Move top-level Cargo.toml to oak/server

BUILD

@@ -32,4 +32,4 @@ exports_files(srcs = glob(["target/x86_64-unknown-linux-musl/release/*oak_loader
 exports_files(srcs = glob(["examples/target/wasm32-unknown-unknown/release/*.wasm"]))
 
 # These files are necessary for the backend server in the Aggregator example application.
-exports_files(srcs = glob(["target/release/aggregator_*"]))
+exports_files(srcs = glob(["examples/target/x86_64-unknown-linux-musl/release/aggregator_*"]))

examples/aggregator/README.md

@@ -16,7 +16,9 @@ Build and run the Backend with the following command:
 
 ```bash
 export RUST_LOG=info
-cargo run --release --package=aggregator_backend
+cargo run --release --manifest-path=examples/aggregator/backend/Cargo.toml -- \
+  --grpc-tls-private-key="<path-to-grpc-tls-private-key>" \
+  --grpc-tls-certificate="<path-to-grpc-tls-certificate>"
 ```
 
 Backend code is in the `backend` directory.
@@ -36,11 +38,12 @@ Build and run the Aggregator with the following command:
 
 ```bash
 ./scripts/build_example -e aggregator
-./scripts/build_server -s rust
-./bazel-clang-bin/oak/server/loader/oak_runner \
+./scripts/build_server -s base
+cargo run --release --target=x86_64-unknown-linux-musl --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
   --application=./bazel-client-bin/examples/aggregator/config/config.bin \
-  --private_key=./examples/certs/local/local.key \
-  --cert_chain=./examples/certs/local/local.pem
+  --grpc-tls-private-key=./examples/certs/local/local.key \
+  --grpc-tls-certificate=./examples/certs/local/local.pem \
+  --root-tls-certificate=./examples/certs/local/ca.pem
 ```
 
 Aggregator code is in `common` and `module` directories (where `common` defines
@@ -104,6 +107,6 @@ Deployment requires Docker images to be uploaded to the
 the following command:
 
 ```bash
-./scripts/build_example -e aggregator -i rust
+./scripts/build_example -e aggregator -i base
 ./examples/aggregator/scripts/docker_push
 ```

examples/aggregator/scripts/run_backend

@@ -5,6 +5,6 @@ readonly SCRIPTS_DIR="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=scripts/common
 source "${GLOBAL_SCRIPTS_DIR}/common"
 
-exec cargo run --release --package=aggregator_backend \
+exec cargo run --release --manifest-path=examples/aggregator/backend/Cargo.toml -- \
   --grpc-tls-private-key="${GLOBAL_SCRIPTS_DIR}/../examples/certs/local/local.key" \
   --grpc-tls-certificate="${GLOBAL_SCRIPTS_DIR}/../examples/certs/local/local.pem"

examples/aggregator/scripts/run_server

@@ -5,11 +5,11 @@ readonly SCRIPTS_DIR="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=scripts/common
 source "${GLOBAL_SCRIPTS_DIR}/common"
 
-"${GLOBAL_SCRIPTS_DIR}/build_server" -s rust
+"${GLOBAL_SCRIPTS_DIR}/build_server" -s base
 "${GLOBAL_SCRIPTS_DIR}/build_example" -e aggregator
 
 readonly APPLICATION="${PWD}/bazel-client-bin/examples/aggregator/config/config.bin"
-exec cargo run --release --target=x86_64-unknown-linux-musl --package=oak_loader -- \
+exec cargo run --release --target=x86_64-unknown-linux-musl --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
   --application="${APPLICATION}" \
   --grpc-tls-private-key="${GLOBAL_SCRIPTS_DIR}/../examples/certs/local/local.key" \
   --grpc-tls-certificate="${GLOBAL_SCRIPTS_DIR}/../examples/certs/local/local.pem" \

examples/aggregator/server/BUILD

@@ -36,7 +36,7 @@ container_image(
         "./aggregator_backend",
     ],
     files = [
-        "//:target/release/aggregator_backend",
+        "//:examples/target/x86_64-unknown-linux-musl/release/aggregator_backend",
     ],
     ports = [
         "8888/tcp",  # Backend gRPC port.

examples/authentication/README.md

@@ -21,7 +21,7 @@ The Oak server can be run with the OpenID Connect authentication service enabled
 using the --oidc-client flag:
 
 ```bash
-cargo run --package=oak_loader -- \
+cargo run --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
     --application=<APP_CONFIG_PATH> \
     --grpc-tls-private-key=<PRIVATE_KEY_PATH> \
     --grpc-tls-certificate=<CERTIFICATE_PATH> \
@@ -55,7 +55,7 @@ While the Oak server is running with the OpenID Connect authentication service
 enabled, the client can be executed using:
 
