Skip to content

Commit 1e74a4c

Browse files
ctrlc03ctrlc03
committed
fix(vms): revert part of the verifyContribution refactoring and update terraform
1 parent 716843d commit 1e74a4c

File tree

2 files changed

+116
-104
lines changed

2 files changed

+116
-104
lines changed

‎packages/backend/aws/main.tf

+10-5
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,9 @@ resource "aws_iam_user_policy" "p0tion_s3_ssm" {
188188
"ec2:RunInstances",
189189
"ec2:DescribeInstanceStatus",
190190
"ec2:CreateTags",
191-
"iam:PassRole"
191+
"iam:PassRole",
192+
"ssm:SendCommand",
193+
"ssm:GetCommandInvocation"
192194
],
193195
"Resource": "*"
194196
}
@@ -211,11 +213,14 @@ resource "aws_iam_user_policy" "p0tion_ec2_privileged" {
211213
"Action": [
212214
"ec2:StopInstances",
213215
"ec2:TerminateInstances",
214-
"ec2:StartInstances",
215-
"ssm:SendCommand",
216-
"ssm:GetCommandInvocation"
216+
"ec2:StartInstances"
217217
],
218-
"Resource": "*"
218+
"Resource": "*",
219+
"Condition": {
220+
"StringEquals": {
221+
"aws:ResourceTag/Name": "p0tionec2instance"
222+
}
223+
}
219224
}
220225
]
221226
}

‎packages/backend/src/functions/circuit.ts

+106-99
Original file line numberDiff line numberDiff line change
@@ -512,107 +512,11 @@ export const verifycontribution = functionsV2.https.onCall(
512512
`${prefix}_${isFinalizing ? finalContributionIndex : lastZkeyIndex}.zkey`
513513
)
514514

