How to run my version:

mkdir Project-Cerberus
cd Project-Cerberus
~/.local/bin/repo init -u https://github.com/jacc-sovv/cerberus-dev-manifest -b master
~/.local/bin/repo sync
cd cerberus
rm -rf build
mkdir build
cd build
cmake -G Ninja ../projects/linux/testing/
ninja
./cerberus-linux-unit-tests

How to run with the server:

1. Extract the server from the tar file I sent
2. Run the server first, it will wait for client to connect
   2a) If on the CSU machines, type:

module load python/bundle-3.9
(If you don't have cryptography already installed)
pip3 install cryptography --user

3. Run the client

Project Cerberus is designed to be a hardware root of trust (RoT) for server platforms. It provides functionality to enforce secure boot for firmware on devices with or without intrinsic secure boot capabilities. It also provides a mechanism to securely attest to the state of the device firmware.

Details of Project Cerberus's goals and design can be found at https://github.com/opencomputeproject/Project_Olympus/tree/master/Project_Cerberus.

The Cerberus source code relies on some external dependencies and allows for customization and extension to different devices. To support these various dependencies, the repo tool is used for local source code management.

Details about the repo tool can be found at https://gerrit.googlesource.com/git-repo/+/refs/heads/master/README.md.

In order to use repo, it must be installed on the system and accessible through $PATH.

mkdir ~/.local/bin
curl https://storage.googleapis.com/git-repo-downloads/repo > ~/.local/bin/repo
chmod a+rx ~/.local/bin/repo

The repo tool is designed to work in a Linux environment, so there are some difficulties working with repo in Windows. See the repo documentation for details regarding Windows support at https://gerrit.googlesource.com/git-repo/+/refs/heads/master/docs/windows.md

If repo is still not working, there are two other options for using repo in Windows.

1. Use Windows Subsystem for Linux (WSL). This has the benefit of not needing anything special for repo to work, but has the downside of not actually being a Windows development enviroment.

2. There exists an old version of repo ported to work in Windows. Details of this project can be found on github at https://github.com/esrlabs/git-repo. See the README.md in that project for installation details.

If no option for repo is working on Windows and Windows must be used, then git repositories must be manually cloned per the repo manifest file.

Once repo is installed, it will be used to download the Cerberus source code into a local working copy.

This will the typical method for initializing the local repository.

mkdir Project-Cerberus
cd Project-Cerberus
~/.local/bin/repo init -u https://github.com/jacc-sovv/cerberus-dev-manifest -b master
~/.local/bin/repo sync

If an SSH connection is desired or required to retrieve the Cerberus code, the repository must be initalized in this way.

mkdir Project-Cerberus
cd Project-Cerberus
repo init -u [email protected]:Azure/Project-Cerberus-manifest.git -m default-ssh.xml -b master
repo sync

The core set of source code provides a set of basline functionality that can be integrated and ported to devices that require Cerberus functionality. Most of the code available here is agnostic to the actual device that it will run on, with abstraction layers defined where necessary.

The Cerberus source tree is structured as follows:

The baseline Cerberus source code comes with support for some projects that are generally useful.

The Linux platform port exists only to support development and unit testing of core Cerberus code. It is not guaranteed to be production ready code.

To add support for additional platforms and/or devices, additions must be made to the source tree. These additional components can be added to the local source tree by adding additional project definitions in local repo manifests in the .repo/local_manifests directory. More details about this process can be found at https://gerrit.googlesource.com/git-repo/+/refs/heads/master/docs/manifest-format.md.

There will typically be two types of additions.

1. New 3rd party components required for the project. These will be added to the external directory.
2. A target platform or specific application build. These will be added to the projects directory.

Without any additional projects, the Cerberus code can be built on Linux and the unit tests can be run. This provides the main development environment for adding core functionality and serves as an example for creating new projects.

1. Install pre-requisites

   sudo apt install git build-essential libssl-dev ninja-build cmake lcov

2. Install latest cmake

   # Download CMake install script
   wget https://github.com/Kitware/CMake/releases/download/v3.16.2/cmake-3.16.2-Linux-x86_64.sh
   chmod +x cmake-3.16.2-Linux-x86_64.sh
   
   # Install CMake
   ./cmake-3.16.2-Linux-x86_64.sh --prefix=~/.local #--skip-license
   
   # Validate CMake version is 3.16
   cmake --version

3. Under the Cerberus source folder create "build" folder

   cd <cerberus_src_dir>
   mkdir build
   cd build

4. Create the build scripts

   cmake -G Ninja ../projects/linux/testing/

5. Build the Cerberus source

   ninja

6. Run Unit Tests

   ./cerberus-linux-unit-tests

The unit test build includes a target which runs the unit tests and generates a code coverate report. If necessary, this target also builds the unit tests. The report output can be found at build/coverage_report.

1. Complete steps 1-4 from the previous section

2. Build, run unit tests, and generate coverage report

   ninja coverage

Cerberus code is developed following Test-Driven Development (TDD) practices. Any code submissions are expected to be similarly developed.

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.