security: harden FRI server and add MATLAB runtime integrity verification (fixes #272)

[GaneshPatil7517]

@pradeeban

Summary

This PR addresses multiple security concerns in the FRI server setup:

1. Removal of hardcoded Flask secret key
2. Prevention of development server usage in production
3. Addition of SHA256 verification for MATLAB Runtime download in Dockerfile

1. Hardcoded Secret Key

The Flask secret key was previously hardcoded as "secret key" in source code, which poses a security risk if deployed publicly. This PR replaces it with an environment-variable-based configuration:

• Uses FLASK_SECRET_KEY environment variable
• Raises RuntimeError if not defined
• Prevents insecure defaults

2. Development Server in Production

The Flask app previously ran without explicitly disabling debug mode. This PR:

• Sets debug=False explicitly in app.run()
• Preserves existing __main__ guard
• Adds comment recommending WSGI server (gunicorn) for production deployment

3. MATLAB Runtime Integrity Verification

The Dockerfile.sh downloaded a 2.5GB MATLAB Runtime binary without verifying integrity, introducing MITM risk. This PR:

• Adds MATLAB_RUNTIME_SHA256 environment variable with the expected checksum
• Validates the download with sha256sum -c -
• Fails Docker build if verification fails

Files Changed

• fri/server/main.py — secret key + debug mode fixes
• Dockerfile.sh — SHA256 checksum verification

Scope Control

• No changes made to concore-lite
• No changes to Verilog implementation
• No logic modifications outside security scope

Testing

• Confirmed Flask server raises RuntimeError when FLASK_SECRET_KEY is not set
• Confirmed Flask server loads successfully with valid FLASK_SECRET_KEY
• Confirmed secret key reads from environment variable correctly
• Confirmed debug=False is set and gunicorn comment is present
• Confirmed SHA256 checksum validation is in Dockerfile.sh

[Copilot]

Pull request overview

This PR hardens the FRI Flask server configuration and improves Docker build security by removing insecure defaults and adding integrity verification for a large external download.

Changes:

• Replaces the hardcoded Flask secret_key with FLASK_SECRET_KEY from the environment and fails fast when missing.
• Ensures the Flask development server is not run with debug enabled (debug=False) and adds a production WSGI (gunicorn) note.
• Adds SHA256 checksum verification for the MATLAB Runtime ZIP download during Docker build.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
fri/server/main.py	Removes hardcoded secret key, enforces env-based secret key, and explicitly disables Flask debug mode with a production gunicorn note.
Dockerfile.sh	Adds a SHA256 checksum check for the MATLAB Runtime download to prevent tampering/MITM issues during builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.