From 4fd61d8cdb08d5c418a7e0cf6d6464fdf3cd469c Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 09:19:21 -0500
Subject: [PATCH 01/10] [chore] Tweak enclave build

---
 Cargo.lock                  |  8 ++++----
 api/requirements-dev.txt    |  2 +-
 canary/requirements-dev.txt |  2 +-
 enclave/Dockerfile          | 23 ++++++++++++++++++-----
 4 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 05915b8..bc29dca 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -506,9 +506,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.4"
+version = "1.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9157bbaa6b165880c27a4293a474c91cdcf265cc68cc829bf10be0964a391caf"
+checksum = "c31a0499c1dc64f458ad13872de75c0eb7e3fdb0e67964610c914b034fc5956e"
 dependencies = [
  "jobserver",
  "libc",
@@ -1297,9 +1297,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.168"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aaeb2981e0606ca11d79718f8bb01164f1d6ed75080182d3abf017e6d244b6d"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "libloading"
diff --git a/api/requirements-dev.txt b/api/requirements-dev.txt
index 8fd892c..1db6f8c 100644
--- a/api/requirements-dev.txt
+++ b/api/requirements-dev.txt
@@ -1,3 +1,3 @@
 black==24.10.0
 aws-lambda-powertools[all,aws-sdk]==3.3.0
-boto3-stubs[dynamodb,kms]==1.35.81
+boto3-stubs[dynamodb,kms]
diff --git a/canary/requirements-dev.txt b/canary/requirements-dev.txt
index 8fd892c..1db6f8c 100644
--- a/canary/requirements-dev.txt
+++ b/canary/requirements-dev.txt
@@ -1,3 +1,3 @@
 black==24.10.0
 aws-lambda-powertools[all,aws-sdk]==3.3.0
-boto3-stubs[dynamodb,kms]==1.35.81
+boto3-stubs[dynamodb,kms]
diff --git a/enclave/Dockerfile b/enclave/Dockerfile
index 9d486ce..f9d4e0a 100644
--- a/enclave/Dockerfile
+++ b/enclave/Dockerfile
@@ -6,7 +6,7 @@
 ##
 ## based on https://github.com/aws/aws-nitro-enclaves-acm/blob/main/env/enclave/Dockerfile
 ####################################################################################################
-FROM public.ecr.aws/docker/library/rust:alpine as kmstool
+FROM public.ecr.aws/docker/library/rust:alpine AS kmstool
 
 ARG TARGETPLATFORM
 ENV RUSTFLAGS="-C target-feature=-crt-static"
@@ -36,6 +36,7 @@ RUN git clone --depth 1 -b v1.12.0 https://github.com/awslabs/aws-lc.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-lc \
     -B aws-lc/build
@@ -46,6 +47,7 @@ RUN git clone --depth 1 -b v1.3.46 https://github.com/aws/s2n-tls.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S s2n-tls \
     -B s2n-tls/build
@@ -56,6 +58,7 @@ RUN git clone --depth 1 -b v0.8.0 https://github.com/awslabs/aws-c-common.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-common \
     -B aws-c-common/build
@@ -76,6 +79,7 @@ RUN git clone --depth 1 -b v0.5.18 https://github.com/awslabs/aws-c-cal.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-cal \
     -B aws-c-cal/build
@@ -87,6 +91,7 @@ RUN cmake \
     -DUSE_VSOCK=1 \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-io \
     -B aws-c-io/build
@@ -97,6 +102,7 @@ RUN git clone --depth 1 -b v0.2.14 https://github.com/awslabs/aws-c-compression.
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-compression \
     -B aws-c-compression/build
@@ -107,6 +113,7 @@ RUN git clone --depth 1 -b v0.6.19 https://github.com/awslabs/aws-c-http.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-http \
     -B aws-c-http/build
@@ -117,16 +124,18 @@ RUN git clone --depth 1 -b v0.6.15 https://github.com/awslabs/aws-c-auth.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-auth \
     -B aws-c-auth/build
 RUN cmake --build aws-c-auth/build --parallel $(nproc) --target install
 