 ```bash
-cargo run --package=auth_client
+cargo run --manifest-path=examples/authentication/client/Cargo.toml
 ```
 
 The client will log the returned identity token as an informational log message.

examples/hello_world/gcp/BUILD

@@ -26,7 +26,6 @@ assemble_packer(
     name = "assemble-oak-gcp-hello-world",
     config = ":config.json",
     files = {
-        "//oak/server/loader:oak_runner": "oak_runner",
         "//examples/hello_world/config:config.bin": "config.bin",
     },
 )

examples/hello_world/gcp/config.json

@@ -31,8 +31,7 @@
       "type": "shell",
       "inline": [
         "sudo mkdir /opt/oak", 
-        "sudo cp /tmp/deployment/* /opt/oak/", 
-        "sudo chmod +x /opt/oak/oak_runner"
+        "sudo cp /tmp/deployment/* /opt/oak/"
       ]
     }
   ]

oak/server/BUILD

@@ -28,7 +28,7 @@ container_image(
     name = "oak_docker",
     base = "@cc_image//image",
     files = [
-        "//:target/x86_64-unknown-linux-musl/release/oak_loader",
+        "target/x86_64-unknown-linux-musl/release/oak_loader",
     ],
     ports = [
         "8080/tcp",  # Oak Application gRPC port.

Cargo.toml → oak/server/Cargo.toml

@@ -1,6 +1,5 @@
 [workspace]
-members = ["oak/server/rust/oak_loader", "oak/server/rust/oak_runtime"]
-exclude = ["third_party/expect", "third_party/roughenough"]
+members = ["rust/oak_loader", "rust/oak_runtime"]
 
 # Patch dependencies on oak crates so that they refer to the versions within this same repository.
 #
@@ -9,9 +8,9 @@ exclude = ["third_party/expect", "third_party/roughenough"]
 # > explicit about the dependency relationships between the crates.
 [patch.crates-io]
 # Oak.
-oak_abi = { path = "oak_abi" }
-oak_loader = { path = "oak/server/rust/oak_loader" }
-oak_runtime = { path = "oak/server/rust/oak_runtime" }
-oak_utils = { path = "oak_utils" }
+oak_abi = { path = "../../oak_abi" }
+oak_loader = { path = "rust/oak_loader" }
+oak_runtime = { path = "rust/oak_runtime" }
+oak_utils = { path = "../../oak_utils" }
 # Third party.
-roughenough = { path = "third_party/roughenough" }
+roughenough = { path = "../../third_party/roughenough" }

oak/server/rust/oak_loader/src/main.rs

@@ -19,7 +19,7 @@
 //! Invoke with:
 //!
 //! ```shell
-//! cargo run --package=oak_loader -- \
+//! cargo run --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
 //!     --application=<APP_CONFIG_PATH> \
 //!     --grpc-tls-private-key=<PRIVATE_KEY_PATH> \
 //!     --grpc-tls-certificate=<CERTIFICATE_PATH> \

runner/src/main.rs

@@ -20,7 +20,7 @@
 //! To invoke, run the following command from the root of the repository:
 //!
 //! ```
-//! cargo run --package=runner
+//! cargo run --manifest-path=runner/Cargo.toml
 //! ```
 
 use colored::*;
@@ -210,7 +210,7 @@ fn build_server(opt: &BuildServer) -> Step {
                     "build",
                     "--release",
                     "--target=x86_64-unknown-linux-musl",
-                    "--package=oak_loader",
+                    "--manifest-path=oak/server/rust/oak_loader/Cargo.toml",
                 ],
             ),
         },
@@ -307,7 +307,7 @@ fn run_example_server(application_file: &str) -> Cmd {
             "run",
             "--release",
             "--target=x86_64-unknown-linux-musl",
-            "--package=oak_loader",
+            "--manifest-path=oak/server/rust/oak_loader/Cargo.toml",
             "--",
             "--grpc-tls-private-key=./examples/certs/local/local.key",
             "--grpc-tls-certificate=./examples/certs/local/local.pem",

scripts/build_example

@@ -56,13 +56,13 @@ case "${application_language}" in
     for module in examples/"${EXAMPLE}"/module*/rust/Cargo.toml; do
       # Use a separate target dir for Wasm build artifacts. The precise name is not relevant, but it
