator_2>:26657"]
trusted_height = <recent_block_height>
trusted_hash = "<recent_block_hash>"

curl -s 'http://localhost:26657/block' | python3 -c "
import json, sys
r = json.load(sys.stdin)['result']
print(f'trusted_height = {r[\"block\"][\"header\"][\"height\"]}')
print(f'trusted_hash =\"{r[\"block_id\"][\"hash\"]}\"')
"

engine-chain-id = 1315 # Aeneid의 경우

#######################################################################
###                         DKG Options                             ###
#######################################################################

[dkg]
# Enable defines if the DKG client is enabled or not.
enable = true

# Comma-separated list of story-kernel (TEE) endpoints.
kernel-endpoints = ["127.0.0.1:50051"]

# The RPC endpoint of execution layer.
engine-rpc-endpoint = "http://127.0.0.1:8545"

# TEE enclave type identifier (1 for SGX).
enc-type = 1

# TLS configuration for kernel gRPC connections (optional).
#kernel-tls-ca-file = "/path/to/ca.crt"
#kernel-tls-cert-file = "/path/to/client.crt"
#kernel-tls-key-file = "/path/to/client.key"

sudo tee /etc/systemd/system/story-kernel.service > /dev/null <<EOF
[Unit]
Description=DATA Foundation DKG TEE Service
After=network.target

[Service]
User=$USER
WorkingDirectory=$HOME/story-kernel
ExecStart=/usr/bin/gramine-sgx story-kernel
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable story-kernel
sudo systemctl start story-kernel

sudo systemctl restart story

sudo lsof -i :50051 | grep LISTEN
journalctl -u story-kernel --no-pager -n 20
# 다음을 찾으세요: "gRPC server is started: :50051"

journalctl -u story --no-pager -n 100 | grep "Connected to kernel"
# 예상 결과: Connected to kernel endpoint  endpoint=127.0.0.1:50051 code_commitment=<mrenclave>

journalctl -u story --no-pager | grep "DKG_REG_STATUS_VERIFIED"

sudo systemctl stop story-kernel
rm -rf /opt/story-kernel/light_client/
# config.toml에서 trusted_height 및 trusted_hash 업데이트
sudo systemctl start story-kernel

kernel-endpoints = ["<sgx-machine-ip>:50051"]

MRENCLAVE:   6b2fb25e0084ad6ecbf6cfcefe09e2fa0fca2b84092f72c01f8fe98e9d7db5cd
Binary hash: 320a744e87426e36de63ebc8c7ff3af23e00ac7b29ad6093acdafd0bb029ca36