From 72b0d510d3b95a94655d41915086afc99980c6e8 Mon Sep 17 00:00:00 2001 From: paypes <43441600+abbesBenayache@users.noreply.github.com> Date: Wed, 22 Apr 2026 16:43:09 +0200 Subject: [PATCH 01/10] docs: migrate documentation from SGX/Bellecour to TDX/Arbitrum - Remove all SGX, Scone, Gramine, and Bellecour references from user-facing documentation and application code - Update chain.utils.ts and wagmiNetworks.ts: drop Bellecour network, add TDX workerpool addresses and TDX tool addresses for Arbitrum mainnet and Sepolia - Fix SMS URLs (sms.labs.iex.ec for Sepolia, sms.arbitrum-mainnet.iex.ec for mainnet), workerpool addresses, and deploy output field names - Rewrite build-your-first-sgx-iapp.md as a TDX SDK CLI guide - Update sidebar: replace SGX entries with TDX equivalents - Add [TDX] link at first mention in every page that references it - Update PoCo tag table: keep only 0x0001 (TEE) and 0x0009 (TEE TDX) - Update important-addresses.md with current TDX contract addresses --- .vitepress/sidebar.ts | 10 +- src/get-started/helloWorld/2-protectData.md | 2 +- src/get-started/helloWorld/3-buildIApp.md | 95 +-- src/get-started/overview/privacy-iapp.md | 14 +- src/get-started/overview/rlc.md | 1 - src/get-started/overview/what-is-iexec.md | 27 +- .../blockchain-explorer.md | 15 +- .../tooling-and-explorers/bridge.md | 56 +- .../tooling-and-explorers/iexec-explorer.md | 2 +- .../important-addresses.md | 36 +- .../subgraph-explorer.md | 26 +- src/get-started/use-cases.md | 2 +- .../advanced/access-confidential-assets.md | 10 +- .../advanced/build-your-first-sgx-iapp.md | 578 ------------------ .../advanced/build-your-first-tdx-iapp.md | 109 ++-- .../build-iapp/advanced/protect-the-result.md | 33 +- src/guides/build-iapp/advanced/quick-start.md | 2 +- src/guides/build-iapp/deploy-&-run.md | 203 +----- src/guides/build-iapp/manage-access.md | 8 +- src/guides/manage-data/manage-access.md | 5 +- src/modules/helloWorld/ProtectData.vue | 14 +- src/protocol/ai.md | 73 +-- src/protocol/proof-of-contribution.md | 34 +- src/protocol/tee/intel-sgx.md | 147 ----- src/protocol/tee/intel-tdx.md | 48 +- src/protocol/tee/introduction.md | 35 +- src/protocol/tee/sgx-vs-tdx.md | 85 --- src/protocol/worker/manage-access.md | 35 +- .../dataProtector/advanced-configuration.md | 12 +- .../dataProtector/getting-started.md | 15 - .../methods/processProtectedData.md | 15 +- .../dataProtector/methods/protectData.md | 12 +- src/references/glossary.md | 87 +-- src/references/iapp-generator.md | 11 +- .../iapp-generator/building-your-iexec-app.md | 26 +- src/utils/chain.utils.ts | 39 +- src/utils/wagmiNetworks.ts | 24 +- 37 files changed, 267 insertions(+), 1679 deletions(-) delete mode 100644 src/guides/build-iapp/advanced/build-your-first-sgx-iapp.md delete mode 100644 src/protocol/tee/intel-sgx.md delete mode 100644 src/protocol/tee/sgx-vs-tdx.md diff --git a/.vitepress/sidebar.ts b/.vitepress/sidebar.ts index e6ae5ae4..8268ce32 100644 --- a/.vitepress/sidebar.ts +++ b/.vitepress/sidebar.ts @@ -157,10 +157,6 @@ export function getSidebar() { text: 'Quick Start', link: '/guides/build-iapp/advanced/quick-start', }, - { - text: 'Build your first SGX app', - link: '/guides/build-iapp/advanced/build-your-first-sgx-iapp', - }, { text: 'End-to-end Encryption', link: '/guides/build-iapp/advanced/protect-the-result', @@ -425,16 +421,12 @@ export function getSidebar() { text: 'Introduction to TEE Technologies', link: '/protocol/tee/introduction', }, - { - text: 'Intel SGX Technology', - link: '/protocol/tee/intel-sgx', - }, { text: 'Intel TDX Technology', link: '/protocol/tee/intel-tdx', }, { - text: 'SGX vs TDX Comparison', + text: 'Why Intel TDX?', link: '/protocol/tee/sgx-vs-tdx', }, ], diff --git a/src/get-started/helloWorld/2-protectData.md b/src/get-started/helloWorld/2-protectData.md index b86aa15a..527ccdb4 100644 --- a/src/get-started/helloWorld/2-protectData.md +++ b/src/get-started/helloWorld/2-protectData.md @@ -110,7 +110,7 @@ button:
4 - iExec's protocol stores the symmetric key in a secure enclave (TEE) in the Secret Management Service + iExec's protocol stores the symmetric key in a [TDX](/protocol/tee/intel-tdx) Trust Domain (TEE) in the Secret Management Service
5 diff --git a/src/get-started/helloWorld/3-buildIApp.md b/src/get-started/helloWorld/3-buildIApp.md index cbcd83cd..c849735b 100644 --- a/src/get-started/helloWorld/3-buildIApp.md +++ b/src/get-started/helloWorld/3-buildIApp.md @@ -364,19 +364,6 @@ Once you have your token, you can deploy your iApp. /> - - ::: tip ๐Ÿ“ Make sure to save your **iApp address** after deployment - you'll need it @@ -533,7 +520,7 @@ const arbitrumSteps = [ }, { showAt: 13, - question: 'Pushed TEE image bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7 on dockerhub', + question: 'Pushed TEE image bob/hello-world:0.0.1-tdx-a53fc4c480f4 on dockerhub', answer: '', showTyping: false, isComplete: true @@ -547,82 +534,8 @@ const arbitrumSteps = [ } ]; -const bellecourSteps = [ - { - showAt: 2, - question: 'Using chain bellecour', - answer: '', - showTyping: false, - isComplete: true - }, - { - showAt: 3, - question: 'Using saved walletPrivateKey (from iapp.config.json)', - answer: '', - showTyping: false, - isComplete: true - }, - { - showAt: 4, - completeAt: 6, - question: 'What is your username on DockerHub? (It will be used to properly tag the Docker image)', - answer: 'bob', - showTyping: true, - isComplete: false - }, - { - showAt: 6, - completeAt: 8, - question: 'What is your DockerHub access token?', - answer: '**********************', - showTyping: true, - isComplete: false - }, - { - showAt: 8, - completeAt: 10, - question: 'What is the version of your iApp?', - answer: '0.0.1', - showTyping: true, - isComplete: false - }, - { - showAt: 10, - question: 'Docker image built (sha256:a53fc4c480f482c384a13266ea2cb6cc5572733c866c44a5f604f4bfab3a744a) and tagged bob/hello-world:0.0.1', - answer: '', - showTyping: false, - isComplete: true - }, - { - showAt: 11, - question: 'Pushed image bob/hello-world:0.0.1 on dockerhub', - answer: '', - showTyping: false, - isComplete: true - }, - { - showAt: 12, - question: 'Pushed TEE image bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7 on dockerhub', - answer: '', - showTyping: false, - isComplete: true - }, - { - showAt: 13, - question: 'TEE app deployed', - answer: '', - showTyping: false, - isComplete: true - } -]; - const arbitrumCompletionItems = [ - 'โ”” Docker image: bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7', - 'โ”” iApp address: 0x1f80DCebc2EAAff0Db7156413C43B7e88D189923' -]; - -const bellecourCompletionItems = [ - 'โ”” Docker image: bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7', + 'โ”” Docker image: bob/hello-world:0.0.1-tdx-a53fc4c480f4', 'โ”” iApp address: 0x1f80DCebc2EAAff0Db7156413C43B7e88D189923' ]; @@ -693,7 +606,7 @@ const arbitrumSepoliaSteps = [ }, { showAt: 13, - question: 'Pushed TEE image bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7 on dockerhub', + question: 'Pushed TEE image bob/hello-world:0.0.1-tdx-a53fc4c480f4 on dockerhub', answer: '', showTyping: false, isComplete: true @@ -708,7 +621,7 @@ const arbitrumSepoliaSteps = [ ]; const arbitrumSepoliaCompletionItems = [ - 'โ”” Docker image: bob/hello-world:0.0.1-tee-scone-5.9.1-v16-ce3a01d9c5d7', + 'โ”” Docker image: bob/hello-world:0.0.1-tdx-a53fc4c480f4', 'โ”” iApp address: 0x1f80DCebc2EAAff0Db7156413C43B7e88D189923' ]; diff --git a/src/get-started/overview/privacy-iapp.md b/src/get-started/overview/privacy-iapp.md index ceedfedf..264097a2 100644 --- a/src/get-started/overview/privacy-iapp.md +++ b/src/get-started/overview/privacy-iapp.md @@ -47,7 +47,7 @@ Privacy iApp, they will.** โœ… **True Privacy:** Users never expose their raw data. Your app processes it -privately inside secure enclaves. +privately inside hardware-isolated Trust Domains. โœ… **Trusted Execution:** iExec ensures your code runs inside a Trusted Execution Environment (TEE), guaranteeing only the specified Docker image @@ -64,10 +64,12 @@ operating system during execution. ## How it Works -Your code runs in a Trusted Execution Environment (TEE). This secure area exists -inside specific processors (Intel Software Guard Extensions (SGX) or Trust -Domain Extensions (TDX) chipsets). Everything stays private and protected there, -even from the operating system. +Your code runs in a Trusted Execution Environment (TEE) powered by **Intel Trust +Domain Extensions ([TDX](/protocol/tee/intel-tdx))**. TDX is a hardware-based +confidential computing technology built into Intel processors. It isolates +entire virtual machines โ€” called **Trust Domains** โ€” from the host hypervisor, +the cloud provider, and the operating system itself. Everything inside a Trust +Domain stays private and protected, even from infrastructure administrators. Authorized users trigger an iApp that processes protected data inside this private environment. Your iApp uses the data but never exposes it, not even to @@ -163,7 +165,7 @@ see what you can build! - **Docker**: Your application must be containerized - **Input/Output**: Define clear input and output schemas -- **TEE Compatibility**: Ensure your code runs in secure enclaves +- **TEE Compatibility**: Ensure your code runs inside a TDX Trust Domain - **Network Access**: Configure any external API calls or dependencies ## Next Steps diff --git a/src/get-started/overview/rlc.md b/src/get-started/overview/rlc.md index 211e5799..29c3be8c 100644 --- a/src/get-started/overview/rlc.md +++ b/src/get-started/overview/rlc.md @@ -119,7 +119,6 @@ You can acquire RLC tokens through several methods: diff --git a/src/get-started/overview/what-is-iexec.md b/src/get-started/overview/what-is-iexec.md index c8f75e5d..ccbb9394 100644 --- a/src/get-started/overview/what-is-iexec.md +++ b/src/get-started/overview/what-is-iexec.md @@ -24,9 +24,10 @@ developers build privacy-preserving apps. ### Step 2: Create a Deal -**Requester** submits a computation request. The **PoCo smart contract** -automatically matches and brings together all required resources: the iApp, -protected data, and available workerpool. +**Requester** submits