Track build code/compose file as a hash

5 files changed, 156 insertions, 136 deletions

diff --git a/client.c b/client.c
index d422385..e157057 100644
--- a/client.c
+++ b/client.c
@@ -84,7 +84,7 @@ void print_usage(const char *name)
            "\n"
            "  retrieveinfo -f FILEIDX [-v VERSION]\n"
            "\n"
-           "  retrievefile -f FILEIDX [-v VERSION] -o IMAGE_OUT\n");
+           "  retrievefile -f FILEIDX [-v VERSION] -o IMAGE_OUT [-ob bc_out] [-oc cf_out]\n");
 }
 
 bool parse_args(int argc, char *argv[])
@@ -153,7 +153,7 @@ bool parse_args(int argc, char *argv[])
                 return false;
             }
         }
-        else if(!strcmp(arg, "-ib"))
+        else if(!strcmp(arg, "-ib") || !strcmp(arg, "-ob"))
         {
             if(++i < argc)
                 buildcode_path = argv[i];
@@ -163,7 +163,7 @@ bool parse_args(int argc, char *argv[])
                 return false;
             }
         }
-        else if(!strcmp(arg, "-ic"))
+        else if(!strcmp(arg, "-ic") || !strcmp(arg, "-oc"))
         {
             if(++i < argc)
                 compose_path = argv[i];
@@ -379,14 +379,14 @@ static bool verify_sp_ack(int fd, const struct tm_request *tmr)
  * this case (in all other cases they are ignored). */
 bool exec_request(int fd, const struct user_request *req,
                   const struct iomt *new_acl,                /* MODIFY_ACL only */
-                  const struct iomt *new_buildcode,          /* MODIFY_FILE only */
-                  const struct iomt *new_composefile,        /* MODIFY_FILE only */
+                  const void *new_bc, size_t new_bc_len,     /* MODIFY_FILE only */
+                  const void *new_cf, size_t new_cf_len,     /* MODIFY_FILE only */
                   const void *new_file_contents, size_t len, /* MODIFY_FILE only */
                   struct tm_request *tmreq_out,              /* CREATE_FILE, MODIFY_FILE, and MODIFY_ACL only */
                   struct version_info *verinfo_out,          /* RETRIEVE_INFO only */
                   const void *user_key, size_t keylen,       /* RETRIEVE_INFO and RETRIEVE_FILE only */
-                  struct iomt **buildcode,                   /* RETRIEVE_FILE only */
-                  struct iomt **composefile,                 /* RETRIEVE_FILE only */
+                  void **buildcode, size_t *bc_len_out,      /* RETRIEVE_FILE only */
+		  void **composefile, size_t *cf_len_out,    /* RETRIEVE_FILE only */
                   hash_t *secret_out,                        /* RETRIEVE_FILE only */
                   void **file_contents_out,                  /* RETRIEVE_FILE only */
                   size_t *file_len)                          /* RETRIEVE_FILE only */
@@ -401,12 +401,9 @@ bool exec_request(int fd, const struct user_request *req,
         break;
     case MODIFY_FILE:
         /* send build code, compose file, and file contents */
-        iomt_serialize(new_buildcode, write_to_fd, &fd);
-        iomt_serialize(new_composefile, write_to_fd, &fd);
-
-        /* prefix file with size */
-        write(fd, &len, sizeof(len));
-        write(fd, new_file_contents, len);
+	serialize_file(fd, new_file_contents, len);
+	serialize_file(fd, new_bc, new_bc_len);
+	serialize_file(fd, new_cf, new_cf_len);
         break;
     case CREATE_FILE:
     case RETRIEVE_INFO:
@@ -427,9 +424,12 @@ bool exec_request(int fd, const struct user_request *req,
         if(req->type == MODIFY_FILE)
         {
             hash_t gamma = sha256(new_file_contents, len);
+	    hash_t h_bc = new_bc ? sha256(new_bc, new_bc_len) : hash_null;
+	    hash_t h_cf = new_cf ? sha256(new_cf, new_cf_len) : hash_null;
+	    
             val = calc_lambda(gamma,
-                              new_buildcode,
-                              new_composefile,
+			      h_bc,
+			      h_cf,
                               req->modify_file.kf);
         }
         else if(req->type == MODIFY_ACL)
@@ -478,22 +478,12 @@ bool exec_request(int fd, const struct user_request *req,
         else
             *secret_out = hash_null;
 
