unable to get local issuer certificate when trying to make HTTPS request

[pbeza]

TL;DR

This question is conceptually similar to another one I recently posted. I'm trying to run Gramine with one more application called zeth (it's Type 0 zkEVM). There is a runtime error related to the SSL/TLS certificate. I tried googling for similar issues, but I haven't found any in the context of Gramine.

My Gramine manifest file:

ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ cat zeth.manifest.template
loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/zeth"
loader.log_level = "{{ log_level }}"
loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}"

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "/zeth", uri = "file:zeth" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
]
loader.argv = ["zeth", "--rpc-url=https://eth-mainnet.g.alchemy.com/v2/FOOBAR", "--cache", "--block-no=16424130"]
sys.insecure__allow_eventfd = true

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:zeth",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/libgcc_s.so.1",
  "file:{{ arch_libdir }}/libssl.so.3",
  "file:{{ arch_libdir }}/libcrypto.so.3",
  "file:/usr/lib/ssl/certs/",
]
sgx.max_threads = 16
sys.enable_extra_runtime_domain_names_conf = true

My problem with running zeth with gramine-sgx (same problem with gramine-direct):

ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ gramine-sgx ./zeth     
Gramine is starting. Parsing TOML manifest file, this may take some time...
-----------------------------------------------------------------------------------------------------------------------
Gramine detected the following insecure configurations:

  - sgx.debug = true                           (this is a debug enclave)
  - sys.insecure__allow_eventfd = true         (host-based eventfd is enabled)

Gramine will continue application execution, but this configuration must not be used in production!
-----------------------------------------------------------------------------------------------------------------------

Emulating a raw syscall instruction. This degrades performance, consider patching your application to use Gramine syscall API.
thread 'tokio-runtime-worker' panicked at 'Could not init: error sending request for url (https://eth-mainnet.g.alchemy.com/v2/FOOBAR): error trying to connect: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)

Caused by:
    0: error trying to connect: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)
    1: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)
    2: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883:', host/src/main.rs:98:14
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: task 9 panicked

I think I'm missing something in the manifest file, but I'm not sure what I'm actually missing. I tried various things without success. Can you please help me and suggest how to fix it?

How to reproduce

1. Clone zeth repo:

   ubuntu@VM-0-6-ubuntu:~$ git clone https://github.com/risc0/zeth.git
   Cloning into 'zeth'...
   remote: Enumerating objects: 1257, done.
   remote: Counting objects: 100% (311/311), done.
   remote: Compressing objects: 100% (47/47), done.
   remote: Total 1257 (delta 283), reused 264 (delta 264), pack-reused 946
   Receiving objects: 100% (1257/1257), 50.38 MiB | 14.27 MiB/s, done.
   Resolving deltas: 100% (676/676), done.
   

2. Go to the relevant directory:

   ubuntu@VM-0-6-ubuntu:~$ cd zeth
   

3. Check hash of the commit in case you want to checkout the same commit as me:

   ubuntu@VM-0-6-ubuntu:~/zeth$ git rev-parse HEAD
   5b76342be3ed94ac7a292ae8098952ae90de589c
   

4. Install recommended Rust toolchain:

   ubuntu@VM-0-6-ubuntu:~/zeth$ cargo install cargo-risczero
       Updating crates.io index
        Ignored package `cargo-risczero v0.18.0` is already installed, use --force to override
   
   ubuntu@VM-0-6-ubuntu:~/zeth$ cargo risczero install
   Getting release info: https://api.github.com/repos/risc0/rust/releases/latest...
   Toolchain path /home/ubuntu/.local/share/cargo-risczero/toolchains/x86_64-unknown-linux-gnu_test-release-2 already exists - deleting existing files!
   Downloading Rust toolchain from url 'https://github.com/risc0/rust/releases/download/test-release-2/rust-toolchain-x86_64-unknown-linux-gnu.tar.gz'...
   Extracting...
   Downloaded toolchain x86_64-unknown-linux-gnu to /home/ubuntu/.local/share/cargo-risczero/toolchains/x86_64-unknown-linux-gnu_test-release-2/rust
   Activating rustup toolchain risc0 at /home/ubuntu/.local/share/cargo-risczero/toolchains/x86_64-unknown-linux-gnu_test-release-2/rust...
   info: uninstalling toolchain 'risc0'
   info: toolchain 'risc0' uninstalled
   Running rustup toolchain link risc0 /home/ubuntu/.local/share/cargo-risczero/toolchains/x86_64-unknown-linux-gnu_test-release-2/rust:
   rustup toolchain risc0 was linked and is now available!
   Toolchain risc0 downloaded and installed to path /home/ubuntu/.local/share/cargo-risczero/toolchains/x86_64-unknown-linux-gnu_test-release-2/rust.
   The risc0 toolchain is now ready to use.
   

