Creating a signed contract

Prerequisites

• You have the attestation_public_key.pub from the Auditor, if you are creating the contract with attestation encryption.

Procedure

1. Copy encrypted-workload.yaml, encrypted-env.yaml, envWorkloadSignature.txt and boot section to the user-data.yaml file. The final user-data.yaml must look like the examples below:

   Bare Metal deployment example:

   workload: hyper-protect-basic.js7TGt77EQ5bgTIKk5C0pViFTRHqWtn.............. 
   env: hyper-protect-basic.VWg/5/SWE+9jLfhr8q4i......... 
   envWorkloadSignature: Icbm1D/CVpLNYkWRC9e ..... 
   boot: | 
       sehdr: SUJNU2VjRXgAAAEAAAAPoH90OdZW...........

   Peerpod deployment example:

   workload: hyper-protect-basic.js7TGt77EQ5bgTIKk5C0pViFTRHqWtn..............
   env: hyper-protect-basic.VWg/5/SWE+9jLfhr8q4i.........
   envWorkloadSignature: Icbm1D/CVpLNYkWRC9e .....

2. If you are creating the contract with the attestation encryption, you must perform the Additional steps for attestation encryption contract.
3. Store the user-data content in a variable by running the following command:

   export encrypted_contract=$(cat "user-data.yaml")

4. Create a initdata.toml file using the encrypted_contract generated in the earlier step:

   cat << EOF > initdata.toml
   algorithm = "sha384"
   version = "0.1.0"
   [data]
   "contract.yaml" = '''${encrypted_contract}'''
   EOF

5. Convert the initdata.toml file to a Base64-encoded string in gzip format in a text file, and store the converted content in a variable by running the following command:

   export initdata_annotation=$(cat "initdata.toml" | gzip | base64 -w0)

6. Deploy the sample workload and verify the contract. For more information, see Verifying the contract.