-        *buildcode = iomt_deserialize(read_from_fd, &fd);
-        *composefile = iomt_deserialize(read_from_fd, &fd);
-
-        recv(fd, file_len, sizeof(*file_len), MSG_WAITALL);
+	*file_contents_out = deserialize_file(fd, file_len);
+	
+        *buildcode = deserialize_file(fd, bc_len_out);
+        *composefile = deserialize_file(fd, cf_len_out);
 
-        if(*file_len)
-        {
-            *file_contents_out = malloc(*file_len);
-            recv(fd, *file_contents_out, *file_len, MSG_WAITALL);
-        }
-        else
-        {
-            *file_contents_out = NULL;
-            return false;
-        }
-        return true;
+	return *file_contents_out != NULL;
     }
     default:
         assert(false);
@@ -516,14 +506,14 @@ struct version_info request_verinfo(int fd, uint64_t user_id,
 
     bool rc = exec_request(fd, &req,
                            NULL,
-                           NULL,
-                           NULL,
+                           NULL, 0,
+                           NULL, 0,
                            NULL, 0,
                            NULL,
                            &verinfo,
                            user_key, keylen,
-                           NULL,
-                           NULL,
+                           NULL, NULL,
+                           NULL, NULL,
                            NULL,
                            NULL,
                            NULL);
@@ -561,6 +551,9 @@ int connect_to_service(const char *sockpath)
 
 void *load_file(const char *path, size_t *len)
 {
+    if(!path)
+      return NULL;
+    
     FILE *f = fopen(path, "r");
     fseek(f, 0, SEEK_END);
     *len = ftell(f);
@@ -589,9 +582,8 @@ bool server_request(const char *sockpath,
                     const char *image_path,
                     const char *file_key)
 {
-    struct iomt *buildcode = NULL, *composefile = NULL;
-    void *file_contents = NULL;
-    size_t file_len = 0;
+    void *file_contents = NULL, *buildcode = NULL, *composefile = NULL;
+    size_t file_len = 0, bc_len = 0, cf_len = 0;
     hash_t secret = hash_null;
 
     /* Fill in rest of request structure */
@@ -600,8 +592,8 @@ bool server_request(const char *sockpath,
     if(req.type == MODIFY_FILE)
     {
         /* these can safely take NULLs */
-        buildcode = iomt_from_lines(buildcode_path);
-        composefile = iomt_from_lines(compose_path);
+        buildcode = load_file(buildcode_path, &bc_len);
+	composefile = load_file(compose_path, &cf_len);
 
         if(image_path)
         {
@@ -657,7 +649,9 @@ bool server_request(const char *sockpath,
     bool success = exec_request(fd, &req,
                                 req.type == MODIFY_ACL ? new_acl : NULL,
                                 req.type == MODIFY_FILE ? buildcode : NULL,
+				req.type == MODIFY_FILE ? bc_len : 0,
                                 req.type == MODIFY_FILE ? composefile : NULL,
+				req.type == MODIFY_FILE ? cf_len : 0,
                                 req.type == MODIFY_FILE ? file_contents : NULL,
                                 req.type == MODIFY_FILE ? file_len : 0,
                                 req.type <= MODIFY_ACL ? &tmreq : NULL,
@@ -665,7 +659,9 @@ bool server_request(const char *sockpath,
                                 req.type >= RETRIEVE_INFO ? user_key : NULL,
                                 req.type >= RETRIEVE_INFO ? strlen(user_key) : 0,
                                 req.type == RETRIEVE_FILE ? &buildcode : NULL,
+				req.type == RETRIEVE_FILE ? &bc_len : NULL,
                                 req.type == RETRIEVE_FILE ? &composefile : NULL,
+				req.type == RETRIEVE_FILE ? &cf_len : NULL,
                                 req.type == RETRIEVE_FILE ? &secret : NULL,
                                 req.type == RETRIEVE_FILE ? &file_contents : NULL,
                                 req.type == RETRIEVE_FILE ? &file_len : NULL);
@@ -692,12 +688,15 @@ bool server_request(const char *sockpath,
     case RETRIEVE_FILE:
     {
         hash_t gamma = sha256(file_contents, file_len);
+	
+	hash_t h_bc = buildcode ? sha256(buildcode, bc_len) : hash_null;
+	hash_t h_cf = composefile ? sha256(composefile, cf_len) : hash_null;
 
