Star6
7
代码
代码
Issues8
Pull Requests6
流水线
项目讨论
Wiki
分析
Star6
7
已合并
Add secGear starterkit example #363
王家寅创建于 5月2日
Add secGear starterkit example #363
已合并
王家寅创建于 5月2日
从weixin_43762511/secGearadd-secgear-starterkit合入到openeuler/secGearmaster
共 30 个文件变更+1313-0
Aexamples/secgear_starterkit/.gitignore+36-0
@@ -0,0 +1,36 @@
1+# Build directories
2+build/
3+*/build/
4+**/build/
5+ 
6+# Generated projects
7+generated/
8+ 
9+# CMake generated files
10+CMakeCache.txt
11+CMakeFiles/
12+cmake_install.cmake
13+Makefile
14+ 
15+# Build outputs
16+*.o
17+*.so
18+*.a
19+*.signed.so
20+*_host
21+a.out
22+ 
23+# Temporary signing keys generated during local builds
24+*.pem
25+ 
26+# Temporary files
27+*.tmp
28+*.log
29+.DS_Store
30+ 
31+# secGear codegen outputs
32+*_t.c
33+*_t.h
34+*_u.c
35+*_u.h
36+*_args.h
Aexamples/secgear_starterkit/Copyright+2-0
@@ -0,0 +1,2 @@
1+Copyright (c) 2026 secGear contributors.
2+This secgear_starterkit example is part of the secGear project and is licensed under the Mulan PSL v2.
Aexamples/secgear_starterkit/README.md+145-0
@@ -0,0 +1,145 @@
1+# secgear-starterkit
2+ 
3+## 1. 项目简介
4+ 
5+secgear-starterkit 是一个面向 openEuler secGear 的机密应用 StarterKit，提供项目脚手架、真实样例和自动化测试模板。
6+ 
7+项目目标是降低 secGear 应用开发门槛，补齐从官方最小样例到可复用工程模板之间的工程化空档，帮助开发者快速完成 secGear 工程初始化、EDL 代理代码生成、host/enclave 构建与签名、自动化 smoke test 验证以及新项目脚手架生成。
8+ 
9+## 2. 项目价值
10+ 
11+openEuler secGear 已经提供机密计算基础能力，但开发者在创建 secGear 应用时，仍需要手动处理 EDL、代理代码生成、host/enclave 构建、enclave 签名、SGX 环境运行验证等流程。
12+ 
13+本项目将这些流程整理为可复用模板、样例工程、脚手架生成器和自动化测试入口，帮助开发者更快启动新的 secGear 应用项目。
14+ 
15+## 3. 功能特性
16+ 
17+- 提供 templates/basic 最小 secGear 工程模板；
18+- 提供 examples/seal_data 独立样例；
19+- 提供 scripts/init.sh，一键生成新的 secGear 项目；
20+- 提供自动化 smoke test；
21+- 提供统一测试入口 tests/run_all.sh；
22+- 已在支持 SGX 的 openEuler 22.03 LTS 环境完成真机验证。
23+ 
24+## 4. 项目结构
25+ 
26+secgear-starterkit/
27+├── templates/
28+│ └── basic/
29+├── examples/
30+│ └── seal_data/
31+├── scripts/
32+│ ├── build.sh
33+│ ├── init.sh
34+│ ├── run.sh
35+│ └── run_seal_data.sh
36+├── tests/
37+│ ├── run_all.sh
38+│ └── smoke/
39+├── docs/
40+├── .gitignore
41+└── README.md
42+ 
43+## 5. 环境要求
44+ 
45+- openEuler 22.03 LTS
46+- x86_64
47+- 支持 Intel SGX 的运行环境
48+- 系统存在以下 SGX 设备节点：
49+ - /dev/sgx_enclave
50+ - /dev/sgx_provision
51+- 已安装 secGear 相关依赖
52+ 
53+## 6. 快速开始
54+ 
55+### 6.1 运行全量 smoke test
56+ 
57+执行：
58+ 
59+ bash tests/run_all.sh
60+ 
61+预期结果：
62+ 
63+ All smoke tests passed.
64+ 
65+### 6.2 运行 basic 样例
66+ 
67+执行：
68+ 
69+ bash scripts/run.sh
70+ 
71+预期结果：
72+ 
73+ message from enclave: hello from secGear starterkit
74+ sum from enclave: 42
75+ 
76+### 6.3 运行 seal_data 样例
77+ 
78+执行：
79+ 
80+ bash scripts/run_seal_data.sh
81+ 
82+预期结果：
83+ 
84+ sealed result: ENC:secret-for-demo
85+ sealed length: 20
86+ unsealed result: secret-for-demo
87+ unsealed length: 16
88+ 
89+## 7. 生成新项目
90+ 
91+执行：
92+ 
93+ bash scripts/init.sh ci_demo_app
94+ 
95+生成的新项目位于：
96+ 
97+ generated/ci_demo_app
98+ 
99+可进入该目录进行独立构建验证。
100+ 
101+## 8. 测试说明
102+ 
103+项目提供统一测试入口：
104+ 
105+ bash tests/run_all.sh
106+ 
107+该入口覆盖三条链路：
108+ 
109+1. templates/basic 基础模板构建与签名；
110+2. examples/seal_data 样例构建与签名；
111+3. scripts/init.sh 生成的新项目独立构建与签名。
112+ 
113+详细测试报告见：
114+ 
115+ docs/test-report.md
116+ 
117+安全说明见：
118+ 
119+ docs/security-note.md
120+ 
121+## 9. openEuler 适配说明
122+ 
123+本项目已在支持 SGX 的 openEuler 22.03 LTS 环境完成验证，验证内容包括：
124+ 
125+- openEuler 系统环境检查；
126+- SGX CPU 特征检查；
127+- SGX 设备节点检查；
128+- host/enclave 构建；
129+- enclave 签名；
130+- SGX 真机运行；
131+- 自动化 smoke test。
132+ 
133+## 10. 当前限制
134+ 
135+当前版本中，seal_data 样例采用稳定占位实现，重点用于展示 StarterKit 在样例扩展、接口封装和端到端运行链路上的能力。
136+ 
137+后续可以继续扩展为更真实的机密数据处理样例。
138+ 
139+## 11. 社区贡献价值
140+ 
141+本项目可作为 openEuler secGear 的工程模板、示例集合和测试基线，帮助开发者更快理解和使用 secGear 开发机密计算应用。