515-
// Step (1).
516-
if (isContributing || isFinalizing) {
517-
// Prepare timer.
518-
const verificationTaskTimer = new Timer({ label: `${ceremonyId}-${circuitId}-${participantDoc.id}` })
519-
verificationTaskTimer.start()
520-
521-
// Step (1.A.3.0).
522-
if (isUsingVM) {
523-
printLog(`Starting the VM mechanism`, LogLevel.DEBUG)
524-
525-
// Prepare for VM execution.
526-
let isVMRunning = false // true when the VM is up, otherwise false.
527-
528-
// Step (1.A.3.1).
529-
await startEC2Instance(ec2, vmInstanceId)
530-
531-
await sleep(180000) // nb. wait for VM startup (3 mins).
532-
533-
// Check if the startup is running.
534-
isVMRunning = await checkIfRunning(ec2, vmInstanceId)
535-
536-
printLog(`VM running: ${isVMRunning}`, LogLevel.DEBUG)
537-
538-
// Step (1.A.3.2).
539-
// Prepare.
540-
const verificationCommand = vmContributionVerificationCommand(
541-
bucketName,
542-
lastZkeyStoragePath,
543-
verificationTranscriptStoragePathAndFilename
544-
)
545-
546-
// Run.
547-
commandId = await runCommandUsingSSM(ssm, vmInstanceId, verificationCommand)
548-
549-
printLog(`Starting the execution of command ${commandId}`, LogLevel.DEBUG)
550-
551-
// Step (1.A.3.3).
552-
new Promise<void>((resolve, reject) =>
553-
waitForVMCommandExecution(resolve, reject, ssm, vmInstanceId, commandId)
554-
)
555-
.then(async () => {
556-
// Command execution successfully completed.
557-
printLog(`Command ${commandId} execution has been successfully completed`, LogLevel.DEBUG)
558-
})
559-
.catch((error: any) => {
560-
// Command execution aborted.
561-
printLog(`Command ${commandId} execution has been aborted - Error ${error}`, LogLevel.DEBUG)
562-
563-
logAndThrowError(COMMON_ERRORS.CM_INVALID_COMMAND_EXECUTION)
564-
})
565-
} else {
566-
// CF approach.
567-
printLog(`CF mechanism`, LogLevel.DEBUG)
568-
569-
const potStoragePath = getPotStorageFilePath(files.potFilename)
570-
const firstZkeyStoragePath = getZkeyStorageFilePath(prefix, `${prefix}_${genesisZkeyIndex}.zkey`)
571-
// Prepare temporary file paths.
572-
// (nb. these are needed to download the necessary artifacts for verification from AWS S3).
573-
verificationTranscriptTemporaryLocalPath = createTemporaryLocalPath(
574-
verificationTranscriptCompleteFilename
575-
)
576-
const potTempFilePath = createTemporaryLocalPath(files.potFilename)
577-
const firstZkeyTempFilePath = createTemporaryLocalPath(firstZkeyFilename)
578-
const lastZkeyTempFilePath = createTemporaryLocalPath(lastZkeyFilename)
579-
580-
// Create and populate transcript.
581-
const transcriptLogger = createCustomLoggerForFile(verificationTranscriptTemporaryLocalPath)
582-
transcriptLogger.info(
583-
`${
584-
isFinalizing ? `Final verification` : `Verification`
585-
} transcript for ${prefix} circuit Phase 2 contribution.\n${
586-
isFinalizing ? `Coordinator ` : `Contributor # ${Number(lastZkeyIndex)}`
587-
} (${contributorOrCoordinatorIdentifier})\n`
588-
)
589-
590-
// Step (1.A.2).
591-
await downloadArtifactFromS3Bucket(bucketName, potStoragePath, potTempFilePath)
592-
await downloadArtifactFromS3Bucket(bucketName, firstZkeyStoragePath, firstZkeyTempFilePath)
593-
await downloadArtifactFromS3Bucket(bucketName, lastZkeyStoragePath, lastZkeyTempFilePath)
594-
595-
printLog(`Downloads from AWS S3 bucket completed - ceremony ${ceremonyId}`, LogLevel.DEBUG)
596-
597-
// Step (1.A.4).
598-
isContributionValid = await zKey.verifyFromInit(
599-
firstZkeyTempFilePath,
600-
potTempFilePath,
601-
lastZkeyTempFilePath,
602-
transcriptLogger
603-
)
604-
605-
// Compute contribution hash.
606-
lastZkeyBlake2bHash = await blake512FromPath(lastZkeyTempFilePath)
607-
608-
// Free resources by unlinking temporary folders.
609-
// Do not free-up verification transcript path here.
610-
fs.unlinkSync(potTempFilePath)
611-
fs.unlinkSync(firstZkeyTempFilePath)
612-
fs.unlinkSync(lastZkeyTempFilePath)
613-
}
515+
const verificationTaskTimer = new Timer({ label: `${ceremonyId}-${circuitId}-${participantDoc.id}` })
614516

517+
const completeVerification = async () => {
615518
// Stop verification task timer.
519+
printLog("Completing verification", LogLevel.DEBUG)
616520
verificationTaskTimer.stop()
617521
verifyCloudFunctionExecutionTime = verificationTaskTimer.ms()
618522

