feat: Remove storage and TDX-releated PCSs from SGX manifests

Author: matevz

build/rofl/manifest.go

@@ -167,7 +167,7 @@ func (m *Manifest) Validate() error {
 		return fmt.Errorf("unsupported app kind: %s", m.Kind)
 	}
 
-	if err := m.Resources.Validate(); err != nil {
+	if err := m.Resources.Validate(m.TEE); err != nil {
 		return fmt.Errorf("bad resources config: %w", err)
 	}
 
@@ -443,13 +443,18 @@ type ResourcesConfig struct {
 }
 
 // Validate validates the resources configuration for correctness.
-func (r *ResourcesConfig) Validate() error {
+func (r *ResourcesConfig) Validate(tee string) error {
 	if r.Memory < 16 {
 		return fmt.Errorf("memory size must be at least 16M")
 	}
 	if r.CPUCount < 1 {
 		return fmt.Errorf("vCPU count must be at least 1")
 	}
+
+	if tee == TEETypeSGX && r.Storage != nil {
+		return fmt.Errorf("SGX apps do not support disk storage")
+	}
+
 	if r.Storage != nil {
 		err := r.Storage.Validate()
 		if err != nil {

cmd/rofl/mgmt.go

@@ -110,6 +110,14 @@ var (
 
 			switch manifest.TEE {
 			case buildRofl.TEETypeTDX:
+				// TDX requires storage settings.
+				if !reset {
+					manifest.Resources.Storage = &buildRofl.StorageConfig{
+						Kind: buildRofl.StorageKindDiskPersistent,
+						Size: 512,
+					}
+				}
+
 				switch appKind {
 				case buildRofl.AppKindRaw:
 					artifacts := buildRofl.LatestBasicArtifacts // Copy.
@@ -235,6 +243,12 @@ var (
 					debugMode = params.DebugAllowTestRuntimes
 				}
 
+				// For TDX assign empty quote policies by default.
+				var tdxQuotePolicy *pcs.TdxQuotePolicy
+				if manifest.TEE == buildRofl.TEETypeTDX {
+					tdxQuotePolicy = &pcs.TdxQuotePolicy{}
+				}
+
 				// Generate manifest and a default policy which does not accept any enclaves.
 				deployment = &buildRofl.Deployment{
 					Network:  npa.NetworkName,
@@ -246,7 +260,7 @@ var (
 							PCS: &pcs.QuotePolicy{
 								TCBValidityPeriod:          30,
 								MinTCBEvaluationDataNumber: 18,
-								TDX:                        &pcs.TdxQuotePolicy{},
+								TDX:                        tdxQuotePolicy,
 							},
 						},
 						Endorsements: []rofl.AllowedEndorsement{