TEE Registry Management CLI tool by khalifaT · Pull Request #26 · OpenGradient/og-evm

khalifaT · 2026-03-04T10:44:01Z

Description

Adds TEE Registry Management CLI tool for managing Trusted Execution Environment registration, attestation, and role-based access control on OpenGradient blockchain.
This CLI provides a complete command-line interface for:

TEE Operations: List, show, register, activate, and deactivate TEEs
PCR Management: Approve, revoke, check, and compute PCR hashes
Type Management: List, add, and deactivate TEE types
Role Management: Grant/revoke admin and operator roles
Certificate Management: Set AWS root certificates

adambalogh · 2026-03-06T01:08:35Z

@khalifaT can you use a more descriptive PR title? It doesn't look like this PR has anything to do with integration tests

Copilot

Pull request overview

This PR adds a new TEE (Trusted Execution Environment) Registry Management CLI tool under scripts/tee-mgmt-cli/ for interacting with the OpenGradient blockchain's TEE registry smart contract. It also updates the local_tee_workflow.go integration test to point to a remote RPC endpoint instead of localhost.

Changes:

New register-mgmt.go CLI providing commands for TEE lifecycle, PCR management, type management, role management, and AWS certificate operations.
New documentation (Readme.md), configuration example (.env.example), and .gitignore for the CLI tool.
Updated RPC_URL constant in local_tee_workflow.go from http://127.0.0.1:8545 to a remote IP.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
`scripts/tee-mgmt-cli/register-mgmt.go`	New CLI tool implementing all TEE registry management commands via Ethereum JSON-RPC
`scripts/tee-mgmt-cli/Readme.md`	Usage documentation for the CLI
`scripts/tee-mgmt-cli/.env.example`	Template environment configuration file
`scripts/tee-mgmt-cli/.gitignore`	Ignores built binary and `.env` secrets file
`scripts/integration/local_tee_workflow.go`	Changes the "local" integration test RPC URL from localhost to a remote server IP

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-06T01:18:34Z

+func fetchAttestation(url string) (string, error) {
+	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}, Timeout: 30 * time.Second}
+	resp, err := client.Get(url)
+	if err != nil {
+ return "", err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	return string(bytes.TrimSpace(body)), nil
+}
+
+func fetchSigningPublicKey(host string) ([]byte, error) {
+	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}, Timeout: 30 * time.Second}
+	resp, err := client.Get(fmt.Sprintf("https://%s/signing-key", host))
+	if err != nil {
+ return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+	var data AttestationResponse
+	json.Unmarshal(body, &data)
+
+	if block, _ := pem.Decode([]byte(data.PublicKey)); block != nil {
+ return block.Bytes, nil
+	}
+	if decoded, err := base64.StdEncoding.DecodeString(data.PublicKey); err == nil {
+ return decoded, nil
+	}
+	return nil, fmt.Errorf("invalid key format")
+}
+
+func fetchTLSCertificate(host, port string) ([]byte, error) {
+	conn, err := tls.Dial("tcp", host+":"+port, &tls.Config{InsecureSkipVerify: true})


Both fetchAttestation and fetchSigningPublicKey use InsecureSkipVerify: true in their TLS configurations. While the attestation document itself might serve as an integrity check, skipping TLS verification means that the connection is susceptible to man-in-the-middle attacks. An attacker could intercept the connection and substitute a malicious attestation document or signing key, potentially allowing an unauthorized TEE to be registered. Since this is a dev/script tool, this should at minimum be documented clearly, and ideally the tool should provide an option to supply a CA certificate for proper verification.

shouldn't the developer pass in the certificate?