@@ -809,6 +713,109 @@ export const verifycontribution = functionsV2.https.onCall(
809713
LogLevel.DEBUG
810714
)
811715
}
716+
717+
// Step (1).
718+
if (isContributing || isFinalizing) {
719+
// Prepare timer.
720+
verificationTaskTimer.start()
721+
722+
// Step (1.A.3.0).
723+
if (isUsingVM) {
724+
printLog(`Starting the VM mechanism`, LogLevel.DEBUG)
725+
726+
// Prepare for VM execution.
727+
let isVMRunning = false // true when the VM is up, otherwise false.
728+
729+
// Step (1.A.3.1).
730+
await startEC2Instance(ec2, vmInstanceId)
731+
732+
await sleep(180000) // nb. wait for VM startup (3 mins).
733+
734+
// Check if the startup is running.
735+
isVMRunning = await checkIfRunning(ec2, vmInstanceId)
736+
737+
printLog(`VM running: ${isVMRunning}`, LogLevel.DEBUG)
738+
739+
// Step (1.A.3.2).
740+
// Prepare.
741+
const verificationCommand = vmContributionVerificationCommand(
742+
bucketName,
743+
lastZkeyStoragePath,
744+
verificationTranscriptStoragePathAndFilename
745+
)
746+
747+
// Run.
748+
commandId = await runCommandUsingSSM(ssm, vmInstanceId, verificationCommand)
749+
750+
printLog(`Starting the execution of command ${commandId}`, LogLevel.DEBUG)
751+
752+
// Step (1.A.3.3).
753+
return new Promise<void>((resolve, reject) =>
754+
waitForVMCommandExecution(resolve, reject, ssm, vmInstanceId, commandId)
755+
)
756+
.then(async () => {
757+
// Command execution successfully completed.
758+
printLog(`Command ${commandId} execution has been successfully completed`, LogLevel.DEBUG)
759+
await completeVerification()
760+
})
761+
.catch((error: any) => {
762+
// Command execution aborted.
763+
printLog(`Command ${commandId} execution has been aborted - Error ${error}`, LogLevel.DEBUG)
764+
765+
logAndThrowError(COMMON_ERRORS.CM_INVALID_COMMAND_EXECUTION)
766+
})
767+
} else {
768+
// CF approach.
769+
printLog(`CF mechanism`, LogLevel.DEBUG)
770+
771+
const potStoragePath = getPotStorageFilePath(files.potFilename)
772+
const firstZkeyStoragePath = getZkeyStorageFilePath(prefix, `${prefix}_${genesisZkeyIndex}.zkey`)
773+
// Prepare temporary file paths.
774+
// (nb. these are needed to download the necessary artifacts for verification from AWS S3).
775+
verificationTranscriptTemporaryLocalPath = createTemporaryLocalPath(
776+
verificationTranscriptCompleteFilename
777+
)
778+
const potTempFilePath = createTemporaryLocalPath(files.potFilename)
779+
const firstZkeyTempFilePath = createTemporaryLocalPath(firstZkeyFilename)
780+
const lastZkeyTempFilePath = createTemporaryLocalPath(lastZkeyFilename)
781+
782+
// Create and populate transcript.
783+
const transcriptLogger = createCustomLoggerForFile(verificationTranscriptTemporaryLocalPath)
784+
transcriptLogger.info(
785+
`${
786+
isFinalizing ? `Final verification` : `Verification`
787+
} transcript for ${prefix} circuit Phase 2 contribution.\n${
788+
isFinalizing ? `Coordinator ` : `Contributor # ${Number(lastZkeyIndex)}`
789+
} (${contributorOrCoordinatorIdentifier})\n`
790+
)
791+
792+
// Step (1.A.2).
793+
await downloadArtifactFromS3Bucket(bucketName, potStoragePath, potTempFilePath)
794+
await downloadArtifactFromS3Bucket(bucketName, firstZkeyStoragePath, firstZkeyTempFilePath)
795+
await downloadArtifactFromS3Bucket(bucketName, lastZkeyStoragePath, lastZkeyTempFilePath)
796+
797+
printLog(`Downloads from AWS S3 bucket completed - ceremony ${ceremonyId}`, LogLevel.DEBUG)
798+
799+
// Step (1.A.4).
800+
isContributionValid = await zKey.verifyFromInit(
801+
firstZkeyTempFilePath,
802+
potTempFilePath,
803+
lastZkeyTempFilePath,
804+
transcriptLogger
805+
)
806+
807+
// Compute contribution hash.
808+
lastZkeyBlake2bHash = await blake512FromPath(lastZkeyTempFilePath)
809+
810+
// Free resources by unlinking temporary folders.
811+
// Do not free-up verification transcript path here.
812+
fs.unlinkSync(potTempFilePath)
813+
fs.unlinkSync(firstZkeyTempFilePath)
814+
fs.unlinkSync(lastZkeyTempFilePath)
815+
816+
await completeVerification()
817+
}
818+
}
812819
}
813820
)
814821

0 commit comments

Comments
 (0)