- There is now an importable CMake package that Open Enclave SDK users can include in their CMake builds.
- This CMake package exposes the Open Enclave SDK targets that enclave developers should interface with when building their enclaves and host executables.
- Ubuntu 18.04 is now supported in addition to Ubuntu 16.04.
- Improved logging
- This is an SDK internal logging feature which logs operations from host and enclave SDK API calls based on configurations.
- SDK logging for host calling paths is always on.
- SDK logging for enclave calling paths is only turned on when they are both signed and loaded as “Debug” enclaves.
- Users can control the logging level by setting the OE_LOG_LEVEL environment variable to one of the supported log levels: NONE< FATAL, ERROR (default), WARN, INFO, or VERBOSE.
- oe_get_report, oe_get_target_info , oe_get_seal_key and oe_get_seal_key_by_policy have been updated with new calling conventions whereby buffers are returned from the API. These APIs are available by defining OE_API_VERSION=2. The old versions of the API, whereby the caller passes in a buffer, are available by default, or by defining OE_API_VERSION=1. The next release will make OE_API_VERSION=2 default and OE_API_VERSION=1 sets of APIs will be deleted.
- Thread-local variables are now supported. Both GNU __thread and C++ thread_local keywords are supported.
- There was previously an issue with debugging simulation mode enclaves on Linux, and this issue has now been resolved.
- The QE Identity revocation information provided by Intel is now being checked against during SGX quote verification.
- The Ninja build engine is now supported as an option to the CMake build generator for Linux and the recommended method for Windows.
- The unsafe string methods for ecalls and ocalls were removed. Developers should now use the edger8r code for ecalls and ocalls. The following deprecated host and enclave methods and declarations were removed:
- oe_call_enclave
- oe_call_host
- oe_call_host_by_address
- OE_ECALL
- OE_OCALL
- oe_create_enclave is still implemented but the edger8r generates a preferred method for creation.
- Support for SGX platforms without AVX.
- Update mbedTLS library to version 2.7.9.
- Update MUSL libc to version 1.1.20.
- Update LLVM libcxx to version 7.0.0.
- Some libcxx headers (e.g.
<string>) now use C++11 template features and may require compiling with the-std=c++11option when building with GCC. - The oesign CLI tool has been revamped to use named parameters.
- Fix CVE-2019-0876:
- _handle_sgx_get_report will now write to the supplied argument only if it lies in host memory.
- Added a check for a missing null terminator in oeedger8r generated code.
SHA256 of open-enclave-0.5.0-Ubuntu_16.04.deb: 3f649f2bd9258e7a71d571d810015bfd92862ae3ad6cf5c763266710ea70c573
SHA256 of open-enclave-0.5.0-Ubuntu_18.04.deb: 1a196a387e1eeb18f69bde329cc8945df51c48d714cdc1756cb4562e881c553d