.gitignore

@@ -1,4 +1,5 @@
 _build
+_dbinit_sql
 vendors
 assets
 keys

GNUmakefile

@@ -1,9 +1,8 @@
 storage=./keys/secmod.fat
 service=tap0
 
-switch:
+setup-switch:
 	opam switch create mte ocaml.5.4.1
-	eval $$(opam env)
 	opam update
 	opam install --yes . --deps-only
 
@@ -11,21 +10,14 @@ vendors: source.sh
 	@mkdir -p vendors
 	@./source.sh
 
-assets:
+.PHONY: clean
-	@cp -r default/assets ./
+clean:
-
+	rm -rf _build/
-build: vendors
+	rm -rf vendors/
-	@dune build @all
-	@dune build --workspace dune-workspace.solo5 src/mte.exe
-
-manifest.json:
-	@dune exec src/mte.exe > src/manifest.json
 
 keys:
 	@mkdir -p keys
 	@dune exec tools/offline.exe -- generate-eddsa-key --output ./keys/master
-
-postgres_password:
 	@read -sp "Enter postgres password: " POSTGRES_PASSWORD; \
 	  echo; \
 	  printf $${POSTGRES_PASSWORD} > ./keys/postgres_password
@@ -33,26 +25,19 @@ postgres_password:
 secmod.fat:
 	mfat make --sectors=2048 $(storage)
 
+assets:
+	@cp -r default/assets ./
+
 config:
 	@sed "s/%%MASTER_PUBLIC_KEY%%/$$(cat ./keys/master.pub)/" -i assets/mte.conf
 
+src/manifest.json:
+	@dune exec src/mte.exe > src/manifest.json
+
+build: vendors
+	@dune build @all
+	@dune build --workspace dune-workspace.solo5 src/mte.exe
+
 run: build
 	@solo5-hvt --block:storage=$(storage) --net:service=$(service) -- ./_build/solo5/src/mte.exe \
 		--postgres-password=$$(cat ./keys/postgres_password)
-
-clean-switch:
-	opam switch remove mte
-
-clean-vendors:
-	rm -rf vendors/
-
-clean-build:
-	rm -rf _build/
-
-clean-assets:
-	rm -rf assets/
-
-clean-keys:
-	rm -rf keys/
-
-clean-all: clean-switch clean-vendors clean-build clean-assets clean-keys

README.md

@@ -60,7 +60,9 @@ To initialize the database use the `tools/dbinit.sh` script, it aggregates toget
 Prepare SQL queries and create the various elements (e.g. sql tables) required to be in the database.
 
 ```
-./tools/dbinit.sh init
+./tools/dbinit fetch
+./tools/dbinit build
+./tools/dbinit init
 ```
 
 ## Dependencies
@@ -70,7 +72,7 @@ MTE use the opam package manager and the dune build system.
 Create a dedicated opam switch, pin libraries to the required version and install them.
 
 ```
-make switch
+make setup-switch
 ```
 
 For compilation to a solo5 unikernel, we also need to "vendor" some libraries.
@@ -81,24 +83,12 @@ make vendors
 
 ## Assets, configuration file and keys
 
-Create a `assets/` folder containing default terms of use files and a default configuration file (incomplete).
+Create a `keys/` folder, generate a fresh master key for the server (and also a file with the required postgres_password to connect to the database).
-
-```
-make assets
-```
-
-Create a `keys/` folder and generate a fresh master key for the server.
 
 ```
 make keys
 ```
 
-Write a `keys/postgres_password` file with the required database password.
-
-```
-make postgres_password
-```
-
 Create `keys/secmod.fat` file that will be the FAT block storage given to MTE.
 MTE will use it to store it's signatures and denominations keys.
 
@@ -106,6 +96,12 @@ MTE will use it to store it's signatures and denominations keys.
 make secmod.fat
 ```
 
+Create a `assets/` folder containing default terms of use files and a default configuration file.
+
+```
+make assets
+```
+
 Complete the configuration file by writing master public key of the server we previously generated into it.
 
 ```
@@ -134,7 +130,7 @@ dune runtest
 This will run tests for various utility functions, binary formats and cryptographic functions.
 It also test that MTE's binary formats and cryptographic signature on the various fields of `/keys` API are consistent with the reference implementation.
 
-It is also possible to run a test scenario of the `/management` API with the `./test/management.sh` script.
+It is also possible to run a test scenario of the `/management` API with the `/test/management.sh` script.
 It uses `mte-offline-tool` executable to produce various keys, signatures and JSON objects used in the `/management` API.
-Note that this script assumes a server is already running on `http://10.0.0.2:3434`, and that it will write changes to the database.
+Note that this script assumes a server is already running at `http://10.0.0.2:3434`, and that it will write changes to the database.
 