         hash_t kf = calc_kf(secret, req.retrieve.file_idx);
 
         /* We should recalculate the roots of the two IOMTs ourselves
          * to be sure */
-        hash_t lambda = calc_lambda(gamma, buildcode, composefile, kf);
+        hash_t lambda = calc_lambda(gamma, h_bc, h_cf, kf);
 
         printf("Decrypted file secret as %s\n", hash_format(secret, 4).str);
         printf("File lambda = %s\n", hash_format(lambda, 4).str);
@@ -707,6 +706,12 @@ bool server_request(const char *sockpath,
 
         printf("Writing image file to %s.\n", image_path);
         write_file(image_path, file_contents, file_len);
+
+	if(buildcode_path && buildcode)
+            write_file(buildcode_path, buildcode, bc_len);
+
+	if(compose_path && composefile)
+            write_file(compose_path, composefile, cf_len);
         /* What about build code? We only have the IOMT, not the actual contents. */
 
         /* Verify contents */
diff --git a/crypto.c b/crypto.c
index 78b48a6..6ba1bba 100644
--- a/crypto.c
+++ b/crypto.c
@@ -299,14 +299,8 @@ hash_t crypt_secret(hash_t encrypted_secret,
 
 /* These are all fixed-length fields, so we can safely append them and
  * forgo any HMAC. */
-hash_t calc_lambda(hash_t gamma, const struct iomt *buildcode, const struct iomt *composefile, hash_t kf)
+hash_t calc_lambda(hash_t gamma, hash_t buildcode_root, hash_t composefile_root, hash_t kf)
 {
-    hash_t buildcode_root = hash_null, composefile_root = hash_null;
-    if(buildcode)
-        buildcode_root = iomt_getroot(buildcode);
-    if(composefile)
-        composefile_root = iomt_getroot(composefile);
-
     SHA256_CTX ctx;
     hash_t h;
 
@@ -491,6 +485,33 @@ void commit_transaction(void *db)
     sqlite3_exec(handle, "COMMIT;", 0, 0, 0);
 }
 
+void *deserialize_file(int cl, size_t *len)
+{
+    recv(cl, len, sizeof(*len), MSG_WAITALL);
+    
+    printf("File is %lu bytes.\n", *len);
+
+    if(!*len)
+        return NULL;
+    
+    void *buf = malloc(*len);
+    recv(cl, buf, *len, MSG_WAITALL);
+
+    return buf;
+}
+
+void serialize_file(int cl, const void *buf, size_t len)
+{
+    if(!buf)
+	len = 0;
+    write(cl, &len, sizeof(len));
+
+    if(!buf || !len)
+	return;
+
+    write(cl, buf, len);
+}
+
 void crypto_test(void)
 {
 #if 1
diff --git a/crypto.h b/crypto.h
index e06b282..ca45247 100644
--- a/crypto.h
+++ b/crypto.h
@@ -67,7 +67,7 @@ hash_t crypt_secret(hash_t encrypted_secret,
 
 struct iomt;
 
-hash_t calc_lambda(hash_t gamma, const struct iomt *buildcode, const struct iomt *composefile, hash_t kf);
+hash_t calc_lambda(hash_t gamma, hash_t h_bc, hash_t h_cf, hash_t kf);
 