a computation request. The +**[PoCo](/protocol/proof-of-contribution) (Proof of Contribution) smart +contract** automatically matches and brings together all required resources: the +iApp, protected data, and available workerpool. โ†’ **Guides**: [Run iApp with ProtectedData](/guides/use-iapp/run-iapp-with-ProtectedData), @@ -35,12 +36,15 @@ protected data, and available workerpool. ### Step 3: Execute in TEE **Workers** from the selected workerpool download the iApp and execute it inside -**secure enclaves** (TEEs). Your data is processed confidentially - workers can -run computations but never access raw data outside the TEE. +**[TDX](/protocol/tee/intel-tdx) Trust Domains** โ€” hardware-isolated +[TEEs](/protocol/tee/introduction) (Trusted Execution Environments). Your data +is processed confidentially: workers can run computations but never access raw +data outside the Trust Domain. ### Step 4: Deliver Results & Pay -Results are encrypted and delivered back to the requester. **RLC tokens** are +Results are encrypted and delivered back to the requester. +**[RLC](/get-started/overview/rlc) tokens** (the protocol's native currency) are automatically distributed to all participants (app provider, data provider, workerpool) based on their contribution. @@ -56,11 +60,12 @@ these purposes." Your code, packaged to run on workers. Can be AI models, data processing scripts, any computation. -### **Workers (Secure Enclaves)** +### **Workers ([TDX](/protocol/tee/intel-tdx) Trust Domains)** -Computers that process your data inside privacy-safe TEE environments. They can -access your data to work with it, but the TEE ensures it stays confidential and -tamper-proof. +Computers that process your data inside hardware-isolated +[TEE](/protocol/tee/introduction) environments (Trusted Execution Environments). +They can access your data to work with it, but the TEE ensures it stays +confidential and tamper-proof. ### **Deals** @@ -76,7 +81,7 @@ protocol takes care of worker allocation and secure coordination. 2. **Deploy**: AI company packages their model โ†’ becomes iApp 3. **Execute**: Someone submits Task โ†’ "Train model on this data" 4. **Result**: Model gets trained, researcher gets insights, raw data never - leaves enclave + leaves the Trust Domain **Web3 Email** diff --git a/src/get-started/tooling-and-explorers/blockchain-explorer.md b/src/get-started/tooling-and-explorers/blockchain-explorer.md index c928d7f8..168058ab 100644 --- a/src/get-started/tooling-and-explorers/blockchain-explorer.md +++ b/src/get-started/tooling-and-explorers/blockchain-explorer.md @@ -1,8 +1,8 @@ --- title: Blockchain Explorers description: - Explore iExec smart contracts on verified blockchain explorers for both - Arbitrum mainnet and Bellecour network. + Explore iExec smart contracts on verified blockchain explorers for Arbitrum + mainnet and Arbitrum Sepolia testnet. --- # Blockchain Explorers @@ -36,16 +36,6 @@ publicly auditable. demo-label="Visit Arbiscan" /> -
::: tip ๐Ÿ’ก Dev Tip @@ -60,5 +50,4 @@ import UseCaseCard from '@/components/UseCaseCard.vue'; // Assets import arbitrumExplorerImage from '@/assets/tooling-&-explorers/blockchain-explorer/arbitrum-explorer.png'; -import bellecourExplorerImage from '@/assets/tooling-&-explorers/blockchain-explorer/bellecour-explorer.png'; diff --git a/src/get-started/tooling-and-explorers/bridge.md b/src/get-started/tooling-and-explorers/bridge.md index 28f80409..04ee2330 100644 --- a/src/get-started/tooling-and-explorers/bridge.md +++ b/src/get-started/tooling-and-explorers/bridge.md @@ -2,7 +2,7 @@ title: iExec RLC Bridge description: Bridge RLC tokens between networks to interact with the iExec protocol. - Transfer RLC to Bellecour (xRLC) and Arbitrum networks using dedicated bridges + Transfer RLC to Arbitrum networks using the Stargate Bridge --- # RLC Bridge @@ -11,8 +11,8 @@ description: whether you're executing tasks, accessing protected data, or participating in the iExec confidential computing network. -This guide helps you bridge RLC tokens to **Bellecour** (becoming xRLC) and -**Arbitrum** networks using the Bellecour Bridge and Stargate Bridge. +This guide helps you bridge RLC tokens to **Arbitrum** using the Stargate +Bridge. ::: tip ๐Ÿงช Testing on Arbitrum Sepolia @@ -30,18 +30,6 @@ iExec provides officially supported bridges for seamless token transfer across networks: - - -## Bellecour Bridge - -The **Bellecour Bridge** enables seamless transfer of RLC tokens between -Ethereum mainnet and the Bellecour sidechain in both directions. When bridged to -Bellecour, RLC becomes xRLC, the native asset of the Bellecour network. - -### Ethereum <> Bellecour (RLC <> xRLC) - -1. **Connect Wallet**: Visit - [Bellecour Bridge UI](https://bridge-bellecour.iex.ec/) and connect your - wallet -2. **Select Source Network**: The bridge automatically detects your current - network and available tokens (RLC on Ethereum or xRLC on Bellecour) -3. **Choose Destination**: The bridge will show the opposite network as - destination automatically -4. **Select Amount**: Choose the amount of tokens you want to bridge -5. **Confirm Transaction**: Approve the bridge transaction and wait for - confirmation -6. **Receive Tokens**: Your tokens will be available on the destination network - - - -::: tip ๐Ÿ”„ Bidirectional Bridge - -The bridge interface automatically detects your wallet's network and available -tokens. The process is similar in both directions - simply switch to the -appropriate network (source chain) in your wallet and refresh the page to update -the bridge direction, then the bridge will handle the conversion between RLC and -xRLC seamlessly. - -::: - ## Security & Audits The **Stargate Bridge** uses the **LayerZero protocol** under the hood, which @@ -152,9 +104,7 @@ import CardGrid from '@/components/CardGrid.vue'; import ProjectCard from '@/components/ProjectCard.vue'; // Assets -import iexecLogoIcon from '@/assets/icons/iexec-logo.png'; import arbitrumLogoIcon from '@/assets/icons/arbitrum.svg'; -import bellecourBridgeImage from '@/assets/tooling-&-explorers/bridge/bellecour-bridge.png'; import stargateBridgeImage from '@/assets/tooling-&-explorers/bridge/stargate-bridge.png'; import halbornLogoIcon from '@/assets/icons/halborn.svg'; diff --git a/src/get-started/tooling-and-explorers/iexec-explorer.md b/src/get-started/tooling-and-explorers/iexec-explorer.md index 4e98c55d..df4eb614 100644 --- a/src/get-started/tooling-and-explorers/iexec-explorer.md +++ b/src/get-started/tooling-and-explorers/iexec-explorer.md @@ -131,7 +131,7 @@ Browse and analyze all tasks across the iExec network: - **Real-time Progress**: Monitor task status from queued โ†’ running โ†’ completed with detailed state transitions - **Execution Environment**: See which workers are processing your tasks and - their TEE capabilities (SGX, TDX) + their TEE capabilities ([TDX](/protocol/tee/intel-tdx)) - **Data Flow**: Track which protected datasets are securely accessed by authorized iApp - **Result Management**: diff --git a/src/get-started/tooling-and-explorers/important-addresses.md b/src/get-started/tooling-and-explorers/important-addresses.md index 0c4ed318..71fb52a8 100644 --- a/src/get-started/tooling-and-explorers/important-addresses.md +++ b/src/get-started/tooling-and-explorers/important-addresses.md @@ -8,8 +8,8 @@ description: # Important Addresses Quick reference guide to all important iExec protocol addresses. Find RLC token -addresses, PoCo smart contracts, and application addresses for Ethereum, -Arbitrum, and Bellecour networks. +addresses, PoCo smart contracts, and application addresses for Ethereum and +Arbitrum networks. ::: tip ๐Ÿ’ก Quick Access @@ -28,14 +28,6 @@ these addresses to interact with RLC tokens on each network. | **Ethereum Mainnet** | 1 | `0x607F4C5BB672230e8672085532f7e901544a7375` | | **Arbitrum Mainnet** | 42161 | `0xe649e6a1F2afc63ca268C2363691ceCAF75CF47C` | | **Arbitrum Sepolia** | 421614 | `0x9923eD3cbd90CD78b910c475f9A731A6e0b8C963` | -| **Bellecour** | 134 | `xRLC` (Native token) | - -::: info - -On **Bellecour**, RLC tokens are bridged from Ethereum and become **xRLC** -(native token). No contract address is needed as it's the native currency. - -::: ## PoCo Smart Contracts @@ -69,15 +61,6 @@ decentralized computing marketplace. | **DatasetRegistry** | `0x07Cc4E1EA30dD02796795876509A3BfC5053128D` | | **WorkerpoolRegistry** | `0xe3c13bb4A5068601c6A08041Cb50887B07B5F398` | -### Bellecour - -| Contract | Address | -| ---------------------- | -------------------------------------------- | -| **Diamond Proxy** | `0x3eca1B216A7DF1C7689aEb259fFB83ADFB894E7f` | -| **AppRegistry** | `0xB1C52075b276f87b1834919167312221d50c9D16` | -| **DatasetRegistry** | `0x799DAa22654128d0C64d5b79eac9283008158730` | -| **WorkerpoolRegistry** | `0xC76A18c78B7e530A165c5683CB1aB134E21938B4` | - ## Data Protector Contracts Smart contracts for managing protected data and access control. @@ -107,9 +90,8 @@ features. | Network | Whitelist Address | | -------------------- | -------------------------------------------- | -| **Arbitrum Mainnet** | `0xD5054a18565c4a9E5c1aa3cEB53258bd59d4c78C` | -| **Arbitrum Sepolia** | `0x8d46d40840f1Aa2264F96184Ffadf04e5D573B9B` | -| **Bellecour** | `0x781482C39CcE25546583EaC4957Fb7Bf04C277D2` | +| **Arbitrum Mainnet** | `0xfa9cceff9431ee0e2a3fe58911073f1357f24e31` | +| **Arbitrum Sepolia** | `0x09d59e1b696d0cb69f46bf762412636e8652ab58` | ### Web3Telegram @@ -117,9 +99,8 @@ Web3Telegram enables decentralized Telegram messaging with Web3 integration. | Network | Whitelist Address | | -------------------- | -------------------------------------------- | -| **Arbitrum Mainnet** | `0x53AFc09a647e7D5Fa9BDC784Eb3623385C45eF89` | -| **Arbitrum Sepolia** | `0x7291ff96100DA6CF97933C225B86124ef95aEc9b` | -| **Bellecour** | `0x192C6f5AccE52c81Fcc2670f10611a3665AAA98F` | +| **Arbitrum Mainnet** | `0xa7101cf61d4602d55a715be4f2b9e1bc71d22301` | +| **Arbitrum Sepolia** | `0x7f67e78a4b0a98c50333b8b72851952c396601a1` | ## Workerpool Addresses @@ -127,9 +108,8 @@ Default workerpool addresses for each network. | Network | Workerpool Address | | -------------------- | -------------------------------------------- | -| **Arbitrum Mainnet** | `0x2C06263943180Cc024dAFfeEe15612DB6e5fD248` | -| **Arbitrum Sepolia** | `0xB967057a21dc6A66A29721d96b8Aa7454B7c383F` | -| **Bellecour** | `prod-v8-bellecour.main.pools.iexec.eth` | +| **Arbitrum Mainnet** | `0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244` | +| **Arbitrum Sepolia** | `0x2956f0cb779904795a5f30d3b3ea88b714c3123f` | ::: tip diff --git a/src/get-started/tooling-and-explorers/subgraph-explorer.md b/src/get-started/tooling-and-explorers/subgraph-explorer.md index c58e7b75..fc25ec5d 100644 --- a/src/get-started/tooling-and-explorers/subgraph-explorer.md +++ b/src/get-started/tooling-and-explorers/subgraph-explorer.md @@ -2,8 +2,7 @@ title: The Graph Explorer description: Explore and query blockchain data using The Graph's decentralized indexing - protocol. Access iExec subgraphs on Arbitrum, Arbitrum Sepolia, and Bellecour - networks. + protocol. Access iExec subgraphs on Arbitrum and Arbitrum Sepolia networks. --- # The Graph Explorer @@ -93,28 +92,6 @@ protocol. button-rel="noreferrer" /> - - - - ## GraphQL Explorer Interface @@ -218,6 +195,5 @@ import ProjectCard from '@/components/ProjectCard.vue'; import theGraphLogoImage from '@/assets/tooling-&-explorers/the-graph/image-logo.jpg'; import theGraphProtocolImage from '@/assets/tooling-&-explorers/the-graph/protocol-view.jpg'; import arbitrumIcon from '@/assets/icons/arbitrum.svg'; -import iexecLogoIcon from '@/assets/icons/iexec-logo.png'; import graphqlExplorerImage from '@/assets/tooling-&-explorers/the-graph/graphql-explorer.png'; diff --git a/src/get-started/use-cases.md b/src/get-started/use-cases.md index 55131653..8975cf1f 100644 --- a/src/get-started/use-cases.md +++ b/src/get-started/use-cases.md @@ -50,7 +50,7 @@ AI framework, you can: /hello-world:1.0.0` image built -previously is required. - -For this tutorial, create a new directory tree. Execute the following commands -in `~/iexec-projects/`: - -```bash -cd ~/iexec-projects -mkdir tee-hello-world-app && cd tee-hello-world-app -iexec init --skip-wallet -mkdir src -touch Dockerfile -touch sconify.sh -chmod +x sconify.sh -``` - -### Write the iApp logic - -Develop your code logic like the content below.The following examples only -feature Javascript and Python use cases for simplicity concerns but remember -that you can run on iExec anything which is Dockerizable. - -**Copy the following content** in `src/` . - -::: code-group - -```javascript [src/app.js] -const fsPromises = require('fs').promises; - -(async () => { - try { - const iexecOut = process.env.IEXEC_OUT; - // Do whatever you want (let's write hello world here) - const message = process.argv.length > 2 ? process.argv[2] : 'World'; - - const text = `Hello, ${message}!`; - console.log(text); - // Append some results in /iexec_out/ - await fsPromises.writeFile(`${iexecOut}/result.txt`, text); - // Declare everything is computed - const computedJsonObj = { - 'deterministic-output-path': `${iexecOut}/result.txt`, - }; - await fsPromises.writeFile( - `${iexecOut}/computed.json`, - JSON.stringify(computedJsonObj) - ); - } catch (e) { - console.log(e); - process.exit(1); - } -})(); -``` - -```python [src/app.py] -import os -import sys -import json - -iexec_out = os.environ['IEXEC_OUT'] - -# Do whatever you want (let's write hello world here) -text = 'Hello, {}!'.format(sys.argv[1] if len(sys.argv) > 1 else "World") -print(text) - -# Append some results in /iexec_out/ -with open(iexec_out + '/result.txt', 'w+') as fout: - fout.write(text) - -# Declare everything is computed -with open(iexec_out + '/computed.json', 'w+') as f: - json.dump({ "deterministic-output-path" : iexec_out + '/result.txt' }, f) -``` - -::: - -::: warning - -As a developer, make it a rule to never log sensitive information in your -application. Execution logs are accessible by: - -- worker(s) involved in the task -- the workerpool manager -- the requester of the task - -::: - -### Dockerize your iApp - -**Copy the following content** in `Dockerfile` . - -::: code-group - -```bash [Dockerfile for JavaScript] -FROM node:22-alpine3.21 -### install your dependencies if you have some -RUN mkdir /app && cd /app -COPY ./src /app -ENTRYPOINT [ "node", "/app/app.js"] -``` - -```bash [Dockerfile for Python] -FROM python:3.13.3-alpine3.21 -### install python dependencies if you have some -COPY ./src /app -ENTRYPOINT ["python3", "/app/app.py"] -``` - -::: - -Build the docker image. - -::: warning - -iExec expects your Docker container to be built for the `linux/amd64` platform. -However, if you develop on a **Mac** with Apple **M processor**, the platform is -`linux/arm64`, which is different. To prepare your application, you will need to -install `buildkit` and then prepare your docker image for both platforms. - -```bash -brew install buildkit -# ARM64 variant for local testing only -docker buildx build --platform linux/arm64 --tag /hello-world . -# AMD64 variant to deploy on iExec -docker buildx build --platform linux/amd64 --tag /hello-world . -``` - -::: - -```bash -docker build --tag hello-world . -``` - -::: tip - -`docker build` produce an image id, using `--tag ` option is a convenient -way to name the image to reuse it in the next steps. - -::: - -**Congratulations you built your first docker image for iExec!** - -## Test your iApp locally - -### Basic test - -Create local volumes to simulate input and output directories. - -```bash -mkdir -p ./tmp/iexec_in -mkdir -p ./tmp/iexec_out -``` - -Run your application locally \(container volumes bound with local volumes\). - -```bash -docker run --rm \ - -v ./tmp/iexec_in:/iexec_in \ - -v ./tmp/iexec_out:/iexec_out \ - -e IEXEC_IN=/iexec_in \ - -e IEXEC_OUT=/iexec_out \ - hello-world arg1 arg2 arg3 -``` - -::: tip Docker run \[options\] image \[args\] - -**docker run usage:** - -`docker run [OPTIONS] IMAGE [COMMAND] [ARGS...]` - -Use `[COMMAND]` and `[ARGS...]` to simulate the requester arguments - -**useful options for iExec:** - -`-v` : Bind mount a volume. Use it to bind input and output directories -(`/iexec_in` and `/iexec_out`) - -`-e`: Set environnement variable. Use it to simulate iExec Runtime variables - -::: - -### Test with input files - -Starting with the basic test you can simulate input files. - -For each input file: - -- Copy it in the local volume bound to `/iexec_in` . -- Add `-e IEXEC_INPUT_FILE_NAME_x=NAME` to docker run options \(`x` is the index - of the file starting by 1 and `NAME` is the name of the file\) - -Add `-e IEXEC_INPUT_FILES_NUMBER=n` to docker run options \(`n` is the total -number of input files\). - -Example with two inputs files: - -```bash -touch ./tmp/iexec_in/file1 && \ -touch ./tmp/iexec_in/file2 && \ -docker run \ - -v ./tmp/iexec_in:/iexec_in \ - -v ./tmp/iexec_out:/iexec_out \ - -e IEXEC_IN=/iexec_in \ - -e IEXEC_OUT=/iexec_out \ - -e IEXEC_INPUT_FILE_NAME_1=file1 \ - -e IEXEC_INPUT_FILE_NAME_2=file2 \ - -e IEXEC_INPUT_FILES_NUMBER=2 \ - hello-world \ - arg1 arg2 arg3 -``` - -## Build the TEE docker image - -Before wrapping your iExec confidential app with Scone, you need to generate a -custom signing key. The sconification process uses this key. - -Generate your enclave signing key with: - -```bash -openssl genrsa -3 -out enclave-key.pem 3072 -``` - -This will create an `enclave-key.pem` file in your current directory. You will -use this file in the sconify Docker command to sign your TEE image. - -Use the following script to wrap the sconification process, copy the -`sconify.sh` script in the current directory: - -::: code-group - -```bash [Javascript] -#!/bin/bash - -# Declare image related variables -IMG_FROM=/hello-world -IMG_TO=/tee-scone-hello-world:1.0.0 - -# Run the sconifier to build the TEE image based on the non-TEE image -docker run -it --rm \ - -v $PWD/enclave-key.pem:/sig/enclave-key.pem \ - -v /var/run/docker.sock:/var/run/docker.sock \ - registry.scontain.com/scone-production/iexec-sconify-image:5.9.2-v16 \ - sconify_iexec \ - --scone-signer=/sig/enclave-key.pem \ - --from=${IMG_FROM} \ - --to=${IMG_TO} \ - --binary-fs \ - --fs-dir=/app \ - --host-path=/etc/hosts \ - --host-path=/etc/resolv.conf \ - --binary=/usr/local/bin/node \ - --heap=1G \ - --dlopen=1 \ - --verbose \ - && echo -e "\n------------------\n" \ - && echo "successfully built TEE docker image => ${IMG_TO}" \ - && echo "application mrenclave.fingerprint is $(docker run --rm -e SCONE_HASH=1 ${IMG_TO})" -``` - -```bash [Python] -#!/bin/bash - -# Declare image related variables -IMG_FROM=/hello-world -IMG_TO=/tee-scone-hello-world:1.0.0 - -# Run the sconifier to build the TEE image based on the non-TEE image -docker run -it --rm \ - -v $PWD/enclave-key.pem:/sig/enclave-key.pem \ - -v /var/run/docker.sock:/var/run/docker.sock \ - registry.scontain.com/scone-production/iexec-sconify-image:5.9.2-v16 \ - sconify_iexec \ - --from=${IMG_FROM} \ - --to=${IMG_TO} \ - --binary-fs \ - --fs-dir=/app \ - --host-path=/etc/hosts \ - --host-path=/etc/resolv.conf \ - --binary=/usr/local/bin/python3 \ - --heap=1G \ - --dlopen=1 \ - --verbose \ - && echo -e "\n------------------\n" \ - && echo "successfully built TEE docker image => ${IMG_TO}" \ - && echo "application mrenclave.fingerprint is $(docker run --rm -e SCONE_HASH=1 ${IMG_TO})" -``` - -::: - -Run the `sconify.sh` script to build the Scone TEE app: - -```bash -./sconify.sh -``` - -Push your image on DockerHub: - -```bash -docker login -docker push /tee-scone-hello-world:1.0.0 -``` - -Congratulations, you just built your Scone TEE app. - -## Test your iApp on iExec - -At this stage, your app is ready to be tested on iExec. The process is similar -to testing any type of app on the platform, with these minor exceptions: - -### Deploy the TEE iApp on iExec - -TEE apps require some additional information to be filled in during deployment. - -```bash -# prepare the TEE app template -iexec app init --tee -``` - -Edit `iexec.json` and fill in the standard keys and the `mrenclave` object: - -```json -{ - ... - "app": { - "owner": "", // starts with 0x - "name": "tee-scone-hello-world", // app name - "type": "DOCKER", - "multiaddr": "docker.io//tee-scone-hello-world:1.0.0", // app image - "checksum": "", // starts with 0x, update it with your own image digest - "mrenclave": { - "framework": "SCONE", // TEE framework (keep default value) - "version": "v5.9", // Scone version (keep default value) - "entrypoint": "node --disable-wasm-trap-handler /app/app.js" OR "python3 /app/app.py", // update it with your own image entrypoint - "heapSize": 1073741824, // heap size in bytes, update it with --heap option value used in sconify.sh script during TEE image build - "fingerprint": "" // fingerprint of the enclave code (mrenclave), without 0x prefix, see how to retrieve it below - } - }, - ... -} -``` - -::: info - -Run your TEE image with `SCONE_HASH=1` to get the enclave fingerprint -(mrenclave): - -```bash -docker run --rm -e SCONE_HASH=1 /tee-scone-hello-world:1.0.0 -``` - -::: - -Deploy the iApp with the standard command: - -```bash twoslash -iexec app deploy --chain {{chainName}} -``` - -You can check your deployed apps with their index, let's check your last -deployed app: - -```bash twoslash -iexec app show --chain {{chainName}} -``` - -## Run the iApp - -iExec allows you to run applications on a decentralized infrastructure with -payment in **RLC** tokens. - -::: info - -To run an application you must have enough RLC staked on your iExec account to -pay for the computing resources. - -Your iExec account is managed by smart contracts \(and not owned by iExec\). - -When you request an execution the price for the task is locked from your -account's stake then transferred to accounts of the workers contributing to the -task \(read more about [Proof of Contribution](/protocol/proof-of-contribution) -protocol\). - -At any time you can: - -- view your balance - -```bash twoslash -iexec account show --chain {{chainName}} -``` - -- deposit RLC from your wallet to your iExec Account - -```bash twoslash -iexec account deposit --chain {{chainName}} -``` - -- withdraw RLC from your iExec account to your wallet \(only stake can be - withdrawn\) - -```bash twoslash -iexec account withdraw --chain {{chainName}} -``` - -::: - -One last thing, in order to run a **TEE** iApp you will also need to select a -workerpool, use the iexec workerpool `{{workerpoolAddress}}`. - -You are now ready to run the iApp - -```bash twoslash -iexec app run --chain {{chainName}} --tag tee,scone --workerpool {{workerpoolAddress}} --watch -``` - -The execution of tasks on the iExec network is asynchronous by design. - -```mermaid -graph TD - Requester["Requester (or anyone)"] --> |"1 . Match compatible orders \n(request, application, dataset & workerpool orders) \n & Wait result" | Blockchain - Blockchain --> |2 . Notify new deal with tasks to compute| Scheduler - Worker --> |3 . Request new task to compute| Scheduler - Worker --> |4 . Run application| Application[Application image] - Worker --> |5.a. Push result| ResultStorage["Result Storage"] - Worker --> |5.b. Commit result proof| Blockchain - Workerpool --> |6 . Publish result link or callback| Blockchain - - subgraph Workerpool - Scheduler - Worker - Application - end -``` - -Guaranties about completion times (fast/slow) are available in the -[category section](/protocol/pay-per-task): - -- maximum deal/task time -- maximum computing time - -Once the task is completed copy the taskid from `iexec app run` output \(taskid -is a 32Bytes hexadecimal string\). - -Download the result of your task - -```bash twoslash -iexec task show --chain {{chainName}} --download my-result -``` - -You can get your taskid with the command: - -```bash twoslash -iexec deal show --chain {{chainName}} -``` - -::: info - -A task result is a zip file containing the output files of the application. - -::: - -[iexechub/python-hello-world](https://hub.docker.com/repository/docker/iexechub/python-hello-world) -produce an text file in `result.txt`. - -Let's discover the result of the computation. - -```bash -unzip my-result.zip -d my-result -cat my-result/result.txt -``` - -Congratulations! You successfully executed your application on iExec! - -## Publish your app on the iExec Marketplace - -Your application is deployed on iExec and you completed an execution on iExec. -For now, only you can request an execution of your application. The next step is -to publish it on the iExec Marketplace, making it available for anyone to use. - -As the owner of this application, you can define the conditions under which it -can be used - -::: info - -iExec uses orders signed by the resource owner's wallet to ensure resources -governance. - -The conditions to use an app are defined in the **apporder**. - -::: - -Publish a new apporder for your application. - -```bash twoslash -iexec app publish --chain {{chainName}} -``` - -::: info - -`iexec app publish` command allows to define custom access rules to the app -\(run `iexec app publish --help` to discover all the possibilities\). - -You will learn more about orders management later, keep the apporder default -values for now. - -::: - -Your application is now available for everyone on iExec marketplace on the -conditions defined in apporder. - -You can check the published apporders for your app - -```bash twoslash -iexec orderbook app --chain {{chainName}} -``` - -Congratulation you just created a decentralized application! Anyone can now -trigger an execution of your application on the iExec decentralized -infrastructure. - -## Next step? - -In this tutorial, you learned how to leverage your app with the power of Trusted -Execution Environments using iExec. But according to your use case, you may need -to use some confidential data to get the full potential of the **Confidential -Computing** paradigm. Check out next chapters to see how: - -- [Access confidential assets from your iApp](access-confidential-assets.md) -- [Protect the result](/guides/build-iapp/advanced/protect-the-result.md) - - diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 9e0315e3..c5615c04 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -1,26 +1,16 @@ --- -title: Build Intel TDX iApp (Experimental) +title: Build Intel TDX iApp description: Learn how to build and run Confidential Computing applications with Intel TDX technology using both traditional deployment and the iApp Generator --- -# Build Intel TDX iApp +# Build Intel TDX iApp In this tutorial, you will learn how to build and run a Confidential Computing application with Intel TDX technology using both traditional deployment and the iApp Generator. -::: info **Experimental Feature** - -TDX support is currently in experimental phase: - -- Stability and confidentiality features are still being tested and refined. -- Features may evolve based on user feedback, please share your experience on - [Discord](https://discord.com/invite/5TewNUnJHN). - -::: - Before implementing TDX, make sure you understand the foundational concepts and differences between TEE technologies. Check out our **[Intel TDX Technology](/protocol/tee/intel-tdx)** guide for comprehensive @@ -46,13 +36,12 @@ This tutorial covers two methods for building TDX applications: Thanks to **Intel TDX**, neither the source code or the binaries of your application need to be changed in order to run securely in a TEE. Only two files -need to be changed compared to the usual SGX workflow: `chain.json` and -`iexec.json`. +need to be configured: `chain.json` and `iexec.json`. iApp using Intel TDX technology follow the same format as non-TEE applications; follow the instructions on -[Build your first application](/guides/build-iapp/advanced/build-your-first-sgx-iapp) -to create and Dockerize your iApp. +[Build and deploy your first iApp](/guides/build-iapp/deploy-&-run) to create +and Dockerize your iApp. After this step, the Docker image of your iApp should be published on Docker Hub (e.g. `/hello-world:1.0.0`). @@ -61,17 +50,32 @@ After this step, the Docker image of your iApp should be published on Docker Hub Modify your `chain.json` as follows to reference the TDX Workerpool: -```json +::: code-group + +```json [Arbitrum Sepolia (testnet)] { - "default": "bellecour", + "default": "arbitrum-sepolia-testnet", "chains": { - "bellecour": { + "arbitrum-sepolia-testnet": { "sms": { "tdx": "https://sms.labs.iex.ec" } } } } ``` +```json [Arbitrum Mainnet] +{ + "default": "arbitrum-mainnet", + "chains": { + "arbitrum-mainnet": { + "sms": { "tdx": "https://sms.arbitrum-mainnet.iex.ec" } + } + } +} +``` + +::: + ### Update `iexec.json` TEE applications need a few more keys in the `iexec.json` file; run this to add @@ -88,7 +92,7 @@ Your `iexec.json` should now look like this example: ... "app": { "owner": "", // starts with 0x - "name": "tee-scone-hello-world", // application name + "name": "tee-tdx-hello-world", // application name "type": "DOCKER", "multiaddr": "/hello-world:1.0.0", // app image "checksum": "", // starts with 0x, update it with your own image digest @@ -116,12 +120,20 @@ iexec app deploy ``` To execute the iApp in TDX, add `--tag tee,tdx` to the `iexec app run` and -select the TDX workerpool (`tdx-labs.pools.iexec.eth`). +select the TDX workerpool for your target network. -```bash -iexec app run --tag tee,tdx --workerpool tdx-labs.pools.iexec.eth --watch +::: code-group + +```bash [Arbitrum Sepolia (testnet)] +iexec app run --tag tee,tdx --workerpool 0x2956f0cb779904795a5f30d3b3ea88b714c3123f --watch +``` + +```bash [Arbitrum Mainnet] +iexec app run --tag tee,tdx --workerpool 0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244 --watch ``` +::: + ::: info Remember, you can access task and iApp logs by following the instructions on @@ -187,7 +199,9 @@ iexec app show โš ๏ธ **To use** the iExec DataProtector SDK with TDX support, you must configure the SDK with the right SMS endpoint. -```jsx +::: code-group + +```jsx [Arbitrum Sepolia (testnet)] const dataProtector = new IExecDataProtector(web3Provider, { iexecOptions: { smsURL: 'https://sms.labs.iex.ec', @@ -195,17 +209,39 @@ const dataProtector = new IExecDataProtector(web3Provider, { }); ``` -โš ๏ธ**You need** to change the default worker pool in your protected Data -declaration +```jsx [Arbitrum