@adambalogh
Do you mean that they should be included in the attestation? If so, the attestation already includes the hash of both of them.
Regarding InsecureSkipVerify: this is due to how the certificates are generated by AWS Nitro. I'm not sure whether we can improve this (@kylexqian).
In the precompile, the certificate chain is validated against the AWS Nitro root. The attestation document contains the hashes of the TLS certificate and the signing public key, which are later compared with the values fetched via fetchAttestation / fetchSigningPublicKey. For the public key, this still needs to be added.
A possible improvement would be to validate that our verifyCOSESignatureES384 implementation works correctly by cross-testing it with AWS’s reference verifier, or by replacing it with a library such as go-cose.

no i mean shouldn't the certificate be passed in to the script?

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

adambalogh · 2026-03-06T02:04:55Z

+./tee-cli show <tee_id>
+
+# Register new TEE from enclave
+./tee-cli register


it feels like it would be more natural to pass in the TEE arguments to this command as opposed to setting them as env vars

adambalogh · 2026-03-06T02:05:11Z

+|----------|-------------|---------|
+| `TEE_RPC_URL` | RPC endpoint | `http://13.59.43.94:8545` |
+| `TEE_REGISTRY_ADDRESS` | Contract address | `0x3d641a2791533b4a...` |
+| `TEE_PRIVATE_KEY` | Private key for signing | (uses node account if empty) |


what is node account?

If TEE_PRIVATE_KEY is not set, the CLI uses eth_sendTransaction RPC method, which requires the node to have an unlocked account. This is only for development but not for production.
I may delete that if needed

i do not understand what is a node/unlocked account, can you clarify in docs or remove?

adambalogh · 2026-03-06T02:06:41Z

+| `TEE_PRIVATE_KEY` | Private key for signing | (uses node account if empty) |
+| `ENCLAVE_HOST` | Enclave hostname | - |
+| `ENCLAVE_PORT` | Enclave port | `443` |
+| `MEASUREMENTS_FILE` | Path to measurements.txt | `measurements.txt` |


can you add more explanation around this? what should be the content of this file?

adambalogh · 2026-03-06T02:07:25Z

+./tee-cli pcr-approve
+
+# From environment variables
+PCR0=abc123... PCR1=def456... PCR2=789... PCR_VERSION=v1.0.0 ./tee-cli pcr-approve


this would be better as cli params ./tee-cli pcr-approve --pcr0 abc1234 ...

you can use a lib like this https://github.com/spf13/cobra

other cli tools also use this
og-evm/x/vm/client/cli/tx.go
Line 47 in 3404790
funcNewRawTxCmd() *cobra.Command {

khalifaT added 4 commits March 4, 2026 12:04

register mgmt script
c724e2b

tee cli script
bed7fc1

tee mgmt cli
11fa66a

tee mgmt cli
7e7c46d

khalifaT force-pushed the kha/improve-integrationTests branch from 1935e6f to 7e7c46dCompare March 4, 2026 11:08

khalifaT marked this pull request as ready for review March 4, 2026 15:28

adambalogh requested a review from Copilot March 6, 2026 01:15

Copilotstarted reviewing on behalf of adambalogh March 6, 2026 01:15 View session

CopilotAI reviewed Mar 6, 2026
View reviewed changes

Update scripts/tee-mgmt-cli/Readme.md
e37604a
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

adambalogh reviewed Mar 6, 2026
View reviewed changes

Comment threadscripts/tee-mgmt-cli/Readme.md

adambalogh reviewed Mar 6, 2026
View reviewed changes

khalifaT changed the title ~~Kha/improve integration tests~~ TEE Registry Management CLI toolMar 6, 2026

khalifaT added 2 commits March 6, 2026 15:13

update cli based on the copilot review
9c82380

env variable update
51f7f1c

khalifaT mentioned this pull request Mar 6, 2026
Verification Process Improvements #28
Open
4 tasks

adambalogh merged commit 5ba320b into mainMar 6, 2026

Uh oh!

Conversation

khalifaT commented Mar 4, 2026

Description

Uh oh!

adambalogh commented Mar 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

CopilotAIMar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adambaloghMar 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adambalogh commented Mar 6, 2026•
edited
Loading

adambaloghMar 6, 2026•
edited
Loading