 /* Generate a signed acknowledgement for successful completion of a
  * request. We append a zero byte to the user request and take the
@@ -93,6 +93,9 @@ hash_t calc_kf(hash_t encryption_key, uint64_t file_idx);
 void begin_transaction(void *db);
 void commit_transaction(void *db);
 
+void *deserialize_file(int cl, size_t *len);
+void serialize_file(int cl, const void *buf, size_t len);
+
 void warn(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
 
 /* self-test */
diff --git a/service_provider.c b/service_provider.c
index 3a01111..a064a90 100644
--- a/service_provider.c
+++ b/service_provider.c
@@ -35,12 +35,6 @@ struct file_version {
 
     struct tm_cert vr_cert; /* VR certificate */
     hash_t vr_hmac;
-
-    /* lines of Dockerfile */
-    struct iomt *buildcode;
-
-    /* lines of docker-compose.yml */
-    struct iomt *composefile;
 };
 
 /* should be free'd with free_record */
@@ -144,7 +138,7 @@ struct tm_cert cert_eq(struct service_provider *sp,
 
 /* write to file data_dir/file_idx/version */
 void write_contents(const struct service_provider *sp,
-                    uint64_t file_idx, uint64_t version,
+                    uint64_t file_idx, uint64_t version, const char *suffix,
                     const void *data, size_t len)
 {
     mkdir(sp->data_dir, 0755);
@@ -155,7 +149,7 @@ void write_contents(const struct service_provider *sp,
     mkdir(dirname, 0755);
 
     char filename[MAX_PATH];
-    snprintf(filename, sizeof(filename), "%s/%lu/%lu", sp->data_dir, file_idx, version);
+    snprintf(filename, sizeof(filename), "%s/%lu/%lu%s", sp->data_dir, file_idx, version, suffix);
 
     FILE *f = fopen(filename, "w");
 
@@ -175,14 +169,21 @@ size_t file_len(FILE *f)
 }
 
 void *read_contents(const struct service_provider *sp,
-                    uint64_t file_idx, uint64_t version,
-                    size_t *len)
+		    uint64_t file_idx, uint64_t version, const char *suffix,
+		    size_t *len)
 {
+    assert(len);
     char filename[MAX_PATH];
-    snprintf(filename, sizeof(filename), "%s/%lu/%lu", sp->data_dir, file_idx, version);
+    snprintf(filename, sizeof(filename), "%s/%lu/%lu%s", sp->data_dir, file_idx, version, suffix);
 
     FILE *f = fopen(filename, "r");
 
+    if(!f)
+    {
+	*len = 0;
+	return NULL;
+    }
+    
     *len = file_len(f);
 
     void *buf = malloc(*len);
@@ -367,8 +368,6 @@ static void free_version(struct file_version *ver)
 {
     if(ver)
     {
-        iomt_free(ver->buildcode);
-        iomt_free(ver->composefile);
         free(ver);
     }
 }
@@ -489,10 +488,6 @@ static void insert_version(struct service_provider *sp,
     sqlite3_bind_blob(st, 5, &ver->vr_cert, sizeof(ver->vr_cert), SQLITE_TRANSIENT);
     sqlite3_bind_blob(st, 6, &ver->vr_hmac, sizeof(ver->vr_hmac), SQLITE_TRANSIENT);
 