Mainnet] +const dataProtector = new IExecDataProtector(web3Provider, { + iexecOptions: { + smsURL: 'https://sms.arbitrum-mainnet.iex.ec', + }, +}); +``` + +::: + +โš ๏ธ**You need** to specify the TDX workerpool in your `processProtectedData` +call. + +::: code-group + +```jsx [Arbitrum Sepolia (testnet)] +await dataProtector.core.processProtectedData({ + protectedData: protectedData.address, + workerpool: '0x2956f0cb779904795a5f30d3b3ea88b714c3123f', + app: '0x456def...', +}); +``` -```jsx +```jsx [Arbitrum Mainnet] await dataProtector.core.processProtectedData({ protectedData: protectedData.address, - workerpool: 'tdx-labs.pools.iexec.eth', + workerpool: '0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244', app: '0x456def...', }); ``` +::: + ### Protected Data Compatibility :::warning Protected Data Requirements @@ -275,22 +311,9 @@ EXPERIMENTAL_TDX_APP=true iapp run - **[Intel TDX Technology](/protocol/tee/intel-tdx)** - Comprehensive guide to TDX technology and benefits -- **[SGX vs TDX Comparison](/protocol/tee/sgx-vs-tdx)** - Understand the - differences between TEE technologies - **[Introduction to TEE Technologies](/protocol/tee/introduction)** - Foundation concepts of TEE technologies -### **Production Considerations** - -**For production applications**: - -- **โš ๏ธ TDX is experimental**: Consider using - **[Intel SGX Technology](/protocol/tee/intel-sgx)** for production -- **[Create Your First SGX iApp](/guides/build-iapp/advanced/build-your-first-sgx-iapp)** - - Build production-ready SGX applications -- **[Deploy & Run](/guides/build-iapp/deploy-&-run)** - Standard iApp deployment - guide - ### **Related Resources** **Explore the iExec ecosystem**: @@ -301,7 +324,3 @@ EXPERIMENTAL_TDX_APP=true iapp run in TDX - **[Advanced iApp Building](/guides/build-iapp/advanced/quick-start)** - Advanced development techniques - - diff --git a/src/guides/build-iapp/advanced/protect-the-result.md b/src/guides/build-iapp/advanced/protect-the-result.md index bc232ab1..fb713239 100644 --- a/src/guides/build-iapp/advanced/protect-the-result.md +++ b/src/guides/build-iapp/advanced/protect-the-result.md @@ -8,26 +8,17 @@ description: # Protect the result Previous tutorials showed how to build -[Confidential Computing applications](/protocol/tee/intel-sgx) that run securely -inside enclaves and combine them with confidential assets to get the most out of -confidential computing advantages. This chapter pushes things further to protect -the workflow in an end to end mode. That means the next step would be encrypting -results. - -::: warning - -Before going any further, make sure you managed to -[Build your first application with Scone framework](/guides/build-iapp/advanced/build-your-first-sgx-iapp.md). - -::: +[Confidential Computing applications](/protocol/tee/intel-tdx) that run securely +inside Trust Domains and combine them with confidential assets to get the most +out of confidential computing advantages. This chapter pushes things further to +protect the workflow in an end to end mode. That means the next step would be +encrypting results. ::: tip Prerequisites: - [Docker](https://docs.docker.com/install/) 17.05 or higher on the daemon and client. - [iExec SDK](https://www.npmjs.com/package/iexec) 8.0.0 or higher. -- Familiarity with the basic concepts of [Intelยฎ SGX](/protocol/tee/intel-sgx) - and [SCONE](https://scontain.com) framework. ::: @@ -39,17 +30,17 @@ feature. ::: Assuming your application is deployed (if not please check how to do it -[with Scone](/guides/build-iapp/advanced/build-your-first-sgx-iapp.md#deploy-the-tee-app-on-iexec)), +[with the TDX guide](/guides/build-iapp/advanced/build-your-first-tdx-iapp.md)), before triggering an execution you need to generate an RSA key-pair, then push -the public key to the [Secret Management Service](/protocol/tee/intel-sgx). The -latter, in turn, will provide it, at runtime, to the enclave running your +the public key to the [Secret Management Service](/protocol/tee/intel-tdx). The +latter, in turn, will provide it, at runtime, to the Trust Domain running your Confidential Computing application. To generate the key-pair, go to `~/iexec-projects` and use the following SDK command: Make sure your -[`chain.json`](/guides/build-iapp/advanced/build-your-first-sgx-iapp.md#update-chain-json) +[`chain.json`](/guides/build-iapp/advanced/build-your-first-tdx-iapp.md#update-chain-json) content is correct. ```bash @@ -70,13 +61,13 @@ private key in the file `<0x-your-wallet-address>_key`. Now, push the public key to the SMS: ```bash twoslash -iexec result push-encryption-key --tee-framework --chain {{chainName}} scone +iexec result push-encryption-key --tee-framework --chain {{chainName}} ``` And check it using: ```bash twoslash -iexec result check-encryption-key --tee-framework --chain {{chainName}} scone +iexec result check-encryption-key --tee-framework --chain {{chainName}} ``` Now to see that in action, you'd need to trigger a task and specify yourself as @@ -86,7 +77,7 @@ the beneficiary in the command: iexec app run <0x-your-app-address> \ --chain {{chainName}} --workerpool {{workerpoolAddress}} \ - --tag tee,scone \ + --tag tee,tdx \ --encrypt-result \ --watch ``` diff --git a/src/guides/build-iapp/advanced/quick-start.md b/src/guides/build-iapp/advanced/quick-start.md index becc20c3..8a2e295a 100644 --- a/src/guides/build-iapp/advanced/quick-start.md +++ b/src/guides/build-iapp/advanced/quick-start.md @@ -83,7 +83,7 @@ You are now familiar with the following key iExec concepts for developers: Continue with these guides: -- [Learn how to build your first confidential application running on iExec](/guides/build-iapp/advanced/build-your-first-sgx-iapp.md) +- [Learn how to build your first confidential application running on iExec](/guides/build-iapp/advanced/build-your-first-tdx-iapp.md) diff --git a/src/utils/chain.utils.ts b/src/utils/chain.utils.ts index 24366513..4e7836e9 100644 --- a/src/utils/chain.utils.ts +++ b/src/utils/chain.utils.ts @@ -1,7 +1,5 @@ import { arbitrum, arbitrumSepolia } from 'viem/chains'; -import { bellecour } from './wagmiNetworks'; import arbitrumLogo from '@/assets/icons/arbitrum.svg'; -import iexecLogo from '@/assets/icons/iexec-logo.png'; export interface Chain { id: number; @@ -44,12 +42,12 @@ export function getSupportedChains(): Chain[] { blockExplorers: arbitrum.blockExplorers, chainName: 'arbitrum-mainnet', iexecExplorerUrl: 'https://explorer.iex.ec/arbitrum-mainnet', - workerpoolAddress: '0x2C06263943180Cc024dAFfeEe15612DB6e5fD248', + workerpoolAddress: '0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244', ipfsGateway: 'https://ipfs-gateway.arbitrum-mainnet.iex.ec', web3MailAddress: '0xe7945ddc8241A877c6e59F50a61e91eBb57AfD84', - web3MailAppWhitelist: '0xD5054a18565c4a9E5c1aa3cEB53258bd59d4c78C', + web3MailAppWhitelist: '0xfa9cceff9431ee0e2a3fe58911073f1357f24e31', web3TelegramAddress: '0xa201D2C9F3464c55639589d25FA6A3ec49C9f238', - web3TelegramAppWhitelist: '0x53AFc09a647e7D5Fa9BDC784Eb3623385C45eF89', + web3TelegramAppWhitelist: '0xa7101cf61d4602d55a715be4f2b9e1bc71d22301', }, { id: arbitrumSepolia.id, @@ -58,37 +56,14 @@ export function getSupportedChains(): Chain[] { nativeCurrency: arbitrumSepolia.nativeCurrency, rpcUrls: arbitrumSepolia.rpcUrls, blockExplorers: arbitrumSepolia.blockExplorers, - chainName: 'arbitrum-sepolia', + chainName: 'arbitrum-sepolia-testnet', iexecExplorerUrl: 'https://explorer.iex.ec/arbitrum-sepolia-testnet', - workerpoolAddress: '0xB967057a21dc6A66A29721d96b8Aa7454B7c383F', + workerpoolAddress: '0x2956f0cb779904795a5f30d3b3ea88b714c3123f', ipfsGateway: 'https://ipfs-gateway.arbitrum-sepolia-testnet.iex.ec', web3MailAddress: '0x97792094EDf25a3AA607ed198aa22c32D7B33b62', - web3MailAppWhitelist: '0x8d46d40840f1Aa2264F96184Ffadf04e5D573B9B', + web3MailAppWhitelist: '0x09d59e1b696d0cb69f46bf762412636e8652ab58', web3TelegramAddress: '0x3476685f4166d4a639c85feca00e2897afd807c6', - web3TelegramAppWhitelist: '0x7291ff96100DA6CF97933C225B86124ef95aEc9b', - }, - { - id: Number(bellecour.id), - name: bellecour.name, - icon: iexecLogo, - nativeCurrency: bellecour.nativeCurrency, - rpcUrls: bellecour.rpcUrls, - blockExplorers: { - default: { - name: bellecour.blockExplorers?.default?.name || 'Blockscout', - url: - bellecour.blockExplorers?.default?.url || - 'https://blockscout-bellecour.iex.ec', - }, - }, - chainName: 'bellecour', - iexecExplorerUrl: 'https://explorer.iex.ec/bellecour', - workerpoolAddress: 'prod-v8-bellecour.main.pools.iexec.eth', - ipfsGateway: 'https://ipfs-gateway.v8-bellecour.iex.ec', - web3MailAddress: 'web3mail.apps.iexec.eth', - web3MailAppWhitelist: '0x781482C39CcE25546583EaC4957Fb7Bf04C277D2', - web3TelegramAddress: 'web3telegram.apps.iexec.eth', - web3TelegramAppWhitelist: '0x192C6f5AccE52c81Fcc2670f10611a3665AAA98F', + web3TelegramAppWhitelist: '0x7f67e78a4b0a98c50333b8b72851952c396601a1', }, ]; } diff --git a/src/utils/wagmiNetworks.ts b/src/utils/wagmiNetworks.ts index d9b15472..a2e02b0d 100644 --- a/src/utils/wagmiNetworks.ts +++ b/src/utils/wagmiNetworks.ts @@ -4,31 +4,9 @@ import { arbitrumSepolia, } from '@reown/appkit/networks'; -export const bellecour: AppKitNetwork = { - id: 0x86, - name: 'iExec Sidechain', - nativeCurrency: { - decimals: 18, - name: 'xRLC', - symbol: 'xRLC', - }, - rpcUrls: { - public: { http: ['https://bellecour.iex.ec'] }, - default: { http: ['https://bellecour.iex.ec'] }, - }, - blockExplorers: { - etherscan: { - name: 'Blockscout', - url: 'https://blockscout-bellecour.iex.ec', - }, - default: { name: 'Blockscout', url: 'https://blockscout-bellecour.iex.ec' }, - }, -}; - const wagmiNetworks = { - bellecour, arbitrum, arbitrumSepolia, -}; +} satisfies Record; export default wagmiNetworks; From 79a3f6f032b75d4846118c856c56cf6f230aa31a Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 09:15:39 +0200 Subject: [PATCH 02/10] Update tag value in manage-access.md --- src/guides/build-iapp/manage-access.