How to check that specific code is running in the enclave [reproducible build]

[tiagorvmartins]

Did some search around, and I believe there are some issues with reproducible builds specifically when using gsc?
Can someone confirm?
At least I tried to build and sign two docker images with same content on the Dockerfile (and related code) and got different mrenclaves.
I wonder how can this be tackled?

The goal is to generate the same mrenclave using the same codebase.
Thank you!

[kailun-qin]

I believe there are some issues with reproducible builds specifically when using gsc?

I think it's not specifically with gsc, but the reproducible build is yet supported in general (while there're several attempts). Pls see some discussions here: #153.

[tiagorvmartins]

Hi @kailun-qin I understand thank you,
Let me put the question on another perspetive then.

On this page (https://gramine.readthedocs.io/en/stable/attestation.html), it states:

"By itself, remote attestation only provides the assurance to the user that the remotely executing TEE is trusted, that the correct code is executed and that the data is processed securely."

So the question is, how is this assurance provided to the user? That the correct code is executed?
How does the user knows that our code is indeed running inside the enclave, if we can't reproduce it having the same mrenclave?

Some points here:

• the user could have a copy of the docker image and do gsc info-image in order to extract the mrenclave
• this mrenclave would match the one when doing remote attestation to our running enclave

But how to verify that the code we claim to be inside the enclave is the one running?

• as an example, lets say a golang binary, the only viable way would be extracting that binary from the gsc docker image and then using our code do a reproducible build and then compare with the hash of the binary that was got extracted from the gsc image enclave?
• still this only proofs that the binary is the same, there is still a lot of moving parts (dependencies, trusted files, etc) beside the binary

Thank you!