5. Build the project:

   ubuntu@VM-0-6-ubuntu:~/zeth$ cargo build --release
   
   <TRUNCATED>
   
   test-guest:    Compiling zeth-primitives v0.1.0 (/home/ubuntu/zeth/primitives)
   test-guest:    Compiling revm v3.3.0
   test-guest:    Compiling zeth-lib v0.1.0 (/home/ubuntu/zeth/lib)
   test-guest:    Compiling test-guest v0.1.0 (/home/ubuntu/zeth/testing/ef-tests/testguest)
   test-guest:     Finished release [optimized] target(s) in 1m 13s
      Compiling zeth v0.1.0 (/home/ubuntu/zeth/host)
       Finished release [optimized + debuginfo] target(s) in 8m 20s
   

6. Change current working directory:

   ubuntu@VM-0-6-ubuntu:~/zeth$ cd target/release/
   

7. Create Gramine's manifest file for zeth:

   ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ cat zeth.manifest.template 
   loader.entrypoint = "file:{{ gramine.libos }}"
   libos.entrypoint = "/zeth"
   loader.log_level = "{{ log_level }}"
   loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}"
   
   fs.mounts = [
     { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
     { path = "/zeth", uri = "file:zeth" },
     { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
   ]
   loader.argv = ["zeth", "--rpc-url=https://eth-mainnet.g.alchemy.com/v2/FOOBAR", "--cache", "--block-no=16424130"]
   sys.insecure__allow_eventfd = true
   
   sgx.debug = true
   sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
   
   sgx.trusted_files = [
     "file:{{ gramine.libos }}",
     "file:zeth",
     "file:{{ gramine.runtimedir() }}/",
     "file:{{ arch_libdir }}/libgcc_s.so.1",
     "file:{{ arch_libdir }}/libssl.so.3",
     "file:{{ arch_libdir }}/libcrypto.so.3",
     "file:/usr/lib/ssl/certs/",
   ]
   sgx.max_threads = 16
   sys.enable_extra_runtime_domain_names_conf = true
   

   Notice this line:

   loader.argv = ["zeth", "--rpc-url=https://eth-mainnet.g.alchemy.com/v2/FOOBAR", "--cache", "--block-no=16424130"]
   

   instead of my API_TOKEN key there is FOOBAR but even if I replace it with my current API_TOKEN it still doesn't work because there is a problem establishing the HTTPS connection in the first place (see: Quick test mode in zeth's README).

8. Process the above manifest file:

   ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ gramine-manifest -Dlog_level=all -Darch_libdir=/usr/lib/x86_64-linux-gnu/ zeth.manifest.template zeth.manifest
   