-    sqlite3_bind_int64(st, 7, ver->buildcode ? ver->buildcode->mt_logleaves : -1);
-
-    sqlite3_bind_int64(st, 8, ver->composefile ? ver->composefile->mt_logleaves : -1);
-
     int rc = sqlite3_step(st);
     if(rc != SQLITE_DONE)
     {
@@ -544,21 +539,6 @@ static struct file_version *lookup_version(struct service_provider *sp,
         memcpy(&ver->encrypted_secret, sqlite3_column_blob(st, 3), sizeof(ver->encrypted_secret));
         memcpy(&ver->vr_cert, sqlite3_column_blob(st, 4), sizeof(ver->vr_cert));
         memcpy(&ver->vr_hmac, sqlite3_column_blob(st, 5), sizeof(ver->vr_hmac));
-
-        int64_t bc_logleaves = sqlite3_column_int64(st, 6);
-        int64_t cf_logleaves = sqlite3_column_int64(st, 7);
-
-        ver->buildcode = bc_logleaves >= 0 ? iomt_new_from_db(sp->db,
-                                                              "BCNodes", "BCLeaves",
-                                                              "FileIdx", file_idx,
-                                                              "Version", version,
-                                                              bc_logleaves) : NULL;
-
-        ver->composefile = cf_logleaves >= 0 ? iomt_new_from_db(sp->db,
-                                                                "CFNodes", "CFLeaves",
-                                                                "FileIdx", file_idx,
-                                                                "Version", version,
-                                                                cf_logleaves) : NULL;
         return ver;
     }
     return NULL;
@@ -588,8 +568,9 @@ struct tm_cert sp_request(struct service_provider *sp,
                           struct tm_cert *vr_out, hash_t *vr_hmac_out,
                           hash_t *ack_hmac_out,
                           hash_t encrypted_secret, hash_t kf,
-                          const struct iomt *buildcode, const struct iomt *composefile,
                           const void *encrypted_contents, size_t contents_len,
+			  const void *buildcode, size_t buildcode_len,
+			  const void *composefile, size_t composefile_len,
                           const struct iomt *new_acl)
 {
     struct tm_cert vr = cert_null;
@@ -662,23 +643,23 @@ struct tm_cert sp_request(struct service_provider *sp,
             ver.version = fr.fr.version;
             ver.vr_cert = vr;
             ver.vr_hmac = vr_hmac;
-
-            if(buildcode)
-                ver.buildcode = iomt_dup(buildcode);
-
-            if(composefile)
-                ver.composefile = iomt_dup(composefile);
-
+	    
+	    /* write to disk */
             if(encrypted_contents)
-            {
-                /* write to disk */
-                write_contents(sp, fr.fr.idx, fr.fr.version,
-                               encrypted_contents, contents_len);
-            }
-
+		write_contents(sp, fr.fr.idx, fr.fr.version, "",
+			       encrypted_contents, contents_len);
+	    
+	    if(buildcode)
+		 write_contents(sp, fr.fr.idx, fr.fr.version, "_bc",
+				buildcode, buildcode_len);
+	    
+	    if(composefile)
+		 write_contents(sp, fr.fr.idx, fr.fr.version, "_cf",
+				composefile, composefile_len);
+	    
             insert_version(sp, rec, &ver);
         }
-
+	
         if(need_insert)
             insert_record(sp, rec);
         else
@@ -810,7 +791,8 @@ struct tm_request sp_createfile(struct service_provider *sp,
                                         NULL, NULL,
                                         ack_hmac,
                                         hash_null, hash_null,
-                                        NULL, NULL,
+					NULL, 0,
+                                        NULL, 0,
                                         NULL, 0,
                                         acl);
     sp->n_placeholders--;
@@ -876,7 +858,8 @@ struct tm_request sp_modifyacl(struct service_provider *sp,
                                        NULL, NULL,
                                        ack_hmac,
                                        hash_null, hash_null,
-                                       NULL, NULL,
+				       NULL, 0,
+                                       NULL, 0,
                                        NULL, 0,
                                        new_acl);
 
@@ -891,8 +874,9 @@ struct tm_request sp_modifyfile(struct service_provider *sp,
                                 void *userdata,
                                 uint64_t file_idx,
                                 hash_t encrypted_secret, hash_t kf,
-                                const struct iomt *buildcode, const struct iomt *composefile,
                                 const void *encrypted_file, size_t filelen,
+				const void *buildcode, size_t buildcode_len,
+				const void *composefile, size_t composefile_len,
                                 hash_t *ack_hmac)
 {
     /* modification */
@@ -924,7 +908,9 @@ struct tm_request sp_modifyfile(struct service_provider *sp,
                                          &acl_orders);
 