142+ 
143+## 12. License
144+ 
145+本示例随 secGear 项目采用 Mulan PSL v2 许可证。
Aexamples/secgear_starterkit/docs/security-note.md+21-0
@@ -0,0 +1,21 @@
1+# 安全说明
2+ 
3+## 1. Enclave_private.pem 说明
4+ 
5+secgear-starterkit 在本地构建 SGX 示例时，会在 build/ 目录中临时生成 Enclave_private.pem，用于 enclave 开发签名和本地验证。
6+ 
7+该密钥仅用于示例、教学和 smoke test，不应用于生产环境。
8+ 
9+本项目不会将 Enclave_private.pem 作为源码文件提交。
10+ 
11+## 2. 生产环境建议
12+ 
13+在真实生产环境中，应使用正式密钥管理流程生成、保存和使用 enclave 签名密钥。
14+ 
15+生产密钥不应提交到公开代码仓库，也不应打包到示例项目中。
16+ 
17+## 3. 构建产物说明
18+ 
19+项目构建过程中会生成 build/ 目录、*.so、*.signed.so、host 可执行文件和 CMake 缓存文件。
20+ 
21+这些文件属于构建产物，不建议作为源码提交。.gitignore 已对这些文件进行排除。
Aexamples/secgear_starterkit/docs/test-report.md+73-0
@@ -0,0 +1,73 @@
1+# secgear-starterkit 测试报告
2+ 
3+## 1. 测试环境
4+ 
5+- 操作系统：openEuler 22.03 LTS
6+- 架构：x86_64
7+- CPU：Intel Xeon Platinum 8369B
8+- SGX CPU 特征：sgx / sgx_lc
9+- SGX 设备节点：
10+ - /dev/sgx_enclave
11+ - /dev/sgx_provision
12+ 
13+## 2. 自动化测试
14+ 
15+测试命令：
16+ 
17+ bash tests/run_all.sh
18+ 
19+测试覆盖三条链路：
20+ 
21+1. templates/basic 基础模板构建与签名；
22+2. examples/seal_data 样例构建与签名；
23+3. scripts/init.sh 生成的新项目独立构建与签名。
24+ 
25+测试结果：
26+ 
27+ All smoke tests passed.
28+ 
29+## 3. basic 样例 SGX 真机运行验证
30+ 
31+测试命令：
32+ 
33+ bash scripts/run.sh
34+ 
35+运行结果：
36+ 
37+ message from enclave: hello from secGear starterkit
38+ sum from enclave: 42
39+ 
40+结论：
41+ 
42+basic 样例已在 SGX 真机环境中成功创建并执行 enclave。
43+ 
44+## 4. seal_data 样例 SGX 真机运行验证
45+ 
46+测试命令：
47+ 
48+ bash scripts/run_seal_data.sh
49+ 
50+运行结果：
51+ 
52+ sealed result: ENC:secret-for-demo
53+ sealed length: 20
54+ unsealed result: secret-for-demo
55+ unsealed length: 16
56+ 
57+结论：
58+ 
59+seal_data 样例已完成 SGX 环境下的端到端运行验证。当前版本采用稳定占位实现，用于展示 StarterKit 在样例扩展、接口封装和运行链路上的能力。
60+ 
61+## 5. 总体结论
62+ 
63+secgear-starterkit 已在支持 SGX 的 openEuler 22.03 LTS 环境完成自动化测试和真机运行验证。
64+ 
65+项目当前已经具备：
66+ 
67+- secGear 基础模板能力；
68+- 第二独立样例能力；
69+- 一键脚手架生成能力；
70+- 自动化 smoke test 能力；
71+- SGX 真机运行验证结果。
72+ 
73+测试结论：通过。
Aexamples/secgear_starterkit/docs/verification.md+55-0
@@ -0,0 +1,55 @@
1+## 验证结果
2+ 
3+### 1. 自动化验证结果
4+ 
5+项目已提供统一自动化测试入口 `tests/run_all.sh`，用于验证：
6+ 
7+- `templates/basic` 基础模板构建与签名链路
8+- `examples/seal_data` 样例构建与签名链路
9+- `scripts/init.sh` 生成项目的独立构建链路
10+ 
11+### 2. SGX 真机运行验证
12+ 
13+项目已在支持 SGX 的 openEuler 22.03 LTS 环境上完成真机运行验证。
14+ 
15+#### basic 样例运行结果
16+ 
17+`basic` 样例已成功创建并运行 enclave，输出结果如下：
18+ 
19+- `message from enclave: hello from secGear starterkit`
20+- `sum from enclave: 42`
21+ 
22+这说明 StarterKit 不仅能够完成工程生成、构建、签名和测试，而且已经具备真实 SGX 环境中的 enclave 创建与执行能力。
23+ 
24+#### seal_data 样例运行结果
25+ 
26+`seal_data` 样例当前采用稳定占位实现，用于展示密封/解封装的工程接口和端到端运行链路。真机运行结果如下：
27+ 
28+- `sealed result: ENC:secret-for-demo`
29+- `sealed length: 20`
30+- `unsealed result: secret-for-demo`
31+- `unsealed length: 16`
32+ 
33+### 3. 环境说明
34+ 
35+真机验证环境具备以下特征：
36+ 
37+- 操作系统：openEuler 22.03 LTS
38+- 架构：x86_64
39+- CPU 特征：包含 `sgx` / `sgx_lc`
40+- 设备节点：存在 `/dev/sgx_enclave` 与 `/dev/sgx_provision`
41+ 
42+### 4. 当前交付范围
43+ 
44+当前稳定交付版本已经覆盖：
45+ 
46+- 基础模板工程
47+- 第二样例工程
48+- 一键生成脚手架
49+- 自动化 smoke test
50+- SGX 真机运行验证（basic 样例）
51+- SGX 真机运行验证（seal_data 占位版样例）
52+ 
53+### 5. 当前限制
54+ 
55+当前版本中，`seal_data` 已完成工程链路与真机运行验证，但仍采用稳定占位逻辑，用于优先保证 StarterKit 的模板化、脚手架化和自动化验证能力。后续可继续沿着更真实的机密数据处理样例方向演进。
Aexamples/secgear_starterkit/examples/seal_data/CMakeLists.txt+33-0
@@ -0,0 +1,33 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+cmake_minimum_required(VERSION 3.16)
10+project(secgear_seal_data C)
11+ 
12+if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|amd64|AMD64")
13+ message(STATUS "secgear-starterkit SGX example is only enabled on x86_64; skip on ${CMAKE_SYSTEM_PROCESSOR}")
14+ return()
15+endif()
16+ 
17+set(CMAKE_C_STANDARD 11)
18+set(CMAKE_C_STANDARD_REQUIRED ON)