9. Sign the manifest:

   ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ gramine-sgx-sign --manifest zeth.manifest --output zeth.manifest.sgx
   Attributes:
       size:        0x10000000
       edmm:        False
       max_threads: 16
       isv_prod_id: 0
       isv_svn:     0
       attr.flags:  0x6
       attr.xfrm:   0x3
       misc_select: 0x0
   SGX remote attestation:
       None
   Memory:
       000000000fff3000-0000000010000000 [REG:R--] (manifest) measured
       000000000ff73000-000000000fff3000 [REG:RW-] (ssa) measured
       000000000ff63000-000000000ff73000 [TCS:---] (tcs) measured
       000000000ff53000-000000000ff63000 [REG:RW-] (tls) measured
       000000000ff13000-000000000ff53000 [REG:RW-] (stack) measured
       000000000fed3000-000000000ff13000 [REG:RW-] (stack) measured
       000000000fe93000-000000000fed3000 [REG:RW-] (stack) measured
       000000000fe53000-000000000fe93000 [REG:RW-] (stack) measured
       000000000fe13000-000000000fe53000 [REG:RW-] (stack) measured
       000000000fdd3000-000000000fe13000 [REG:RW-] (stack) measured
       000000000fd93000-000000000fdd3000 [REG:RW-] (stack) measured
       000000000fd53000-000000000fd93000 [REG:RW-] (stack) measured
       000000000fd13000-000000000fd53000 [REG:RW-] (stack) measured
       000000000fcd3000-000000000fd13000 [REG:RW-] (stack) measured
       000000000fc93000-000000000fcd3000 [REG:RW-] (stack) measured
       000000000fc53000-000000000fc93000 [REG:RW-] (stack) measured
       000000000fc13000-000000000fc53000 [REG:RW-] (stack) measured
       000000000fbd3000-000000000fc13000 [REG:RW-] (stack) measured
       000000000fb93000-000000000fbd3000 [REG:RW-] (stack) measured
       000000000fb53000-000000000fb93000 [REG:RW-] (stack) measured
       000000000fb43000-000000000fb53000 [REG:RW-] (sig_stack) measured
       000000000fb33000-000000000fb43000 [REG:RW-] (sig_stack) measured
       000000000fb23000-000000000fb33000 [REG:RW-] (sig_stack) measured
       000000000fb13000-000000000fb23000 [REG:RW-] (sig_stack) measured
       000000000fb03000-000000000fb13000 [REG:RW-] (sig_stack) measured
       000000000faf3000-000000000fb03000 [REG:RW-] (sig_stack) measured
       000000000fae3000-000000000faf3000 [REG:RW-] (sig_stack) measured
       000000000fad3000-000000000fae3000 [REG:RW-] (sig_stack) measured
       000000000fac3000-000000000fad3000 [REG:RW-] (sig_stack) measured
       000000000fab3000-000000000fac3000 [REG:RW-] (sig_stack) measured
       000000000faa3000-000000000fab3000 [REG:RW-] (sig_stack) measured
       000000000fa93000-000000000faa3000 [REG:RW-] (sig_stack) measured
       000000000fa83000-000000000fa93000 [REG:RW-] (sig_stack) measured
       000000000fa73000-000000000fa83000 [REG:RW-] (sig_stack) measured
       000000000fa63000-000000000fa73000 [REG:RW-] (sig_stack) measured
       000000000fa53000-000000000fa63000 [REG:RW-] (sig_stack) measured
       000000000f9f9000-000000000fa49000 [REG:R-X] (code) measured
       000000000fa49000-000000000fa53000 [REG:RW-] (data) measured
       0000000000010000-000000000f9f9000 [REG:RWX] (free)
   Measurement:
       2240f6077d852d3f43fe296dbc55b4e812c3c59cb1b27986c7a3bd5d7c273f42
   

10. Run the app with Gramine:

    ubuntu@VM-0-6-ubuntu:~/zeth/target/release$ gramine-sgx ./zeth     
    Gramine is starting. Parsing TOML manifest file, this may take some time...
    -----------------------------------------------------------------------------------------------------------------------
    Gramine detected the following insecure configurations:
    
      - sgx.debug = true                           (this is a debug enclave)
      - sys.insecure__allow_eventfd = true         (host-based eventfd is enabled)
    
    Gramine will continue application execution, but this configuration must not be used in production!
    -----------------------------------------------------------------------------------------------------------------------
    
    Emulating a raw syscall instruction. This degrades performance, consider patching your application to use Gramine syscall API.
    thread 'tokio-runtime-worker' panicked at 'Could not init: error sending request for url (https://eth-mainnet.g.alchemy.com/v2/FOOBAR): error trying to connect: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)
    
    Caused by:
        0: error trying to connect: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)
        1: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883: (unable to get local issuer certificate)
        2: error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file, error:80000002:system library:file_open:reason(2):../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/lib/ssl/certs), error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1883:', host/src/main.rs:98:14
    note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
    Error: task 9 panicked
    