     hash_t gamma = sha256(encrypted_file, filelen);
-    hash_t lambda = calc_lambda(gamma, buildcode, composefile, kf);
+    hash_t h_bc = buildcode ? sha256(buildcode, buildcode_len) : hash_null;
+    hash_t h_cf = composefile ? sha256(composefile, composefile_len) : hash_null;
+    hash_t lambda = calc_lambda(gamma, h_bc, h_cf, kf);
 
     struct tm_request req = req_filemodify(sp->tm,
                                            &rec->fr_cert, rec->fr_hmac,
@@ -953,8 +939,9 @@ struct tm_request sp_modifyfile(struct service_provider *sp,
                                        &vr, &vr_hmac,
                                        ack_hmac,
                                        encrypted_secret, kf,
-                                       buildcode, composefile,
                                        encrypted_file, filelen,
+				       buildcode, buildcode_len,
+				       composefile, composefile_len,
                                        NULL);
 
     /* We return the request because that is how the module's
@@ -1042,8 +1029,10 @@ void *sp_retrieve_file(struct service_provider *sp,
                        uint64_t version,
                        hash_t *encrypted_secret,
                        hash_t *kf,
-                       struct iomt **buildcode,
-                       struct iomt **composefile,
+                       void **buildcode,
+		       size_t *bc_len,
+                       void **composefile,
+		       size_t *cf_len,
                        size_t *len)
 {
     struct file_record *rec = lookup_record(sp, file_idx);
@@ -1095,13 +1084,13 @@ void *sp_retrieve_file(struct service_provider *sp,
     if(kf)
         *kf = ver->kf;
 
-    void *ret = read_contents(sp, file_idx, version, len);
+    void *ret = read_contents(sp, file_idx, version, "", len);
 
-    /* duplicate compose and build files */
+    /* read contents of build/compose files */
     if(buildcode)
-        *buildcode = iomt_dup(ver->buildcode);
+	 *buildcode = read_contents(sp, file_idx, version, "_bc", bc_len);
     if(composefile)
-        *composefile = iomt_dup(ver->composefile);
+	 *composefile = read_contents(sp, file_idx, version, "_cf", cf_len);
 
     free_record(rec);
     free_version(ver);
@@ -1166,15 +1155,13 @@ static void sp_handle_client(struct service_provider *sp, int cl)
     case MODIFY_FILE:
     {
         printf("Client: modify file %lu\n", user_req.modify_file.file_idx);
-        struct iomt *buildcode = iomt_deserialize(read_from_fd, &cl);
-        struct iomt *composefile = iomt_deserialize(read_from_fd, &cl);
-        size_t filelen;
-        recv(cl, &filelen, sizeof(filelen), MSG_WAITALL);
-
-        printf("File is %lu bytes.\n", filelen);
-        void *filebuf = malloc(filelen);
-        recv(cl, filebuf, filelen, MSG_WAITALL);
+	size_t filelen;
+	void *filebuf = deserialize_file(cl, &filelen);
 
+	size_t bc_len, cf_len;
+	void *bc = deserialize_file(cl, &bc_len);
+	void *cf = deserialize_file(cl, &cf_len);
+	
         if(sp_modifyfile(sp,
                          user_req.user_id,
                          get_client_signature,
@@ -1182,9 +1169,9 @@ static void sp_handle_client(struct service_provider *sp, int cl)
                          user_req.modify_file.file_idx,
                          user_req.modify_file.encrypted_secret,
                          user_req.modify_file.kf,
-                         buildcode,
-                         composefile,
                          filebuf, filelen,
+			 bc, bc_len,
+			 cf, cf_len,
                          &ack_hmac).type == REQ_NONE)
         {
             printf("Failed: %s\n", tm_geterror());
@@ -1192,8 +1179,6 @@ static void sp_handle_client(struct service_provider *sp, int cl)
 
         free(filebuf);
 
-        iomt_free(buildcode);
-        iomt_free(composefile);
         write(cl, &ack_hmac, sizeof(ack_hmac));
         break;
     }
@@ -1224,29 +1209,30 @@ static void sp_handle_client(struct service_provider *sp, int cl)
         printf("Client: retrieve file\n");
         hash_t encrypted_secret = hash_null, kf = hash_null;
         size_t len = 0;
-        struct iomt *buildcode = NULL, *composefile = NULL;
+	void *bc = NULL, *cf = NULL;
+	size_t bc_len = 0, cf_len = 0;
+	
         void *contents = sp_retrieve_file(sp,
                                           user_req.user_id,
                                           user_req.retrieve.file_idx,
                                           user_req.retrieve.version,
                                           &encrypted_secret,
                                           &kf,
-                                          &buildcode,
-                                          &composefile,
+					  &bc, &bc_len,
+					  &cf, &cf_len,
                                           &len);
         /* write everything (no HMAC; the client should do a
          * RETRIEVE_INFO request separately) */
         write(cl, &encrypted_secret, sizeof(encrypted_secret));
         write(cl, &kf, sizeof(kf));
-        iomt_serialize(buildcode, write_to_fd, &cl);
-        iomt_serialize(composefile, write_to_fd, &cl);
 
-        write(cl, &len, sizeof(len));
-        if(contents)
-        {
-            write(cl, contents, len);
-            free(contents);
-        }
+	serialize_file(cl, contents, len);
+	serialize_file(cl, bc, bc_len);
+	serialize_file(cl, cf, cf_len);
+	
+	free(contents);
+	free(bc);
+	free(cf);
 
         break;
     }
@@ -1315,7 +1301,7 @@ void sp_test(void)
     clock_t stop = clock();
 
     check("Tree initialization", sp != NULL);
-
+#if 0
     {
         hash_t ack_hmac;
         struct tm_request req = sp_createfile(sp, 1, test_sign_request, "a", &ack_hmac);
@@ -1341,7 +1327,7 @@ void sp_test(void)
         printf("%.1f modifications per second\n", (double)N_MODIFY * CLOCKS_PER_SEC / (stop - start));
 
         check("File modification", verify_ack(&req, "a", 1, ack_hmac));
-
+	
         hash_t hmac;
         /* check inside range, but empty slot */
         struct version_info vi = sp_fileinfo(sp, 1, 12, 1, hash_null, &hmac, NULL);
@@ -1412,7 +1398,8 @@ void sp_test(void)
 
         check("ACL modification 1", success);
     }
-
+#endif
+    
     if(logleaves < 5)
     {
         printf("CDI-IOMT contents: ");
diff --git a/service_provider.h b/service_provider.h
index b64bc82..65ba3bd 100644
--- a/service_provider.h
+++ b/service_provider.h
@@ -84,8 +84,9 @@ struct tm_cert sp_request(struct service_provider *sp,
                           struct tm_cert *vr_out, hash_t *vr_hmac_out,
                           hash_t *ack_hmac_out,
                           hash_t encrypted_secret, hash_t kf,
-                          const struct iomt *buildcode, const struct iomt *composefile,
                           const void *encrypted_contents, size_t contents_len,
+			  const void *buildcode, size_t buildcode_len,
+			  const void *composefile, size_t composefile_len,
                           const struct iomt *new_acl);
 
 /* Reserve a new file index with user_id added to the ACL. Returns
@@ -111,8 +112,9 @@ struct tm_request sp_modifyfile(struct service_provider *sp,
                                 void *userdata,
                                 uint64_t file_idx,
                                 hash_t encrypted_secret, hash_t kf,
-                                const struct iomt *buildcode, const struct iomt *composefile,
                                 const void *encrypted_file, size_t filelen,
+				const void *buildcode, size_t buildcode_len,
+				const void *composefile, size_t composefile_len,
                                 hash_t *ack_hmac);
 
 /* Retrieve authenticated information on a version of a file; if
@@ -131,8 +133,10 @@ void *sp_retrieve_file(struct service_provider *sp,
                        uint64_t version,
                        hash_t *encrypted_secret,
                        hash_t *kf,
-                       struct iomt **buildcode,
-                       struct iomt **composefile,
+                       void **buildcode,
+		       size_t *bc_len,
+                       void **composefile,
+		       size_t *cf_len,
                        size_t *len);
 
 void sp_test(void);