19+set(CMAKE_SKIP_RPATH TRUE)
20+ 
21+set(SECGEAR_INCLUDE_DIR /usr/include/secGear)
22+set(SECGEAR_LIB /usr/lib64/libsecgear.so)
23+ 
24+set(SGX_SDK /opt/intel/sgxsdk)
25+set(SGX_SDK_INCLUDE_DIR ${SGX_SDK}/include)
26+set(SGX_SDK_LIB_DIR ${SGX_SDK}/lib64)
27+ 
28+include_directories(
29+ ${SECGEAR_INCLUDE_DIR}
30+)
31+ 
32+add_subdirectory(host)
33+add_subdirectory(enclave)
Aexamples/secgear_starterkit/examples/seal_data/enclave/CMakeLists.txt+77-0
@@ -0,0 +1,77 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+set(ENCLAVE_NAME enclave)
10+set(ENCLAVE_SIGNED ${CMAKE_BINARY_DIR}/enclave.signed.so)
11+ 
12+add_library(${ENCLAVE_NAME} SHARED
13+ enclave.c
14+ seal_data_t.c
15+)
16+ 
17+target_include_directories(${ENCLAVE_NAME} PRIVATE
18+ ${CMAKE_CURRENT_BINARY_DIR}
19+ ${CMAKE_CURRENT_SOURCE_DIR}
20+ ${SGX_SDK_INCLUDE_DIR}
21+ ${SGX_SDK_INCLUDE_DIR}/tlibc
22+ ${SGX_SDK_INCLUDE_DIR}/libcxx
23+ ${SECGEAR_INCLUDE_DIR}
24+)
25+ 
26+target_compile_options(${ENCLAVE_NAME} PRIVATE
27+ -m64
28+ -O2
29+ -fPIC
30+ -fvisibility=hidden
31+ -Wno-attributes
32+)
33+ 
34+target_link_directories(${ENCLAVE_NAME} PRIVATE
35+ ${SGX_SDK_LIB_DIR}
36+)
37+ 
38+target_link_options(${ENCLAVE_NAME} PRIVATE
39+ -nostdlib
40+ -nodefaultlibs
41+ -nostartfiles
42+ -Wl,-z,defs
43+ -Wl,-z,now
44+ -Wl,-z,relro
45+ -Wl,-z,noexecstack
46+ -Wl,-pie
47+ -Wl,-Bstatic
48+ -Wl,-Bsymbolic
49+ -Wl,-eenclave_entry
50+ -Wl,--export-dynamic
51+ -Wl,--defsym,__ImageBase=0
52+ -Wl,--gc-sections
53+ -Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/Enclave.lds
54+)
55+ 
56+target_link_libraries(${ENCLAVE_NAME}
57+ -Wl,--whole-archive sgx_trts -Wl,--no-whole-archive
58+ -Wl,--start-group
59+ sgx_tstdc
60+ sgx_tcxx
61+ sgx_tcrypto
62+ sgx_tservice
63+ -Wl,--end-group
64+)
65+ 
66+add_custom_command(
67+ TARGET ${ENCLAVE_NAME}
68+ POST_BUILD
69+ COMMAND umask 0177
70+ COMMAND openssl genrsa -3 -out ${CMAKE_CURRENT_BINARY_DIR}/Enclave_private.pem 3072
71+ COMMAND /opt/intel/sgxsdk/bin/x64/sgx_sign sign
72+ -key ${CMAKE_CURRENT_BINARY_DIR}/Enclave_private.pem
73+ -enclave ${CMAKE_CURRENT_BINARY_DIR}/lib${ENCLAVE_NAME}.so
74+ -out ${ENCLAVE_SIGNED}
75+ -config ${CMAKE_CURRENT_SOURCE_DIR}/Enclave.config.xml
76+ VERBATIM
77+)
Aexamples/secgear_starterkit/examples/seal_data/enclave/Enclave.config.xml+11-0
@@ -0,0 +1,11 @@
1+<EnclaveConfiguration>
2+ <ProdID>0</ProdID>
3+ <ISVSVN>0</ISVSVN>
4+ <StackMaxSize>0x40000</StackMaxSize>
5+ <HeapMaxSize>0x40000</HeapMaxSize>
6+ <TCSNum>10</TCSNum>
7+ <TCSPolicy>1</TCSPolicy>
8+ <DisableDebug>0</DisableDebug>
9+ <MiscSelect>0</MiscSelect>
10+ <MiscMask>0xFFFFFFFF</MiscMask>
11+</EnclaveConfiguration>
Aexamples/secgear_starterkit/examples/seal_data/enclave/Enclave.lds+10-0
@@ -0,0 +1,10 @@
1+enclave.so
2+{
3+ global:
4+ g_global_data_sim;
5+ g_global_data;
6+ enclave_entry;
7+ g_peak_heap_used;
8+ local:
9+ *;
10+};
Aexamples/secgear_starterkit/examples/seal_data/enclave/enclave.c+76-0
@@ -0,0 +1,76 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+#include <string.h>
12+#include "seal_data_t.h"
13+ 
14+#define ENC_PREFIX "ENC:"
15+#define ENC_PREFIX_LEN ((int)(sizeof(ENC_PREFIX) - sizeof(char)))
16+#define ENC_TAIL_LEN ((int)sizeof(char))
17+#define ENC_OVERHEAD_LEN (ENC_PREFIX_LEN + ENC_TAIL_LEN)
18+ 
19+static void CopyBytes(char *dst, const char *src, int len)
20+{
21+ int i;
22+ 
23+ if (dst == NULL || src == NULL || len <= 0) {
24+ return;
25+ }
26+ 
27+ for (i = 0; i < len; ++i) {
28+ dst[i] = src[i];
29+ }
30+}
31+ 
32+int SealData(char *plain, int plainLen, char *sealedBuf, int sealedBufLen, int *sealedLen)
33+{
34+ if (plain == NULL || sealedBuf == NULL || sealedLen == NULL) {
35+ return -1;
36+ }
37+ 
38+ if (plainLen <= 0 || sealedBufLen < plainLen + ENC_OVERHEAD_LEN) {