[dimakuv]

Try to add an FS mount that corresponds to your certificates' directory:

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "/zeth", uri = "file:zeth" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr/lib/ssl/certs/", uri = "file:/usr/lib/ssl/certs/" },  # add this line
]

Also, I see that you use Ubuntu. On Ubuntu, the traditional place where SSL/TLS certificates are stored is the /etc/ssl/certs/ dir. Maybe you'll need to add this directory too (also in both fs.mounts and in sgx.trusted_files). See https://ubuntu.com/server/docs/security-certificates for details.

[pbeza]

That seems to work now! Thank you! 🙏🏼

Looking back retrospectively – as you can see in my initial post, I added:

"file:/usr/lib/ssl/certs/"

to the sgx.trusted_files section instead of fs.mounts. I wrongly assumed the former implicitly imply the latter (similarly as with the "file:/usr/lib/x86_64-linux-gnu/libgcc_s.so.1" path in the other issue I had).

I need to build some better intuition on what should I put in fs.mounts and sgx.trusted_files. Is it accurate to say that all the files listed in the sgx.trusted_files section should be listed in the fs.mounts section as well (or one of their parent directories)? Is there any point in having some files listed only in the sgx.trusted_files section?

Also, I see that you use Ubuntu. On Ubuntu, the traditional place where SSL/TLS certificates are stored is the /etc/ssl/certs/ dir. (...)

BTW: do you have any experience with running SGX (and Gramine) with distros other than the ones mentioned in Intel SGX SDK README? I believe Ubuntu is (unfortunately) one of the most common OS for running SGX-based apps. Ideally I would like to run it with Arch Linux but I haven't tried it out. Perhaps you have some more experience with that?

[dimakuv]

I need to build some better intuition on what should I put in fs.mounts and sgx.trusted_files. Is it accurate to say that all the files listed in the sgx.trusted_files section should be listed in the fs.mounts section as well (or one of their parent directories)? Is there any point in having some files listed only in the sgx.trusted_files section?

Yes, you're correct.

Think of it this way: fs.mounts is a "peaking window" from the Gramine file system to the host-OS file system. It's like Docker's volumes. If you don't specify any chroot-typed (the default type) files/paths in fs.mounts, then Gramine won't be able to access them. So this is the first level of host file access in Gramine.

Then there is a second level of host file access, which is specific to Intel SGX and refers to security guarantees. You can mark the files/dirs in fs.mounts as sgx.trusted_files or sgx.allowed_files -- the former means "read-only integrity-protected files", the latter means "unprotected do-whatever-you-like files".

Finally, there is a kinda special type of files -- Encrypted Files. These files are defined in fs.mounts as encrypted-typed mounts (in contrast to chroot-typed mounts). They don't need a corresponding sgx. entry in the manifest, as they already have security guarantees.

The current state of the files' definitions in the manifest file is a bit weird, we admit. We have/had plans to make it more intuitive, but we currently have other priorities.

[dimakuv]

BTW: do you have any experience with running SGX (and Gramine) with distros other than the ones mentioned in Intel SGX SDK README? I believe Ubuntu is (unfortunately) one of the most common OS for running SGX-based apps. Ideally I would like to run it with Arch Linux but I haven't tried it out. Perhaps you have some more experience with that?

I don't think anyone from the Gramine team has experience with Arch Linux. Maybe @woju ?

But Gramine is known to work under Ubuntu, Debian, CentOS, RHEL, Fedora, AlmaLinux, RockyLinux, and (recently) Alpine.

[mkow]

BTW: do you have any experience with running SGX (and Gramine) with distros other than the ones mentioned in Intel SGX SDK README?

FYI: Gramine and Intel SGX SDK are completely unrelated, we don't use it. The only part we use is SGX PSW, which are the user-mode daemons managing e.g. the SGX architectural enclaves. So, whether SGX SDK support something or not is rather unrelated to whether Gramine supports it.

[pbeza]

Perfect, thank you for your help! 🙏🏼 Closing the issue as resolved.