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/guides/build-iapp/manage-access.md b/src/guides/build-iapp/manage-access.md index a58f252c..0d9567bf 100644 --- a/src/guides/build-iapp/manage-access.md +++ b/src/guides/build-iapp/manage-access.md @@ -55,7 +55,7 @@ Here's an example app order for a sentiment analysis iApp: "app": "0x123abc...", // Your iApp address "appprice": "1000000000", // 1 RLC per execution "volume": "100", // 100 authorized uses - "tag": "0x0000000000000000000000000000000000000000000000000000000000000003", // TEE required + "tag": "0x0000000000000000000000000000000000000000000000000000000000000009", // Tee Tdx required "datasetrestrict": "0x0000000000000000000000000000000000000000", "workerpoolrestrict": "0x0000000000000000000000000000000000000000", "requesterrestrict": "0x0000000000000000000000000000000000000000" @@ -161,7 +161,7 @@ according to your needs: "app": "0xYourAppAddress", "appprice": "1000000000", "volume": "100", - "tag": "0x0000000000000000000000000000000000000000000000000000000000000003", + "tag": "0x0000000000000000000000000000000000000000000000000000000000000009", "datasetrestrict": "0x0000000000000000000000000000000000000000", "workerpoolrestrict": "0x0000000000000000000000000000000000000000", "requesterrestrict": "0x0000000000000000000000000000000000000000" @@ -219,7 +219,7 @@ iexec order cancel --app { "appprice": "2000000000", "volume": "500", - "tag": "0x0000000000000000000000000000000000000000000000000000000000000003" + "tag": "0x0000000000000000000000000000000000000000000000000000000000000009" } ``` From 306c40d9985b11b7e8fb98a153208a930d67f336 Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 09:22:54 +0200 Subject: [PATCH 03/10] Remove prerequisites for TDX iApp tutorial Removed prerequisites section for building TDX applications. --- .../build-iapp/advanced/build-your-first-tdx-iapp.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index c5615c04..05a0661a 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -16,13 +16,6 @@ differences between TEE technologies. Check out our **[Intel TDX Technology](/protocol/tee/intel-tdx)** guide for comprehensive explanations of TDX technology and its benefits. -## Prerequisites - -- [Docker](https://docs.docker.com/install/) 17.05 or higher on the daemon and - client. -- [iExec SDK 8.13.0-tdx](https://github.com/aimen-djari/iexec-sdk/tree/feature/tdx). - Contact us to have this special release. - ## Choose Your Approach This tutorial covers two methods for building TDX applications: From 6657bb1b48bda610ea9f63ebd66a3e72b153fac8 Mon Sep 17 00:00:00 2001 From: paypes <43441600+abbesBenayache@users.noreply.github.com> Date: Thu, 23 Apr 2026 09:54:13 +0200 Subject: [PATCH 04/10] docs: restore missing TDX iApp steps from SGX doc (sconify removed, TDX-specific deploy/run) --- .vitepress/sidebar.ts | 4 - .../advanced/build-your-first-tdx-iapp.md | 561 +++++++++++++----- 2 files changed, 419 insertions(+), 146 deletions(-) diff --git a/.vitepress/sidebar.ts b/.vitepress/sidebar.ts index 8268ce32..7b01030a 100644 --- a/.vitepress/sidebar.ts +++ b/.vitepress/sidebar.ts @@ -425,10 +425,6 @@ export function getSidebar() { text: 'Intel TDX Technology', link: '/protocol/tee/intel-tdx', }, - { - text: 'Why Intel TDX?', - link: '/protocol/tee/sgx-vs-tdx', - }, ], }, { diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 05a0661a..38d5362b 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -2,46 +2,257 @@ title: Build Intel TDX iApp description: Learn how to build and run Confidential Computing applications with Intel TDX - technology using both traditional deployment and the iApp Generator + on iExec, from a Docker image to deployment and the marketplace --- -# Build Intel TDX iApp +# Build your first TDX iApp In this tutorial, you will learn how to build and run a Confidential Computing -application with Intel TDX technology using both traditional deployment and the -iApp Generator. +app with **Intel TDX (Trust Domain Extensions)** on the iExec protocol. -Before implementing TDX, make sure you understand the foundational concepts and -differences between TEE technologies. Check out our -**[Intel TDX Technology](/protocol/tee/intel-tdx)** guide for comprehensive -explanations of TDX technology and its benefits. +::: tip Prerequisites -## Choose Your Approach +- [Docker](https://docs.docker.com/install/) 17.05 or higher on the daemon and + client. +- [iExec SDK](https://www.npmjs.com/package/iexec) 8.0.0 or higher. +- Familiarity with the basics of [Intel TDX](/protocol/tee/intel-tdx) and the + iExec workflow described in + [Deploy and run an iApp](/guides/build-iapp/deploy-&-run). -This tutorial covers two methods for building TDX applications: +::: -1. **[Traditional Deployment](#build-your-application)** - Manual configuration - with `chain.json` and `iexec.json` -2. **[iApp Generator](#using-iapp-generator)** - Simplified deployment using the - iApp Generator tool +Unlike the legacy SGX/SCONE flow, **TDX does not require** a separate +sconification step: you build a **standard** `linux/amd64` OCI image, push it to +a registry, and configure the iExec app for the TDX framework (see +**[Intel TDX Technology](/protocol/tee/intel-tdx)** for what TDX provides). -## Build your application +## Prepare your app -Thanks to **Intel TDX**, neither the source code or the binaries of your -application need to be changed in order to run securely in a TEE. Only two files -need to be configured: `chain.json` and `iexec.json`. +For this tutorial, create a new directory tree. Execute the following commands +in `~/iexec-projects/`: -iApp using Intel TDX technology follow the same format as non-TEE applications; -follow the instructions on -[Build and deploy your first iApp](/guides/build-iapp/deploy-&-run) to create -and Dockerize your iApp. +```bash +cd ~/iexec-projects +mkdir tee-hello-world-tdx && cd tee-hello-world-tdx +iexec init --skip-wallet +mkdir src +touch Dockerfile +``` -After this step, the Docker image of your iApp should be published on Docker Hub -(e.g. `/hello-world:1.0.0`). +### Write the iApp logic -### Update `chain.json` +Develop your code logic as below. The following examples use JavaScript and +Python for brevity; any workload that fits in a Docker image can be used on +iExec. -Modify your `chain.json` as follows to reference the TDX Workerpool: +**Copy the following content** in `src/`. + +::: code-group + +```javascript [src/app.js] +const fsPromises = require('fs').promises; + +(async () => { + try { + const iexecOut = process.env.IEXEC_OUT; + // Do whatever you want (let's write hello world here) + const message = process.argv.length > 2 ? process.argv[2] : 'World'; + + const text = `Hello, ${message}!`; + console.log(text); + // Append some results in /iexec_out/ + await fsPromises.writeFile(`${iexecOut}/result.txt`, text); + // Declare everything is computed + const computedJsonObj = { + 'deterministic-output-path': `${iexecOut}/result.txt`, + }; + await fsPromises.writeFile( + `${iexecOut}/computed.json`, + JSON.stringify(computedJsonObj) + ); + } catch (e) { + console.log(e); + process.exit(1); + } +})(); +``` + +```python [src/app.py] +import os +import sys +import json + +iexec_out = os.environ['IEXEC_OUT'] + +# Do whatever you want (let's write hello world here) +text = 'Hello, {}!'.format(sys.argv[1] if len(sys.argv) > 1 else "World") +print(text) + +# Append some results in /iexec_out/ +with open(iexec_out + '/result.txt', 'w+') as fout: + fout.write(text) + +# Declare everything is computed +with open(iexec_out + '/computed.json', 'w+') as f: + json.dump({ "deterministic-output-path" : iexec_out + '/result.txt' }, f) +``` + +::: + +::: warning + +As a developer, make it a rule to never log sensitive information in your +application. Execution logs are accessible by: + +- worker(s) involved in the task +- the workerpool manager +- the requester of the task + +::: + +### Dockerize your iApp + +**Copy the following content** in `Dockerfile`. + +::: code-group + +```bash [Dockerfile for JavaScript] +FROM node:22-alpine3.21 +### install your dependencies if you have some +RUN mkdir /app && cd /app +COPY ./src /app +ENTRYPOINT [ "node", "/app/app.js"] +``` + +```bash [Dockerfile for Python] +FROM python:3.13.3-alpine3.21 +### install python dependencies if you have some +COPY ./src /app +ENTRYPOINT ["python3", "/app/app.py"] +``` + +::: + +Build the docker image. + +::: warning + +iExec expects your Docker container to be built for the `linux/amd64` platform. +On a **Mac** with an **Apple Silicon** chip, the default platform is +`linux/arm64`. Use buildx to produce the image for `linux/amd64`. + +```bash +brew install buildkit +# ARM64 variant for local testing only +docker buildx build --platform linux/arm64 --tag /hello-world . +# AMD64 variant to deploy on iExec +docker buildx build --platform linux/amd64 --tag /hello-world:1.0.0 --load . +``` + +::: + +```bash +docker build --tag /hello-world:1.0.0 . +``` + +::: tip + +`docker build` produces an image id; using `--tag :` is a +convenient way to name the image for the next steps. + +::: + +## Test your iApp locally + +### Basic test + +Create local volumes to simulate input and output directories. + +```bash +mkdir -p ./tmp/iexec_in +mkdir -p ./tmp/iexec_out +``` + +Run your application locally (container volumes bound with local volumes). + +```bash +docker run --rm \ + -v ./tmp/iexec_in:/iexec_in \ + -v ./tmp/iexec_out:/iexec_out \ + -e IEXEC_IN=/iexec_in \ + -e IEXEC_OUT=/iexec_out \ + /hello-world:1.0.0 arg1 arg2 arg3 +``` + +::: tip Docker run [options] image [args] + +**docker run usage:** + +`docker run [OPTIONS] IMAGE [COMMAND] [ARGS...]` + +Use `[COMMAND]` and `[ARGS...]