 # JSON-C library
-RUN git clone --depth 1 -b json-c-0.16-20220414 https://github.com/json-c/json-c.git
+RUN git clone --depth 1 -b json-c-0.18-20240915 https://github.com/json-c/json-c.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S json-c \
     -B json-c/build
@@ -134,6 +143,7 @@ RUN cmake --build json-c/build --parallel $(nproc) --target install
 
 # NSM LIB
 RUN git clone --depth 1 -b v0.4.0 "https://github.com/aws/aws-nitro-enclaves-nsm-api"
+RUN rustup target add $TARGETPLATFORM
 RUN cd aws-nitro-enclaves-nsm-api \
     && PATH="$PATH:/root/.cargo/bin" cargo build --release --target $TARGETPLATFORM --jobs $(nproc) -p nsm-lib \
     && mv target/$TARGETPLATFORM/release/libnsm.so /usr/lib/ \
@@ -152,22 +162,25 @@ RUN cmake --build aws-nitro-enclaves-sdk-c/build --parallel $(nproc) --target in
 ####################################################################################################
 ## Chef image
 ####################################################################################################
-FROM public.ecr.aws/docker/library/rust:alpine as chef
+FROM public.ecr.aws/docker/library/rust:alpine AS chef
+ARG TARGETPLATFORM
+
 WORKDIR /app
 RUN apk add --no-cache build-base
+RUN rustup target add $TARGETPLATFORM
 RUN cargo install cargo-chef --locked
 
 ####################################################################################################
 ## Planner image
 ####################################################################################################
-FROM chef as planner
+FROM chef AS planner
 COPY . .
 RUN cargo chef prepare --recipe-path recipe.json
 
 ####################################################################################################
 ## Builder image
 ####################################################################################################
-FROM chef as builder
+FROM chef AS builder
 ARG TARGETPLATFORM
 
 COPY --from=planner /app/recipe.json recipe.json

From 36e09e2afb5d3baff6332a9dcd09412825db3557 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 09:27:40 -0500
Subject: [PATCH 02/10] missed one

---
 enclave/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enclave/Dockerfile b/enclave/Dockerfile
index f9d4e0a..73d53fe 100644
--- a/enclave/Dockerfile
+++ b/enclave/Dockerfile
@@ -69,6 +69,7 @@ RUN git clone --depth 1 -b v0.1.2 https://github.com/awslabs/aws-c-sdkutils
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
+    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-sdkutils \
     -B aws-c-sdkutils/build

From cf1cf78091fa43eb24baa53b9c51f5af96fe4e02 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 10:13:35 -0500
Subject: [PATCH 03/10] remove shared libs

---
 enclave/Dockerfile | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/enclave/Dockerfile b/enclave/Dockerfile
index 73d53fe..097a519 100644
--- a/enclave/Dockerfile
+++ b/enclave/Dockerfile
@@ -36,7 +36,6 @@ RUN git clone --depth 1 -b v1.12.0 https://github.com/awslabs/aws-lc.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-lc \
     -B aws-lc/build
@@ -47,7 +46,6 @@ RUN git clone --depth 1 -b v1.3.46 https://github.com/aws/s2n-tls.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S s2n-tls \
     -B s2n-tls/build
@@ -58,7 +56,6 @@ RUN git clone --depth 1 -b v0.8.0 https://github.com/awslabs/aws-c-common.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-common \
     -B aws-c-common/build
@@ -69,7 +66,6 @@ RUN git clone --depth 1 -b v0.1.2 https://github.com/awslabs/aws-c-sdkutils
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-sdkutils \
     -B aws-c-sdkutils/build
@@ -80,7 +76,6 @@ RUN git clone --depth 1 -b v0.5.18 https://github.com/awslabs/aws-c-cal.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-cal \
     -B aws-c-cal/build
@@ -92,7 +87,6 @@ RUN cmake \
     -DUSE_VSOCK=1 \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-io \
     -B aws-c-io/build
@@ -103,7 +97,6 @@ RUN git clone --depth 1 -b v0.2.14 https://github.com/awslabs/aws-c-compression.
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-compression \
     -B aws-c-compression/build
@@ -114,7 +107,6 @@ RUN git clone --depth 1 -b v0.6.19 https://github.com/awslabs/aws-c-http.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-http \
     -B aws-c-http/build
@@ -125,7 +117,6 @@ RUN git clone --depth 1 -b v0.6.15 https://github.com/awslabs/aws-c-auth.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S aws-c-auth \
     -B aws-c-auth/build
@@ -136,7 +127,6 @@ RUN git clone --depth 1 -b json-c-0.18-20240915 https://github.com/json-c/json-c
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \
-    -DBUILD_SHARED_LIBS=1 \
     -DBUILD_TESTING=0 \
     -S json-c \
     -B json-c/build

