# Third-Party Dependency Vendoring

For Teaclave, since all SGX/enclave dependencies are part of trusted computing base (TCB), in order to ease auditing, ensure product stability, as well as reduce the possibility of the supply chain attack, all TEE dependencies should be vendored. Then during the build process, both the untrusted (i.e., the app part) and trusted components (i.e., the enclave part) will only consume packages from this designated repository and will not download any code from external package registry such as crates.io. The vendoring of Rust crates are not done here for development ease but are recommended for production use.

Basically, we have these submodules:

  • rust-sgx-sdk: Teaclave SGX SDK for standard libraries and Rust bindings of SGX libraries.
  • webassembly-micro-runtime: A sandboxed runtime to execute(interpret) WebAssembly bytecode.
Last Updated: 5/9/2023, 3:44:20 AM

← Tools →

Apache Teaclave (incubating) is an effort undergoing incubation at The Apache Software Foundation (ASF), sponsored by the Apache Incubator. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF. Copyright © 2020 The Apache Software Foundation. Licensed under the Apache License, Version 2.0. Apache Teaclave, Apache, the Apache feather, and the Apache Teaclave project logo are either trademarks or registered trademarks of the Apache Software Foundation.