` to simulate the requester arguments. + +**Useful options for iExec:** + +`-v` : Bind mount a volume. Use it to bind input and output directories +(`/iexec_in` and `/iexec_out`) + +`-e`: Set environment variable. Use it to simulate iExec runtime variables + +::: + +### Test with input files + +Starting with the basic test, you can simulate input files. + +For each input file: + +- Copy it in the local volume bound to `/iexec_in`. +- Add `-e IEXEC_INPUT_FILE_NAME_x=NAME` to docker run options (`x` is the index + of the file starting at 1 and `NAME` is the name of the file) + +Add `-e IEXEC_INPUT_FILES_NUMBER=n` to docker run options (`n` is the total +number of input files). + +Example with two input files: + +```bash +touch ./tmp/iexec_in/file1 && \ +touch ./tmp/iexec_in/file2 && \ +docker run \ + -v ./tmp/iexec_in:/iexec_in \ + -v ./tmp/iexec_out:/iexec_out \ + -e IEXEC_IN=/iexec_in \ + -e IEXEC_OUT=/iexec_out \ + -e IEXEC_INPUT_FILE_NAME_1=file1 \ + -e IEXEC_INPUT_FILE_NAME_2=file2 \ + -e IEXEC_INPUT_FILES_NUMBER=2 \ + /hello-world:1.0.0 \ + arg1 arg2 arg3 +``` + +## Build and push your Docker image for TDX + +For **TDX**, you use the **same** image you built and tested: there is no +enclave packaging step. Ensure the image is built for `linux/amd64`, then push +it to Docker Hub (or another registry you reference in `iexec.json`). + +```bash +docker login +docker push /hello-world:1.0.0 +``` + +You are now ready to register and run this image as a TDX iApp on iExec. + +## Test your iApp on iExec + +At this stage, your app is ready to be tested on iExec. The process is similar +to testing a non-TEE app, with TDX-specific settings below. + +### Update `chain.json` {#update-chain-json} + +Point the iExec client to the **TDX** Secret Management Service (SMS) for your +target network. Edit `chain.json` as follows (or create it if missing): ::: code-group @@ -69,29 +280,29 @@ Modify your `chain.json` as follows to reference the TDX Workerpool: ::: -### Update `iexec.json` +### Deploy the TEE iApp on iExec -TEE applications need a few more keys in the `iexec.json` file; run this to add -them automatically: +TEE apps require additional fields during deployment. Prepare the TEE app +template and select the **TDX** framework: ```bash iexec app init --tee-framework tdx ``` -Your `iexec.json` should now look like this example: +Edit `iexec.json` and fill in the standard keys and the TDX `mrenclave` object: ```json { ... "app": { "owner": "", // starts with 0x - "name": "tee-tdx-hello-world", // application name + "name": "tee-tdx-hello-world", // app name "type": "DOCKER", - "multiaddr": "/hello-world:1.0.0", // app image - "checksum": "", // starts with 0x, update it with your own image digest + "multiaddr": "docker.io//hello-world:1.0.0", // app image + "checksum": "", // starts with 0x, update with your image digest "mrenclave": { - "framework": "TDX", // TEE framework (keep default value) - } + "framework": "TDX" // TEE framework (keep default value) + } }, ... } @@ -99,98 +310,209 @@ Your `iexec.json` should now look like this example: ::: info -See [Deploy your iApp on iExec](/guides/build-iapp/deploy-&-run.md) to retrieve -your image ``. +See [Deploy your iApp on iExec](/guides/build-iapp/deploy-&-run.md) to obtain +your image `` (digest). ::: -### Deploy and run the TEE iApp +Deploy the iApp: -Deploy the iApp with the standard command: +```bash twoslash +iexec app deploy --chain {{chainName}} +``` -```bash -iexec app deploy +List your last deployed app: + +```bash twoslash +iexec app show --chain {{chainName}} ``` -To execute the iApp in TDX, add `--tag tee,tdx` to the `iexec app run` and -select the TDX workerpool for your target network. +## Run the iApp + +iExec runs applications on decentralized infrastructure; execution is paid in +**RLC** on Arbitrum networks. + +::: info + +To run an application you must have enough RLC staked on your iExec account to +pay for the computing resources. + +When you request an execution, the task cost is reserved from your accountโ€™s +stake, then distributed to workers (see +[Proof of Contribution](/protocol/proof-of-contribution)). + +At any time you can: + +- view your balance + +```bash twoslash +iexec account show --chain {{chainName}} +``` + +- deposit RLC from your wallet to your iExec account + +```bash twoslash +iexec account deposit --chain {{chainName}} +``` + +- withdraw RLC from your iExec account to your wallet (only stake can be + withdrawn) + +```bash twoslash +iexec account withdraw --chain {{chainName}} +``` + +::: + +To run a **TDX** iApp, use the TEE **tee** and **tdx** tags and a **TDX +workerpool** for the target network. + +```bash twoslash +iexec app run --chain {{chainName}} --tag tee,tdx --workerpool {{workerpoolAddress}} --watch +``` ::: code-group ```bash [Arbitrum Sepolia (testnet)] -iexec app run --tag tee,tdx --workerpool 0x2956f0cb779904795a5f30d3b3ea88b714c3123f --watch +iexec app run --chain arbitrum-sepolia-testnet --tag tee,tdx --workerpool 0x2956f0cb779904795a5f30d3b3ea88b714c3123f --watch ``` ```bash [Arbitrum Mainnet] -iexec app run --tag tee,tdx --workerpool 0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244 --watch +iexec app run --chain arbitrum-mainnet --tag tee,tdx --workerpool 0x8ef2ec3ef9535d4b4349bfec7d8b31a580e60244 --watch ``` ::: +Task execution on iExec is asynchronous. + +```mermaid +graph TD + Requester["Requester (or anyone)"] --> |"1 . Match compatible orders \n(request, application, dataset & workerpool orders) \n & Wait result" | Blockchain + Blockchain --> |2 . Notify new deal with tasks to compute| Scheduler + Worker --> |3 . Request new task to compute| Scheduler + Worker --> |4 . Run application| Application[Application image] + Worker --> |5.a. Push result| ResultStorage["Result Storage"] + Worker --> |5.b. Commit result proof| Blockchain + Workerpool --> |6 . Publish result link or callback| Blockchain + + subgraph Workerpool + Scheduler + Worker + Application + end +``` + +Guarantees about completion times (fast/slow) are described in the +[category section](/protocol/pay-per-task): maximum deal/task time, maximum +computing time, etc. + +When the task completes, copy the `taskid` from the `iexec app run` output (a +32-byte hex string). + +Download the result: + +```bash twoslash +iexec task show --chain {{chainName}} --download my-result +``` + +You can get the `taskid` for a `dealid` with: + +```bash twoslash +iexec deal show --chain {{chainName}} +``` + +::: info + +A task result is a zip file containing the application output files. + +::: + +For this hello-world app, the output includes `result.txt`. Unpack and read it: + +```bash +unzip my-result.zip -d my-result +cat my-result/result.txt +``` + +Congratulations! You have executed your application on iExec in a TDX Trust +Domain. + +## Publish your app on the iExec Marketplace + +Your app is deployed and you have completed an execution. To let others run it, +publish an **apporder** (see +[iApp access and pricing](/guides/build-iapp/manage-access) for how orders +work). + +```bash twoslash +iexec app publish --chain {{chainName}} +``` + ::: info -Remember, you can access task and iApp logs by following the instructions on -page [Debug your tasks](/guides/build-iapp/debugging). +`iexec app publish` allows custom access rules (`iexec app publish --help`). ::: +Check published app orders: + +```bash twoslash +iexec orderbook app --chain {{chainName}} +``` + +## Next steps + +In this tutorial you used **Intel TDX** on iExec to run a confidential workload. +To go further with confidential data and result protection: + +- [Access confidential assets from your iApp](/guides/build-iapp/advanced/access-confidential-assets) +- [Protect the result](/guides/build-iapp/advanced/protect-the-result) + +Deeper TEE context: + +- [Intel TDX Technology](/protocol/tee/intel-tdx) +- [Introduction to TEE technologies](/protocol/tee/introduction) + ## Using iApp Generator -The iApp Generator provides a simplified way to deploy and run TDX applications -with minimal configuration. +The [iApp Generator](/references/iapp-generator) can deploy and run **TDX** apps +with less manual `iexec.json` editing. ### Enabling TDX in iApp Generator -#### Environment Variable Method - -**Enable TDX for deployment and execution**: +**Enable TDX for deployment and execution:** ```bash -# Set the experimental flag export EXPERIMENTAL_TDX_APP=true - -# Deploy and run with TDX iapp deploy iapp run ``` -:::warning Environment Variable Declaration - -The syntax for setting environment variables differs between operating systems: +::: warning Environment variable declaration - **Mac/Linux**: `export EXPERIMENTAL_TDX_APP=true` - **Windows**: `set EXPERIMENTAL_TDX_APP=true` ::: -#### Per-Command Method - -**Enable TDX for specific commands**: +**Per command:** ```bash -# Deploy TDX-enabled iApp EXPERIMENTAL_TDX_APP=true iapp deploy - -# Run with TDX EXPERIMENTAL_TDX_APP=true iapp run - -# Debug TDX execution EXPERIMENTAL_TDX_APP=true iapp debug ``` -#### Verification - -**Check if TDX is enabled**: +**Verify TEE tags on the app:** ```bash -# Your deployed iApp should show TDX-related tags iexec app show ``` -### DataProtector SDK Configuration +### DataProtector SDK with TDX -โš ๏ธ **To use** the iExec DataProtector SDK with TDX support, you must configure -the SDK with the right SMS endpoint. +To use **DataProtector** with TDX, point the SDK at the TDX SMS (same hosts as +in [Update `chain.json`](#update-chain-json) above). ::: code-group @@ -212,8 +534,7 @@ const dataProtector = new IExecDataProtector(web3Provider, { ::: -โš ๏ธ**You need** to specify the TDX workerpool in your `processProtectedData` -call. +Pass the TDX **workerpool** in `processProtectedData`: ::: code-group @@ -235,85 +556,41 @@ await dataProtector.core.processProtectedData({ ::: -### Protected Data Compatibility - -:::warning Protected Data Requirements - -**TDX iApp may require TDX-compatible protected data.