From e2d06d8e6f57ca85b23cdc35ab9fd04e6b741c4b Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 10:35:10 -0500
Subject: [PATCH 04/10] Upgrade aws-lc from v1.12.0 to v1.41.1

---
 enclave/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enclave/Dockerfile b/enclave/Dockerfile
index 097a519..b24799d 100644
--- a/enclave/Dockerfile
+++ b/enclave/Dockerfile
@@ -32,7 +32,7 @@ RUN ln -s /usr/lib /usr/lib64
 WORKDIR /tmp/crt-builder
 
 # Build AWS libcrypto
-RUN git clone --depth 1 -b v1.12.0 https://github.com/awslabs/aws-lc.git
+RUN git clone --depth 1 -b v1.41.1 https://github.com/awslabs/aws-lc.git
 RUN cmake \
     -DCMAKE_PREFIX_PATH=/usr \
     -DCMAKE_INSTALL_PREFIX=/usr \

From fe95d6f4a76b8dfaa5ac9d2d6d8d031c33e1c01c Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 15:54:14 -0500
Subject: [PATCH 05/10] WIP

---
 .github/workflows/docker-bake.yml | 33 +++++++++++++++++++++++++++++++
 .github/workflows/rust.yml        | 10 ++++++----
 docker-bake.hcl                   | 21 ++++++++++++++++++++
 3 files changed, 60 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/docker-bake.yml
 create mode 100644 docker-bake.hcl

diff --git a/.github/workflows/docker-bake.yml b/.github/workflows/docker-bake.yml
new file mode 100644
index 0000000..a2a24e6
--- /dev/null
+++ b/.github/workflows/docker-bake.yml
@@ -0,0 +1,33 @@
+name: enclave bake
+
+on:
+  push:
+    branches:
+      - main
+      - jp-more-tweaks
+  pull_request:
+    branches:
+      - main
+      - jp-more-tweaks
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_TERM_COLOR: never
+
+jobs:
+  docker:
+    # if: github.repository_owner == 'aws-samples'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Set up Docker buildx
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+      - name: Build
+        uses: docker/bake-action@3fc70e1131fee40a422dd8dd0ff22014ae20a1f3 # v5.11.0
+        env:
+          SOURCE_DATE_EPOCH: 0
\ No newline at end of file
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index af407ae..ae89faf 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,4 +1,4 @@
-name: Rust
+name: rust tests
 
 on:
   push:
@@ -14,15 +14,17 @@ concurrency:
 