39+ return -1;
40+ }
41+ 
42+ CopyBytes(sealedBuf, ENC_PREFIX, ENC_PREFIX_LEN);
43+ CopyBytes(sealedBuf + ENC_PREFIX_LEN, plain, plainLen);
44+ sealedBuf[ENC_PREFIX_LEN + plainLen] = '\0';
45+ *sealedLen = plainLen + ENC_OVERHEAD_LEN;
46+ 
47+ return 0;
48+}
49+ 
50+int UnsealData(char *sealedBuf, int sealedLen, char *plainBuf, int plainBufLen, int *plainLen)
51+{
52+ int payloadLen;
53+ 
54+ if (sealedBuf == NULL || plainBuf == NULL || plainLen == NULL) {
55+ return -1;
56+ }
57+ 
58+ if (sealedLen <= ENC_OVERHEAD_LEN) {
59+ return -1;
60+ }
61+ 
62+ payloadLen = sealedLen - ENC_OVERHEAD_LEN;
63+ if (payloadLen <= 0 || plainBufLen < payloadLen + ENC_TAIL_LEN) {
64+ return -1;
65+ }
66+ 
67+ if (strncmp(sealedBuf, ENC_PREFIX, ENC_PREFIX_LEN) != 0) {
68+ return -1;
69+ }
70+ 
71+ CopyBytes(plainBuf, sealedBuf + ENC_PREFIX_LEN, payloadLen);
72+ plainBuf[payloadLen] = '\0';
73+ *plainLen = payloadLen;
74+ 
75+ return 0;
76+}
Aexamples/secgear_starterkit/examples/seal_data/host/CMakeLists.txt+29-0
@@ -0,0 +1,29 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+add_executable(secgear_seal_data_host
10+ main.c
11+ seal_data_u.c
12+)
13+ 
14+target_include_directories(secgear_seal_data_host PRIVATE
15+ ${CMAKE_CURRENT_SOURCE_DIR}
16+ ${SECGEAR_INCLUDE_DIR}
17+ ${SGX_SDK_INCLUDE_DIR}
18+)
19+ 
20+target_link_libraries(secgear_seal_data_host
21+ ${SECGEAR_LIB}
22+ /usr/lib64/libsgx_urts.so
23+ /opt/intel/sgxsdk/lib64/libsgx_uae_service.so
24+ pthread
25+)
26+ 
27+set_target_properties(secgear_seal_data_host PROPERTIES
28+ RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}
29+)
Aexamples/secgear_starterkit/examples/seal_data/host/main.c+77-0
@@ -0,0 +1,77 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+#include <stdio.h>
12+#include <string.h>
13+#include "enclave.h"
14+#include "seal_data_u.h"
15+ 
16+#define BUF_LEN 256
17+#define ENCLAVE_PATH "./enclave.signed.so"
18+ 
19+int main(void)
20+{
21+ cc_enclave_t context = {0};
22+ cc_enclave_result_t res;
23+ int retval = 0;
24+ 
25+ char plain[] = "secret-for-demo";
26+ char sealed[BUF_LEN] = {0};
27+ char unsealed[BUF_LEN] = {0};
28+ int sealedLen = 0;
29+ int plainLen = 0;
30+ 
31+ res = cc_enclave_create(ENCLAVE_PATH,
32+ AUTO_ENCLAVE_TYPE,
33+ 0,
34+ SECGEAR_DEBUG_FLAG,
35+ NULL,
36+ 0,
37+ &context);
38+ if (res != CC_SUCCESS) {
39+ printf("cc_enclave_create failed: 0x%x\n", res);
40+ return 1;
41+ }
42+ 
43+ res = SealData(&context, &retval,
44+ plain, (int)strlen(plain),
45+ sealed, BUF_LEN,
46+ &sealedLen);
47+ if (res != CC_SUCCESS || retval != 0) {
48+ printf("SealData failed: res=0x%x retval=%d\n", res, retval);
49+ cc_enclave_destroy(&context);
50+ return 1;
51+ }
52+ 
53+ printf("sealed result: %s\n", sealed);
54+ printf("sealed length: %d\n", sealedLen);
55+ 
56+ res = UnsealData(&context, &retval,
57+ sealed, sealedLen,
58+ unsealed, BUF_LEN,
59+ &plainLen);
60+ if (res != CC_SUCCESS || retval != 0) {
61+ printf("UnsealData failed: res=0x%x retval=%d\n", res, retval);
62+ cc_enclave_destroy(&context);
63+ return 1;
64+ }
65+ 
66+ unsealed[plainLen] = '\0';
67+ printf("unsealed result: %s\n", unsealed);
68+ printf("unsealed length: %d\n", plainLen);
69+ 
70+ res = cc_enclave_destroy(&context);
71+ if (res != CC_SUCCESS) {
72+ printf("cc_enclave_destroy failed: 0x%x\n", res);
73+ return 1;
74+ }
75+ 
76+ return 0;
77+}
Aexamples/secgear_starterkit/examples/seal_data/seal_data.edl+31-0
@@ -0,0 +1,31 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+enclave {
12+ include "secgear_urts.h" from "secgear_tstdc.edl" import *;
13+ 
14+ trusted {
15+ public int SealData(
16+ [in, size=plainLen] char *plain,
17+ int plainLen,
18+ [out, size=sealedBufLen] char *sealedBuf,