_dbinit_sql/drop.sql

@@ -1,38 +0,0 @@
---
--- This file is part of TALER
--- Copyright (C) 2014--2022 Taler Systems SA
---
--- TALER is free software; you can redistribute it and/or modify it under the
--- terms of the GNU General Public License as published by the Free Software
--- Foundation; either version 3, or (at your option) any later version.
---
--- TALER is distributed in the hope that it will be useful, but WITHOUT ANY
--- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
--- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
---
--- You should have received a copy of the GNU General Public License along with
--- TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
---
-
--- Everything in one big transaction
-BEGIN;
-
-WITH xpatches AS (
-  SELECT patch_name
-  FROM _v.patches
-  WHERE starts_with(patch_name,'exchange-')
-)
-  SELECT _v.unregister_patch(xpatches.patch_name)
-    FROM xpatches;
-
-WITH xpatches AS (
-  SELECT patch_name
-    FROM _v.patches
-   WHERE starts_with(patch_name,'auditor-triggers-')
-)
-  SELECT _v.unregister_patch(xpatches.patch_name)
-    FROM xpatches;
-
-DROP SCHEMA exchange CASCADE;
-
-COMMIT;

ip6tables.rules.example

@@ -1,26 +0,0 @@
-*filter
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]
-:OUTPUT ACCEPT [0:0]
-:TCP - [0:0]
-:UDP - [0:0]
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A INPUT -i lo -j ACCEPT
--A INPUT -m conntrack --ctstate INVALID -j DROP
-
-# for ICMPv6 Neighbor Discovery Protocol
-# (note: need a corresponding line for each directly attached subnet)
--A INPUT -p ipv6-icmp --icmpv6-type 128 -m conntrack --ctstate NEW -j ACCEPT
--A INPUT -s fe80::/10 -p ipv6-icmp -j ACCEPT
-
--A INPUT -p udp -m conntrack --ctstate NEW -j UDP
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
--A INPUT -p udp -j REJECT --reject-with icmp6-port-unreachable
--A INPUT -p tcp -j REJECT --reject-with tcp-reset
--A INPUT -j REJECT
-
-#  accept incoming connections on UDP port 546, to enable DHCPv6
--A UDP -p udp --sport 547 --dport 546 -j ACCEPT
-
-
-COMMIT

iptables.rules.example

@@ -1,23 +0,0 @@
-*filter
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]
-:OUTPUT ACCEPT [0:0]
-:TCP - [0:0]
-:UDP - [0:0]
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A INPUT -i lo -j ACCEPT
--A INPUT -m conntrack --ctstate INVALID -j DROP
--A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
--A INPUT -p udp -m conntrack --ctstate NEW -j UDP
--A INPUT -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
--A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
--A INPUT -p tcp -j REJECT --reject-with tcp-reset
--A INPUT -j REJECT --reject-with icmp-proto-unreachable
-
--A UDP -p udp --dport 53 -j ACCEPT
--A TCP -p tcp --dport 53 -j ACCEPT
--A TCP -p tcp --dport 3434 -j ACCEPT
--A TCP -p tcp --dport 5432 -j ACCEPT
-
-
-COMMIT

mte.opam

@@ -48,16 +48,12 @@ depends: [
   "caqti-mnet"
   "caqti-driver-pgx"
   "pgx"
-  "mkernel"
-  "utcp"
 ]
 build: [
   [make "build"]
 ]
 pin-depends: [
   [ "zarith.dev" "git+https://github.com/mirage/Zarith.git#df8969d9bb95cffca13e31a615189ab27ada0684" ]
-  [ "mkernel.dev" "git+https://github.com/robur-coop/mkernel.git#v0.0.2" ]
-  [ "utcp.dev" "git+https://github.com/robur-coop/utcp.git#0.0.2" ]
   [ "mnet.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]
   [ "mnet-tls.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]
   [ "mnet-happy-eyeballs.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]

src/dune

@@ -34,7 +34,7 @@
   mirage-ptime.solo5
   mfat
   ;
-  caqti.classic
+  caqti
   caqti-miou
   caqti-mnet
   caqti-driver-pgx
@@ -75,7 +75,7 @@
   fpath
   cohttp
   bin
-  caqti.classic
+  caqti
   jsont
   jsont.bytesrw
   digestif