 env:
   RUST_BACKTRACE: 1
-  CARGO_TERM_COLOR: always
+  CARGO_TERM_COLOR: never
 
 jobs:
   test:
     if: github.repository_owner == 'aws-samples'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Cache
+        uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5
       - name: Format
         run: cargo fmt --all -- --check --verbose
       - name: Build
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 0000000..8fb0466
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,21 @@
+group "default" {
+    targets = ["parent", "enclave"]
+}
+
+target "parent" {
+    context = "./parent"
+    dockerfile = "Dockerfile"
+    args = {
+        TARGETPLATFORM = "x86_64-unknown-linux-gnu"
+    }
+    tags = ["parent-vault:latest"]
+}
+
+target "enclave" {
+    context = "./enclave"
+    dockerfile = "Dockerfile"
+    args = {
+        TARGETPLATFORM = "x86_64-unknown-linux-musl"
+    }
+    tags = ["enclave-vault:latest"]
+}
\ No newline at end of file

From b898c6a88ec0362fcc8042b05b418f34ea0edef2 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 15:55:21 -0500
Subject: [PATCH 06/10] Upgrade powertools from 3.3.0 to 3.4.0

---
 api/dependencies/requirements.txt    | 2 +-
 api/requirements-dev.txt             | 2 +-
 canary/dependencies/requirements.txt | 2 +-
 canary/requirements-dev.txt          | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/dependencies/requirements.txt b/api/dependencies/requirements.txt
index 8ef7437..08b42ac 100644
--- a/api/dependencies/requirements.txt
+++ b/api/dependencies/requirements.txt
@@ -1,4 +1,4 @@
-aws-lambda-powertools[tracer,parser]==3.3.0
+aws-lambda-powertools[tracer,parser]==3.4.0
 cryptography==43.0.3
 hpke==0.3.2
 pksuid==1.1.2
diff --git a/api/requirements-dev.txt b/api/requirements-dev.txt
index 1db6f8c..132bc03 100644
--- a/api/requirements-dev.txt
+++ b/api/requirements-dev.txt
@@ -1,3 +1,3 @@
 black==24.10.0
-aws-lambda-powertools[all,aws-sdk]==3.3.0
+aws-lambda-powertools[all,aws-sdk]==3.4.0
 boto3-stubs[dynamodb,kms]
diff --git a/canary/dependencies/requirements.txt b/canary/dependencies/requirements.txt
index 699e280..1e769b7 100644
--- a/canary/dependencies/requirements.txt
+++ b/canary/dependencies/requirements.txt
@@ -1 +1 @@
-aws-lambda-powertools==3.3.0
+aws-lambda-powertools==3.4.0
diff --git a/canary/requirements-dev.txt b/canary/requirements-dev.txt
index 1db6f8c..132bc03 100644
--- a/canary/requirements-dev.txt
+++ b/canary/requirements-dev.txt
@@ -1,3 +1,3 @@
 black==24.10.0
-aws-lambda-powertools[all,aws-sdk]==3.3.0
+aws-lambda-powertools[all,aws-sdk]==3.4.0
 boto3-stubs[dynamodb,kms]

From 181f9c06ef16d1a53969d0a4f8386b1b8916246c Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 16:18:22 -0500
Subject: [PATCH 07/10] WIP

---
 .github/workflows/docker-bake.yml | 4 +---
 parent/Dockerfile                 | 6 +++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-bake.yml b/.github/workflows/docker-bake.yml
index a2a24e6..46fe4a9 100644
--- a/.github/workflows/docker-bake.yml
+++ b/.github/workflows/docker-bake.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches:
       - main
-      - jp-more-tweaks
   pull_request:
     branches:
       - main
-      - jp-more-tweaks
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -20,7 +18,7 @@ env:
 
 jobs:
   docker:
-    # if: github.repository_owner == 'aws-samples'
+    if: github.repository_owner == 'aws-samples'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/parent/Dockerfile b/parent/Dockerfile
index 94560d5..4f5300c 100644
--- a/parent/Dockerfile
+++ b/parent/Dockerfile
@@ -4,7 +4,7 @@
 ####################################################################################################
 ## Chef image
 ####################################################################################################
-FROM public.ecr.aws/docker/library/rust:latest as chef
+FROM public.ecr.aws/docker/library/rust:latest AS chef
 ARG TARGETPLATFORM
 