       # should end with `target` so that it gets automatically ignored by our `.gitignore`.
-      cargo build --release --target-dir=examples/target --target=wasm32-unknown-unknown --manifest-path="${module}"
+      cargo build --release --target=wasm32-unknown-unknown --manifest-path="${module}"
     done
 
     # Serialize application configuration for Rust module.
     if [[ "${EXAMPLE}" == "hello_world" ]]; then
       # `hello_world` example has an optional additional `translator` module.
-      cargo build --release --target-dir=examples/target --target=wasm32-unknown-unknown --manifest-path="examples/translator/module/rust/Cargo.toml"
+      cargo build --release --target=wasm32-unknown-unknown --manifest-path="examples/translator/module/rust/Cargo.toml"
     elif [[ "${EXAMPLE}" == "aggregator" ]]; then
       # `aggregator` example has an additional Backend Docker image
       cargo build --release --target=x86_64-unknown-linux-musl --manifest-path="examples/aggregator/backend/Cargo.toml"

scripts/build_gh_pages

@@ -33,7 +33,7 @@ fi
 readonly TARGET_ABS_PATH="$(realpath "${TARGET_DIR}")"
 
 # All the dirs that we want to generate docs for.
-declare -ar SOURCE_PATHS=("." "oak_abi" "oak_utils" "sdk" "runner")
+declare -ar SOURCE_PATHS=("oak/server" "oak_abi" "oak_utils" "sdk" "runner")
 declare -ar TARGET_SUBDIRS=("oak" "oak_abi" "oak_utils" "sdk" "runner")
 
 # Titles used in the top-level index.html files. 

scripts/check_docs

@@ -6,10 +6,8 @@ readonly SCRIPTS_DIR="$(dirname "$0")"
 # shellcheck source=scripts/common
 source "$SCRIPTS_DIR/common"
 
-# All the dirs that we generate docs for
-declare -ar PATHS=("." "oak_abi" "oak_utils")
-
-for path in "${PATHS[@]}"; do
+# We will not generate docs for all the workspaces, but we check the docs for all workspaces regardless. 
+for path in "${ALL_CRATES[@]}"; do
   (
     cd "$path"
     DOCS_OUT="$(cargo doc --document-private-items --no-deps 2>&1)"

scripts/common

@@ -17,7 +17,7 @@ readonly SERVER_DOCKER_IMAGE_NAME='gcr.io/oak-ci/oak-server'
 readonly CACHE_DIR='bazel-cache'
 
 # List all workspaces.
-declare -ar ALL_CRATES=("oak_utils" "oak_abi" "." "sdk" "examples" "runner" "experimental")
+declare -ar ALL_CRATES=("oak_utils" "oak_abi" "oak/server" "sdk" "examples" "runner" "experimental")
 
 # To set up remote cache write credentials:
 # - navigate to https://pantheon.corp.google.com/iam-admin/serviceaccounts?project=oak-ci

scripts/deploy_example_gcp

@@ -20,7 +20,9 @@ source "$SCRIPTS_DIR/gcp_common"
 #   - Service Account User
 
 # Create a minimal Ubuntu linux image on the GCP project.
-# The image will be named oak-gcp-hello-world.
+# The image will be named oak-gcp-hello-world. 
+# The script fails if an image with the same name exists. 
+# Use `gcloud compute images delete oak-gcp-hello-world` to remove the old image.
 bazel run "${bazel_build_flags[@]}" "//examples/hello_world/gcp:deploy-${IMAGE_NAME}"
 
 # Authenticate as the service account
@@ -37,7 +39,6 @@ gcloud beta compute instances create "${INSTANCE_NAME}" \
   --boot-disk-size=16GB \
   --boot-disk-type=pd-standard \
   --boot-disk-device-name="${DISK_NAME}" \
-  --metadata=startup-script='/opt/oak/oak_runner --application=/opt/oak/config.bin'
 
 # Create a firewall rule to allow access to the hello world VM on port 8080
 gcloud compute firewall-rules create "${FIREWALL_RULE}" \

scripts/run_server

@@ -93,6 +93,6 @@ fi
 
 # Launching the server requires a `--application=<dir>/config.bin` flag.
 # `exec` is necessary for the `run_example` script to be able to get a PID of a background server.
-exec cargo run "${cargo_build_flags[@]}" --package=oak_loader -- \
+exec cargo run "${cargo_build_flags[@]}" --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
     --application="${APPLICATION_FILE}" \
     "${additional_args[@]}"