19+ int sealedBufLen,
20+ [out] int *sealedLen
21+ );
22+ 
23+ public int UnsealData(
24+ [in, size=sealedLen] char *sealedBuf,
25+ int sealedLen,
26+ [out, size=plainBufLen] char *plainBuf,
27+ int plainBufLen,
28+ [out] int *plainLen
29+ );
30+ };
31+};
Aexamples/secgear_starterkit/scripts/build.sh+45-0
@@ -0,0 +1,45 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
13+TEMPLATE_DIR="${PROJECT_ROOT}/templates/basic"
14+BUILD_DIR="${TEMPLATE_DIR}/build"
15+ 
16+echo "[1/4] enter template directory"
17+cd "${TEMPLATE_DIR}"
18+ 
19+echo "[2/4] regenerate proxy code"
20+codegen --sgx \
21+ --search-path /usr/include/secGear \
22+ --search-path /opt/intel/sgxsdk/include \
23+ --search-path . \
24+ --trusted-dir enclave \
25+ --untrusted-dir host \
26+ starterkit.edl
27+ 
28+echo "[3/4] configure cmake"
29+mkdir -p "${BUILD_DIR}"
30+cd "${BUILD_DIR}"
31+cmake ..
32+ 
33+echo "[4/4] build targets"
34+make -j2
35+ 
36+echo
37+echo "Build finished."
38+echo "Host binary: ${BUILD_DIR}/secgear_starterkit_host"
39+echo "Signed enclave: ${BUILD_DIR}/enclave.signed.so"
40+ 
41+ARCH="$(uname -m)"
42+if [ "${ARCH}" != "x86_64" ]; then
43+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
44+ exit 0
45+fi
Aexamples/secgear_starterkit/scripts/init.sh+63-0
@@ -0,0 +1,63 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+if [[ $# -ne 1 ]]; then
13+ echo "Usage: $0 <project_name>"
14+ exit 1
15+fi
16+ 
17+PROJECT_NAME="$1"
18+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
19+TEMPLATE_DIR="${PROJECT_ROOT}/templates/basic"
20+OUTPUT_ROOT="${PROJECT_ROOT}/generated"
21+TARGET_DIR="${OUTPUT_ROOT}/${PROJECT_NAME}"
22+ 
23+mkdir -p "${OUTPUT_ROOT}"
24+ 
25+if [[ -e "${TARGET_DIR}" ]]; then
26+ echo "Target already exists: ${TARGET_DIR}"
27+ exit 1
28+fi
29+ 
30+echo "[1/6] copy template"
31+cp -r "${TEMPLATE_DIR}" "${TARGET_DIR}"
32+ 
33+echo "[2/6] remove build directory"
34+rm -rf "${TARGET_DIR}/build"
35+ 
36+echo "[3/6] rename edl and generated proxy files"
37+mv "${TARGET_DIR}/starterkit.edl" "${TARGET_DIR}/${PROJECT_NAME}.edl"
38+mv "${TARGET_DIR}/host/starterkit_u.c" "${TARGET_DIR}/host/${PROJECT_NAME}_u.c"
39+mv "${TARGET_DIR}/host/starterkit_u.h" "${TARGET_DIR}/host/${PROJECT_NAME}_u.h"
40+mv "${TARGET_DIR}/enclave/starterkit_t.c" "${TARGET_DIR}/enclave/${PROJECT_NAME}_t.c"
41+mv "${TARGET_DIR}/enclave/starterkit_t.h" "${TARGET_DIR}/enclave/${PROJECT_NAME}_t.h"
42+ 
43+echo "[4/6] replace template identifiers"
44+find "${TARGET_DIR}" -type f \
45+ \( -name '*.c' -o -name '*.h' -o -name '*.txt' -o -name '*.edl' -o -name 'CMakeLists.txt' -o -name '*.xml' -o -name '*.lds' \) \
46+ -exec sed -i "s/starterkit/${PROJECT_NAME}/g" {} +
47+ 
48+echo "[5/6] regenerate proxy code"
49+cd "${TARGET_DIR}"
50+codegen --sgx \
51+ --search-path /usr/include/secGear \
52+ --search-path /opt/intel/sgxsdk/include \
53+ --search-path . \
54+ --trusted-dir enclave \
55+ --untrusted-dir host \
56+ "${PROJECT_NAME}.edl"
57+ 
58+echo "[6/6] done"
59+echo "Generated project: ${TARGET_DIR}"
60+echo "Build it with:"
61+echo " cd ${TARGET_DIR}"
62+echo " mkdir -p build && cd build"
63+echo " cmake .. && make -j2"
Aexamples/secgear_starterkit/scripts/run.sh+44-0
@@ -0,0 +1,44 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
13+BUILD_DIR="${PROJECT_ROOT}/templates/basic/build"
14+HOST_BIN="${BUILD_DIR}/secgear_starterkit_host"
15+ 
16+echo "[1/3] check build outputs"
17+if [[ ! -x "${HOST_BIN}" ]]; then
18+ echo "Host binary not found: ${HOST_BIN}"
19+ echo "Please run scripts/build.sh first."
20+ exit 1
21+fi
22+ 
23+if [[ ! -f "${BUILD_DIR}/enclave.signed.so" ]]; then
24+ echo "Signed enclave not found: ${BUILD_DIR}/enclave.signed.so"
25+ echo "Please run scripts/build.sh first."
26+ exit 1
27+fi
28+ 
29+echo "[2/3] check SGX runtime environment"
30+if [[ ! -e /dev/sgx_enclave && ! -e /dev/sgx_provision && ! -e /dev/isgx ]]; then
31+ echo "No SGX device found on this machine."
32+ echo "Build is successful, but runtime validation requires SGX-enabled hardware."
33+ exit 2
34+fi
35+ 
36+echo "[3/3] run host program"
37+cd "${BUILD_DIR}"
38+LD_LIBRARY_PATH=/usr/lib64:/opt/intel/sgxsdk/lib64 ./secgear_starterkit_host
39+ 
40+ARCH="$(uname -m)"
41+if [ "${ARCH}" != "x86_64" ]; then
42+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
43+ exit 0
44+fi
Aexamples/secgear_starterkit/scripts/run_seal_data.sh+44-0
@@ -0,0 +1,44 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
13+BUILD_DIR="${PROJECT_ROOT}/examples/seal_data/build"
14+HOST_BIN="${BUILD_DIR}/secgear_seal_data_host"
15+ 
16+echo "[1/3] check build outputs"
17+if [[ ! -x "${HOST_BIN}" ]]; then
18+ echo "Host binary not found: ${HOST_BIN}"
19+ echo "Please build examples/seal_data first."
20+ exit 1
21+fi
22+ 
23+if [[ ! -f "${BUILD_DIR}/enclave.signed.so" ]]; then
24+ echo "Signed enclave not found: ${BUILD_DIR}/enclave.signed.so"
25+ echo "Please build examples/seal_data first."
26+ exit 1
27+fi
28+ 
29+echo "[2/3] check SGX runtime environment"
30+if [[ ! -e /dev/sgx_enclave && ! -e /dev/sgx_provision && ! -e /dev/isgx ]]; then
31+ echo "No SGX device found on this machine."
32+ echo "Runtime validation requires SGX-enabled hardware."
33+ exit 2
34+fi
35+ 
36+echo "[3/3] run seal_data example"
37+cd "${BUILD_DIR}"
38+LD_LIBRARY_PATH=/usr/lib64:/opt/intel/sgxsdk/lib64 ./secgear_seal_data_host
39+ 
40+ARCH="$(uname -m)"
41+if [ "${ARCH}" != "x86_64" ]; then
42+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
43+ exit 0
44+fi
Aexamples/secgear_starterkit/templates/basic/CMakeLists.txt+33-0
@@ -0,0 +1,33 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+cmake_minimum_required(VERSION 3.16)
10+project(secgear_starterkit C)
11+ 
12+if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|amd64|AMD64")
13+ message(STATUS "secgear-starterkit SGX example is only enabled on x86_64; skip on ${CMAKE_SYSTEM_PROCESSOR}")
14+ return()
15+endif()
16+ 
17+set(CMAKE_C_STANDARD 11)
18+set(CMAKE_C_STANDARD_REQUIRED ON)
19+set(CMAKE_SKIP_RPATH TRUE)
20+ 
21+set(SECGEAR_INCLUDE_DIR /usr/include/secGear)
22+set(SECGEAR_LIB /usr/lib64/libsecgear.so)
23+ 
24+set(SGX_SDK /opt/intel/sgxsdk)
25+set(SGX_SDK_INCLUDE_DIR ${SGX_SDK}/include)
26+set(SGX_SDK_LIB_DIR ${SGX_SDK}/lib64)
27+ 
28+include_directories(
29+ ${SECGEAR_INCLUDE_DIR}
30+)
31+ 
32+add_subdirectory(host)
33+add_subdirectory(enclave)
Aexamples/secgear_starterkit/templates/basic/enclave/CMakeLists.txt+77-0
@@ -0,0 +1,77 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+set(ENCLAVE_NAME enclave)
10+set(ENCLAVE_SIGNED ${CMAKE_BINARY_DIR}/enclave.signed.so)
11+ 
12+add_library(${ENCLAVE_NAME} SHARED
13+ enclave.c
14+ starterkit_t.c
15+)
16+ 
17+target_include_directories(${ENCLAVE_NAME} PRIVATE
18+ ${CMAKE_CURRENT_BINARY_DIR}
19+ ${CMAKE_CURRENT_SOURCE_DIR}
20+ ${SGX_SDK_INCLUDE_DIR}
21+ ${SGX_SDK_INCLUDE_DIR}/tlibc
22+ ${SGX_SDK_INCLUDE_DIR}/libcxx
23+ ${SECGEAR_INCLUDE_DIR}
24+)
25+ 
26+target_compile_options(${ENCLAVE_NAME} PRIVATE
27+ -m64
28+ -O2
29+ -fPIC
30+ -fvisibility=hidden
31+ -Wno-attributes
32+)
33+ 
34+target_link_directories(${ENCLAVE_NAME} PRIVATE
35+ ${SGX_SDK_LIB_DIR}
36+)
37+ 
38+target_link_options(${ENCLAVE_NAME} PRIVATE
39+ -nostdlib
40+ -nodefaultlibs
41+ -nostartfiles
42+ -Wl,-z,defs
43+ -Wl,-z,now
44+ -Wl,-z,relro
45+ -Wl,-z,noexecstack
46+ -Wl,-pie
47+ -Wl,-Bstatic
48+ -Wl,-Bsymbolic
49+ -Wl,-eenclave_entry
50+ -Wl,--export-dynamic
51+ -Wl,--defsym,__ImageBase=0
52+ -Wl,--gc-sections
53+ -Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/Enclave.lds
54+)
55+ 
56+target_link_libraries(${ENCLAVE_NAME}
57+ -Wl,--whole-archive sgx_trts -Wl,--no-whole-archive
58+ -Wl,--start-group
59+ sgx_tstdc
60+ sgx_tcxx
61+ sgx_tcrypto
62+ sgx_tservice
63+ -Wl,--end-group
64+)
65+ 
66+add_custom_command(
67+ TARGET ${ENCLAVE_NAME}
68+ POST_BUILD
69+ COMMAND umask 0177
70+ COMMAND openssl genrsa -3 -out ${CMAKE_CURRENT_BINARY_DIR}/Enclave_private.pem 3072
71+ COMMAND /opt/intel/sgxsdk/bin/x64/sgx_sign sign
72+ -key ${CMAKE_CURRENT_BINARY_DIR}/Enclave_private.pem
73+ -enclave ${CMAKE_CURRENT_BINARY_DIR}/lib${ENCLAVE_NAME}.so
74+ -out ${ENCLAVE_SIGNED}
75+ -config ${CMAKE_CURRENT_SOURCE_DIR}/Enclave.config.xml
76+ VERBATIM
77+)
Aexamples/secgear_starterkit/templates/basic/enclave/Enclave.config.xml+11-0
@@ -0,0 +1,11 @@
1+<EnclaveConfiguration>
2+ <ProdID>0</ProdID>
3+ <ISVSVN>0</ISVSVN>
4+ <StackMaxSize>0x40000</StackMaxSize>
5+ <HeapMaxSize>0x40000</HeapMaxSize>
6+ <TCSNum>10</TCSNum>
7+ <TCSPolicy>1</TCSPolicy>
8+ <DisableDebug>0</DisableDebug>
9+ <MiscSelect>0</MiscSelect>
10+ <MiscMask>0xFFFFFFFF</MiscMask>
11+</EnclaveConfiguration>
Aexamples/secgear_starterkit/templates/basic/enclave/Enclave.lds+10-0
@@ -0,0 +1,10 @@
1+enclave.so
2+{
3+ global:
4+ g_global_data_sim;
5+ g_global_data;
6+ enclave_entry;
7+ g_peak_heap_used;
8+ local:
9+ *;
10+};
Aexamples/secgear_starterkit/templates/basic/enclave/enclave.c+50-0
@@ -0,0 +1,50 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+#include "starterkit_t.h"
12+ 
13+#define MSG "hello from secGear starterkit"
14+ 
15+#define MESSAGE_BUF_SIZE 64
16+ 
17+static int CopyString(char *dst, int dstLen, const char *src)
18+{
19+ int i;
20+ 
21+ if (dst == NULL || src == NULL || dstLen <= 0) {
22+ return -1;
23+ }
24+ 
25+ for (i = 0; src[i] != '\0'; ++i) {
26+ if (i + 1 >= dstLen) {
27+ dst[0] = '\0';
28+ return -1;
29+ }
30+ dst[i] = src[i];
31+ }
32+ 
33+ dst[i] = '\0';
34+ return 0;
35+}
36+ 
37+int GetMessage(char *buf)
38+{
39+ return CopyString(buf, MESSAGE_BUF_SIZE, MSG);
40+}
41+ 
42+int AddNumbers(int a, int b, int *sum)
43+{
44+ if (sum == NULL) {
45+ return -1;
46+ }
47+ 
48+ *sum = a + b;
49+ return 0;
50+}
Aexamples/secgear_starterkit/templates/basic/host/CMakeLists.txt+29-0
@@ -0,0 +1,29 @@
1+# Copyright (c) 2026 secGear contributors.
2+# secGear is licensed under the Mulan PSL v2.
3+# You can use this software according to the terms and conditions of the Mulan PSL v2.
4+# You may obtain a copy of Mulan PSL v2 at:
5+# http://license.coscl.org.cn/MulanPSL2
6+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
7+# See the Mulan PSL v2 for more details.
8+ 
9+add_executable(secgear_starterkit_host
10+ main.c
11+ starterkit_u.c
12+)
13+ 
14+target_include_directories(secgear_starterkit_host PRIVATE
15+ ${CMAKE_CURRENT_SOURCE_DIR}
16+ ${SECGEAR_INCLUDE_DIR}
17+ ${SGX_SDK_INCLUDE_DIR}
18+)
19+ 
20+target_link_libraries(secgear_starterkit_host
21+ ${SECGEAR_LIB}
22+ /usr/lib64/libsgx_urts.so
23+ /opt/intel/sgxsdk/lib64/libsgx_uae_service.so
24+ pthread
25+)
26+ 
27+set_target_properties(secgear_starterkit_host PROPERTIES
28+ RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}
29+)
Aexamples/secgear_starterkit/templates/basic/host/main.c+66-0
@@ -0,0 +1,66 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+#include <stdio.h>
12+#include "enclave.h"
13+#include "starterkit_u.h"
14+ 
15+#define BUF_LEN 64
16+#define LEFT_ADDEND 7
17+#define RIGHT_ADDEND 35
18+#define EXPECTED_ADD_RESULT 42
19+ 
20+#define ENCLAVE_PATH "./enclave.signed.so"
21+ 
22+int main(void)
23+{
24+ cc_enclave_t context = {0};
25+ cc_enclave_result_t res;
26+ int retval = 0;
27+ 
28+ char buf[BUF_LEN] = {0};
29+ int sum = 0;
30+ 
31+ res = cc_enclave_create(ENCLAVE_PATH,
32+ AUTO_ENCLAVE_TYPE,
33+ 0,
34+ SECGEAR_DEBUG_FLAG,
35+ NULL,
36+ 0,
37+ &context);
38+ if (res != CC_SUCCESS) {
39+ printf("cc_enclave_create failed: 0x%x\n", res);
40+ return 1;
41+ }
42+ 
43+ res = GetMessage(&context, &retval, buf);
44+ if (res != CC_SUCCESS || retval != 0) {
45+ printf("GetMessage failed: res=0x%x retval=%d\n", res, retval);
46+ cc_enclave_destroy(&context);
47+ return 1;
48+ }
49+ printf("message from enclave: %s\n", buf);
50+ 
51+ res = AddNumbers(&context, &retval, LEFT_ADDEND, RIGHT_ADDEND, &sum);
52+ if (res != CC_SUCCESS || retval != 0) {
53+ printf("AddNumbers failed: res=0x%x retval=%d\n", res, retval);
54+ cc_enclave_destroy(&context);
55+ return 1;
56+ }
57+ printf("sum from enclave: %d\n", sum);
58+ 
59+ res = cc_enclave_destroy(&context);
60+ if (res != CC_SUCCESS) {
61+ printf("cc_enclave_destroy failed: 0x%x\n", res);
62+ return 1;
63+ }
64+ 
65+ return 0;
66+}
Aexamples/secgear_starterkit/templates/basic/starterkit.edl+18-0
@@ -0,0 +1,18 @@
1+/*
2+ * Copyright (c) 2026 secGear contributors.