** Check compatibility -before using protected data with TDX iApp. - -::: - -**Important**: The exact process for creating TDX-compatible protected data may -differ from standard protected data creation. Consult the latest DataProtector -documentation for TDX-specific requirements. - -### Development Workflow +TDX iApps may require **TDX-compatible** protected data. Check the latest +[DataProtector](/references/dataProtector) documentation for requirements. -#### 1. **Local Testing** +**Local test (same as non-TEE):** ```bash -# Test locally (same as regular iApp) iapp test --protectedData "mock_name" - -# TDX only affects remote deployment/execution ``` -#### 2. **Deployment** +## Current limitations (experimental TDX / iApp Generator) -```bash -# Deploy TDX iApp -EXPERIMENTAL_TDX_APP=true iapp deploy -``` +::: danger Production warnings -#### 3. **Execution** - -```bash -# Run with TDX -EXPERIMENTAL_TDX_APP=true iapp run -``` - -## Current Limitations - -:::danger Production Warnings - -- **๐Ÿšซ NOT for production use** -- **๐Ÿšซ Limited worker availability** -- **๐Ÿšซ Unstable execution** environment -- **๐Ÿšซ Breaking changes** without notice +- **Not** intended for production use without your own review +- **Worker availability** and behavior may change +- **Breaking changes** possible in experimental flags and endpoints ::: -## What's Next? - -### **Continue with TDX Development** - -**Enhance your TDX application**: - -- **[Debugging Your iApp](/guides/build-iapp/debugging)** - Troubleshoot - execution issues and TDX-specific problems -- **[Inputs](/guides/build-iapp/inputs)** - Handle data inputs -- **[Outputs](/guides/build-iapp/outputs)** - Handle data outputs in TEE - environment with TDX -- **[iApp Access Control and Pricing](/guides/build-iapp/manage-access)** - - Configure access control for your TDX applications - -### **Learn More About TEE Technologies** - -**Deepen your understanding**: +### Related resources -- **[Intel TDX Technology](/protocol/tee/intel-tdx)** - Comprehensive guide to - TDX technology and benefits -- **[Introduction to TEE Technologies](/protocol/tee/introduction)** - - Foundation concepts of TEE technologies +- [iApp Generator reference](/references/iapp-generator) +- [Debugging your iApp](/guides/build-iapp/debugging) +- [Inputs](/guides/build-iapp/inputs) / [Outputs](/guides/build-iapp/outputs) +- [iApp access and pricing](/guides/build-iapp/manage-access) -### **Related Resources** + From 0181fa0a49884d61142574ee8f90389aaf50c3ad Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 10:08:41 +0200 Subject: [PATCH 05/10] Update iExec SDK version in prerequisites --- src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 38d5362b..897d1d93 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -14,7 +14,7 @@ app with **Intel TDX (Trust Domain Extensions)** on the iExec protocol. - [Docker](https://docs.docker.com/install/) 17.05 or higher on the daemon and client. -- [iExec SDK](https://www.npmjs.com/package/iexec) 8.0.0 or higher. +- [iExec SDK](https://www.npmjs.com/package/iexec) 8.24.0 or higher. - Familiarity with the basics of [Intel TDX](/protocol/tee/intel-tdx) and the iExec workflow described in [Deploy and run an iApp](/guides/build-iapp/deploy-&-run). From 8cb9d349cf34bbe7cc86f88d6d67dfb47e5b0960 Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 10:09:14 +0200 Subject: [PATCH 06/10] Remove mrenclave configuration from TDX app Removed mrenclave section from app configuration. --- src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 897d1d93..1dae1214 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -300,9 +300,6 @@ Edit `iexec.json` and fill in the standard keys and the TDX `mrenclave` object: "type": "DOCKER", "multiaddr": "docker.io//hello-world:1.0.0", // app image "checksum": "", // starts with 0x, update with your image digest - "mrenclave": { - "framework": "TDX" // TEE framework (keep default value) - } }, ... } From d055aa6ee02f46bcc9c0a9208ca4ca96e517c381 Mon Sep 17 00:00:00 2001 From: paypes <43441600+abbesBenayache@users.noreply.github.com> Date: Thu, 23 Apr 2026 10:31:13 +0200 Subject: [PATCH 07/10] refactor: remove EXPERIMENTAL_TDX_APP --- .../advanced/build-your-first-tdx-iapp.md | 14 ++--- .../iapp-generator/building-your-iexec-app.md | 51 ++++++------------- 2 files changed, 18 insertions(+), 47 deletions(-) diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 1dae1214..252fda72 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -480,24 +480,16 @@ with less manual `iexec.json` editing. **Enable TDX for deployment and execution:** ```bash -export EXPERIMENTAL_TDX_APP=true iapp deploy iapp run ``` -::: warning Environment variable declaration - -- **Mac/Linux**: `export EXPERIMENTAL_TDX_APP=true` -- **Windows**: `set EXPERIMENTAL_TDX_APP=true` - -::: - **Per command:** ```bash -EXPERIMENTAL_TDX_APP=true iapp deploy -EXPERIMENTAL_TDX_APP=true iapp run -EXPERIMENTAL_TDX_APP=true iapp debug +iapp deploy +iapp run +iapp debug ``` **Verify TEE tags on the app:** diff --git a/src/references/iapp-generator/building-your-iexec-app.md b/src/references/iapp-generator/building-your-iexec-app.md index 01caeb02..2c5708f7 100644 --- a/src/references/iapp-generator/building-your-iexec-app.md +++ b/src/references/iapp-generator/building-your-iexec-app.md @@ -123,16 +123,14 @@ algorithms and data processing here. ### `iapp init` -**Purpose**: Initialize a new iApp project -**Usage**: `iapp init` -**What it does**: Creates project structure, configuration files, and basic -templates through interactive prompts. +**Purpose**: Initialize a new iApp project **Usage**: `iapp init` **What it +does**: Creates project structure, configuration files, and basic templates +through interactive prompts. ### `iapp test` -**Purpose**: Test your iApp locally before deployment -**Usage**: `iapp test [options]` -**Options**: +**Purpose**: Test your iApp locally before deployment **Usage**: +`iapp test [options]` **Options**: - `-v, --version` [boolean] โ€“ Show version number - `--args ` โ€“ Arguments accessible inside the iApp (use quotes to group) @@ -145,18 +143,16 @@ templates through interactive prompts. ### `iapp deploy` -**Purpose**: Deploy your iApp to the iExec network -**Usage**: `iapp deploy [options]` -**Options**: +**Purpose**: Deploy your iApp to the iExec network **Usage**: +`iapp deploy [options]` **Options**: - `--chain ` โ€“ Specify the blockchain network for deployment (e.g., `arbitrum-mainnet`, `arbitrum-sepolia-testnet`) ### `iapp run ` -**Purpose**: Execute your deployed iApp on a worker node -**Usage**: `iapp run [options]` -**Positional arguments**: +**Purpose**: Execute your deployed iApp on a worker node **Usage**: +`iapp run [options]` **Positional arguments**: - `` โ€“ Address of the deployed iApp to run @@ -174,9 +170,8 @@ templates through interactive prompts. ### `iapp debug ` -**Purpose**: Retrieve detailed execution logs from worker nodes -**Usage**: `iapp debug [options]` -**Positional arguments**: +**Purpose**: Retrieve detailed execution logs from worker nodes **Usage**: +`iapp debug [options]` **Positional arguments**: - `` โ€“ The ID of the task to debug @@ -187,35 +182,19 @@ templates through interactive prompts. ### `iapp mock ` -**Purpose**: Create a mocked input for testing -**Usage**: `iapp mock [options]` -**Positional arguments**: +**Purpose**: Create a mocked input for testing **Usage**: +`iapp mock [options]` **Positional arguments**: - `` โ€“ Type of input to mock [choices: "protectedData"] ### `iapp wallet ` -**Purpose**: Manage wallet-related operations -**Usage**: `iapp wallet [options]` -**Positional arguments**: +**Purpose**: Manage wallet-related operations **Usage**: +`iapp wallet [options]` **Positional arguments**: - `` โ€“ Import a new wallet or select one from the keystore [choices: "import", "select"] -## TDX Configuration - -### `EXPERIMENTAL_TDX_APP=true` - -**Purpose**: Enable Intel [TDX](/protocol/tee/intel-tdx) support -**Usage**: Set as environment variable before running commands -**Example**: `EXPERIMENTAL_TDX_APP=true iapp deploy` - -**Available with**: - -- `iapp test` -- `iapp deploy` -- `iapp run ` - ## Next Steps Your iApp is now running on iExec! From 1933a43c783309cd221832c35249a3920524a982 Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 10:36:55 +0200 Subject: [PATCH 08/10] Remove duplicate sidebar entry for Intel TDX app Removed duplicate entry for 'Build Intel TDX app' in sidebar. --- .vitepress/sidebar.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.vitepress/sidebar.ts b/.vitepress/sidebar.ts index 7b01030a..a6858d70 100644 --- a/.vitepress/sidebar.ts +++ b/.vitepress/sidebar.ts @@ -157,6 +157,10 @@ export function getSidebar() { text: 'Quick Start', link: '/guides/build-iapp/advanced/quick-start', }, + { + text: 'Build Intel TDX app', + link: '/guides/build-iapp/advanced/build-your-first-tdx-iapp', + }, { text: 'End-to-end Encryption', link: '/guides/build-iapp/advanced/protect-the-result', @@ -168,11 +172,7 @@ export function getSidebar() { { text: 'Access Confidential Assets', link: '/guides/build-iapp/advanced/access-confidential-assets', - }, - { - text: 'Build Intel TDX app', - link: '/guides/build-iapp/advanced/build-your-first-tdx-iapp', - }, + }, ], }, ], From ccdc80a0f42b903de7bd90e7e5a8998a482dc742 Mon Sep 17 00:00:00 2001 From: raorla <159026312+raorla@users.noreply.github.com> Date: Thu, 23 Apr 2026 10:38:55 +0200 Subject: [PATCH 09/10] Delete limitations section from TDX/iApp guide Removed section on current limitations for experimental TDX/iApp Generator. --- .../build-iapp/advanced/build-your-first-tdx-iapp.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md index 252fda72..cf3f078b 100644 --- a/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md +++ b/src/guides/build-iapp/advanced/build-your-first-tdx-iapp.md @@ -554,16 +554,6 @@ TDX iApps may require **TDX-compatible** protected data. Check the latest iapp test --protectedData "mock_name" ``` -## Current limitations (experimental TDX / iApp Generator) - -::: danger Production warnings - -- **Not** intended for production use without your own review -- **Worker availability** and behavior may change -- **Breaking changes** possible in experimental flags and endpoints - -::: - ### Related resources - [iApp Generator reference](/references/iapp-generator) From ff53524d1430128e207595c4fd41e86c2cde0433 Mon Sep 17 00:00:00 2001 From: paypes <43441600+abbesBenayache@users.noreply.github.com> Date: Thu, 23 Apr 2026 14:37:48 +0200 Subject: [PATCH 10/10] style: run format --- .vitepress/sidebar.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.vitepress/sidebar.ts b/.vitepress/sidebar.ts index a6858d70..69caccab 100644 --- a/.vitepress/sidebar.ts +++ b/.vitepress/sidebar.ts @@ -172,7 +172,7 @@ export function getSidebar() { { text: 'Access Confidential Assets', link: '/guides/build-iapp/advanced/access-confidential-assets', - }, + }, ], }, ],