Fix gramine-direct issue while rendering entrypoint manifest file

[DukeDavis12]

Description of the changes

Fix gramine-direct issue while rendering entrypoint manifest file.

Gramine-direct expects trusted files to be in a TOML table structure.
Changes based on commit aef087f [LibOS] Move trusted and allowed files logic to LibOS.

How to test this PR?

Manual Testing

---

This change is 

[DukeDavis12]

@kailun-qin @woju @mkow Please review.

[woju]

Reviewed 1 of 1 files at r1, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions, not enough approvals from maintainers (3 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @DukeDavis12)

---

finalize_manifest.py line 36 at r1 (raw file):

    expanded_files = []
    for uri in trusted_files:
        file_path = urlparse(uri).path

Our file: are fake and do not conform to IANA file: urls. You should just .split(':', 1) them and check if the left part is file', or equivalently if uri.startswith('file:'), or sth like that. In any case, please do not use urllib to parse them.

---

finalize_manifest.py line 37 at r1 (raw file):

    for uri in trusted_files:
        file_path = urlparse(uri).path
        if os.path.exists(file_path):

And if it does not exist? What should be the expected behaviour if the file does not exist at the time of manifest generation?

---

finalize_manifest.py line 159 at r1 (raw file):

    if 'allow_all_but_log' not in rendered_manifest_dict['sgx'].get('file_check_policy', ''):
        trusted_files = generate_trusted_files(args.dir, already_added_files)
        rendered_manifest_dict['sgx']['trusted_files'] = expand_trusted_files(trusted_files + already_added_files)

why did you change .setdefault() to =?

[DukeDavis12]

Reviewed 1 of 1 files at r1, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions, not enough approvals from maintainers (3 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @DukeDavis12)

finalize_manifest.py line 36 at r1 (raw file):

    expanded_files = []
    for uri in trusted_files:
        file_path = urlparse(uri).path

Our file: are fake and do not conform to IANA file: urls. You should just .split(':', 1) them and check if the left part is file', or equivalently if uri.startswith('file:'), or sth like that. In any case, please do not use urllib to parse them.

• Updated.

finalize_manifest.py line 37 at r1 (raw file):

    for uri in trusted_files:
        file_path = urlparse(uri).path
        if os.path.exists(file_path):

And if it does not exist? What should be the expected behaviour if the file does not exist at the time of manifest generation?

• Updated.

finalize_manifest.py line 159 at r1 (raw file):

    if 'allow_all_but_log' not in rendered_manifest_dict['sgx'].get('file_check_policy', ''):
        trusted_files = generate_trusted_files(args.dir, already_added_files)
        rendered_manifest_dict['sgx']['trusted_files'] = expand_trusted_files(trusted_files + already_added_files)

why did you change .setdefault() to =?

.setdefault() is designed to only set a value if the key does not already exist in the dictionary.

The above approach ensures that the trusted_files key in the rendered_manifest_dict['sgx'] dictionary is set to the result of expand_trusted_files(trusted_files + already_added_files), regardless of whether the key was previously present or not (Creates key if not present).

However, if you want to use .setdefault() to ensure the key exists and then update its value, you can do it in two steps:

1. Use .setdefault() to ensure the key exists.
2. Update the value of the key.

I have updated PR to reflect the last method of using setDefault and then updating the value.

The reason why I am not extending trusted_files is that the trusted_files might already contain entry in trusted_files= [ "URI", "URI"] format.
Example: https://github.com/gramineproject/gsc/blob/master/test/generic.manifest#L5 ; extending just appends expanded_files to trusted_files along with existing ["URI", "URI"] entry resulting in failure during run-time.