3+ * secGear is licensed under the Mulan PSL v2.
4+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
5+ * You may obtain a copy of Mulan PSL v2 at:
6+ * http://license.coscl.org.cn/MulanPSL2
7+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+ * See the Mulan PSL v2 for more details.
9+ */
10+ 
11+enclave {
12+ include "secgear_urts.h" from "secgear_tstdc.edl" import *;
13+ 
14+ trusted {
15+ public int GetMessage([out, size=64] char *buf);
16+ public int AddNumbers(int a, int b, [out] int *sum);
17+ };
18+};
Aexamples/secgear_starterkit/tests/run_all.sh+32-0
@@ -0,0 +1,32 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
13+ 
14+echo "[1/3] run basic template smoke test"
15+"${PROJECT_ROOT}/tests/smoke/test_build.sh"
16+ 
17+echo
18+echo "[2/3] run seal_data smoke test"
19+"${PROJECT_ROOT}/tests/smoke/test_seal_data_build.sh"
20+ 
21+echo
22+echo "[3/3] run generated project smoke test"
23+"${PROJECT_ROOT}/tests/smoke/test_init_generated_project.sh"
24+ 
25+echo
26+echo "All smoke tests passed."
27+ 
28+ARCH="$(uname -m)"
29+if [ "${ARCH}" != "x86_64" ]; then
30+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
31+ exit 0
32+fi
Aexamples/secgear_starterkit/tests/smoke/test_build.sh+30-0
@@ -0,0 +1,30 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
13+BUILD_SCRIPT="${PROJECT_ROOT}/scripts/build.sh"
14+BUILD_DIR="${PROJECT_ROOT}/templates/basic/build"
15+ 
16+echo "[1/3] run build script"
17+"${BUILD_SCRIPT}"
18+ 
19+echo "[2/3] verify build outputs"
20+test -x "${BUILD_DIR}/secgear_starterkit_host"
21+test -f "${BUILD_DIR}/enclave/libenclave.so"
22+test -f "${BUILD_DIR}/enclave.signed.so"
23+ 
24+echo "[3/3] smoke build test passed"
25+ 
26+ARCH="$(uname -m)"
27+if [ "${ARCH}" != "x86_64" ]; then
28+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
29+ exit 0
30+fi
Aexamples/secgear_starterkit/tests/smoke/test_init_generated_project.sh+42-0
@@ -0,0 +1,42 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
13+GENERATED_ROOT="${PROJECT_ROOT}/generated"
14+PROJECT_NAME="ci_demo_app"
15+TARGET_DIR="${GENERATED_ROOT}/${PROJECT_NAME}"
16+ 
17+echo "[1/4] clean old generated project"
18+rm -rf "${TARGET_DIR}"
19+ 
20+echo "[2/4] generate new project"
21+cd "${PROJECT_ROOT}"
22+./scripts/init.sh "${PROJECT_NAME}"
23+ 
24+echo "[3/4] build generated project"
25+cd "${TARGET_DIR}"
26+mkdir -p build
27+cd build
28+cmake ..
29+make -j2
30+ 
31+echo "[4/4] verify outputs"
32+test -x "${TARGET_DIR}/build/secgear_${PROJECT_NAME}_host"
33+test -f "${TARGET_DIR}/build/enclave/libenclave.so"
34+test -f "${TARGET_DIR}/build/enclave.signed.so"
35+ 
36+echo "generated project smoke test passed"
37+ 
38+ARCH="$(uname -m)"
39+if [ "${ARCH}" != "x86_64" ]; then
40+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
41+ exit 0
42+fi
Aexamples/secgear_starterkit/tests/smoke/test_seal_data_build.sh+43-0
@@ -0,0 +1,43 @@
1+#!/usr/bin/env bash
2+# Copyright (c) 2026 secGear contributors.
3+# secGear is licensed under the Mulan PSL v2.
4+# You can use this software according to the terms and conditions of the Mulan PSL v2.
5+# You may obtain a copy of Mulan PSL v2 at:
6+# http://license.coscl.org.cn/MulanPSL2
7+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND.
8+# See the Mulan PSL v2 for more details.
9+ 
10+set -euo pipefail
11+ 
12+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
13+EXAMPLE_DIR="${PROJECT_ROOT}/examples/seal_data"
14+BUILD_DIR="${EXAMPLE_DIR}/build"
15+ 
16+echo "[1/3] regenerate proxy code"
17+cd "${EXAMPLE_DIR}"
18+codegen --sgx \
19+ --search-path /usr/include/secGear \
20+ --search-path /opt/intel/sgxsdk/include \
21+ --search-path . \
22+ --trusted-dir enclave \
23+ --untrusted-dir host \
24+ seal_data.edl
25+ 
26+echo "[2/3] configure and build"
27+mkdir -p "${BUILD_DIR}"
28+cd "${BUILD_DIR}"
29+cmake ..
30+make -j2
31+ 
32+echo "[3/3] verify outputs"
33+test -x "${BUILD_DIR}/secgear_seal_data_host"
34+test -f "${BUILD_DIR}/enclave/libenclave.so"
35+test -f "${BUILD_DIR}/enclave.signed.so"
36+ 
37+echo "seal_data smoke build test passed"
38+ 
39+ARCH="$(uname -m)"
40+if [ "${ARCH}" != "x86_64" ]; then
41+ echo "secgear-starterkit SGX smoke tests require x86_64. Skip on ${ARCH}."
42+ exit 0
43+fi