 WORKDIR /app
@@ -15,14 +15,14 @@ RUN cargo install cargo-chef --locked
 ####################################################################################################
 ## Planner image
 ####################################################################################################
-FROM chef as planner
+FROM chef AS planner
 COPY . .
 RUN cargo chef prepare  --recipe-path recipe.json
 
 ####################################################################################################
 ## Builder image
 ####################################################################################################
-FROM chef as builder
+FROM chef AS builder
 ARG TARGETPLATFORM
 
 COPY --from=planner /app/recipe.json recipe.json

From d1ca4962502cc2457e5fd5ff9e7960aa955e7572 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 16:23:38 -0500
Subject: [PATCH 08/10] try caching

---
 .github/workflows/docker-bake.yml | 8 ++++++--
 docker-bake.hcl                   | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-bake.yml b/.github/workflows/docker-bake.yml
index 46fe4a9..d4dd27d 100644
--- a/.github/workflows/docker-bake.yml
+++ b/.github/workflows/docker-bake.yml
@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
+      - jp-more-tweaks
   pull_request:
     branches:
       - main
+      - jp-more-tweaks
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -18,7 +20,7 @@ env:
 
 jobs:
   docker:
-    if: github.repository_owner == 'aws-samples'
+    # if: github.repository_owner == 'aws-samples'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -28,4 +30,6 @@ jobs:
       - name: Build
         uses: docker/bake-action@3fc70e1131fee40a422dd8dd0ff22014ae20a1f3 # v5.11.0
         env:
-          SOURCE_DATE_EPOCH: 0
\ No newline at end of file
+          SOURCE_DATE_EPOCH: 0
+        with:
+          push: false
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 8fb0466..6529499 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -9,6 +9,8 @@ target "parent" {
         TARGETPLATFORM = "x86_64-unknown-linux-gnu"
     }
     tags = ["parent-vault:latest"]
+    cache-to = ["type=gha,ignore-error=true,mode=max,scope=parent"]
+    cache-from = ["type=gha,scope=parent"]
 }
 
 target "enclave" {
@@ -18,4 +20,6 @@ target "enclave" {
         TARGETPLATFORM = "x86_64-unknown-linux-musl"
     }
     tags = ["enclave-vault:latest"]
+    cache-to = ["type=gha,ignore-error=true,mode=max,scope=enclave"]
+    cache-from = ["type=gha,scope=enclave"]
 }
\ No newline at end of file

From 3b5d29e953e52f2307cec6ae15c4ec6f84aef298 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 16:26:30 -0500
Subject: [PATCH 09/10] change name

---
 .github/workflows/docker-bake.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-bake.yml b/.github/workflows/docker-bake.yml
index d4dd27d..cd443fc 100644
--- a/.github/workflows/docker-bake.yml
+++ b/.github/workflows/docker-bake.yml
@@ -1,4 +1,4 @@
-name: enclave bake
+name: docker bake
 
 on:
   push:

From 87ebb44b3e7461f20f7689f1af2a775cd4269bf5 Mon Sep 17 00:00:00 2001
From: Justin Plock <jplock@amazon.com>
Date: Fri, 20 Dec 2024 16:37:39 -0500
Subject: [PATCH 10/10] WIP

---
 .github/workflows/docker-bake.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/docker-bake.yml b/.github/workflows/docker-bake.yml
index cd443fc..c06cea8 100644
--- a/.github/workflows/docker-bake.yml
+++ b/.github/workflows/docker-bake.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches:
       - main
-      - jp-more-tweaks
   pull_request:
     branches:
       - main
-      - jp-more-tweaks
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -20,7 +18,7 @@ env:
 
 jobs:
   docker:
-    # if: github.repository_owner == 'aws-samples'
+    if: github.repository_owner == 'aws-samples'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout