refactor(attestation): explicit trust configuration and mock E2E by kvinwang · Pull Request #806 · Dstack-TEE/dstack

kvinwang · 2026-07-21T09:25:29Z

Summary

introduce a caller-owned AttestationVerifier containing one QVL verifier per evidence trust domain
load configured CA files and collateral URLs once, falling back to safe production defaults when omitted
pass the verifier explicitly through Verifier, KMS, Gateway, RA-RPC, and RA-TLS instead of using global state or environment variables
require attestation.insecure_allow_external_trust_anchors = true before loading any external CA file
add deterministic cryptographic mock attestation and separate-process E2E coverage for TDX, GCP TPM, AWS Nitro Enclave, AWS NitroTPM, and SEV-SNP

Configuration

[attestation]
insecure_allow_external_trust_anchors = false

[attestation.urls]
# pccs = "https://pccs.phala.network"
# amd_kds = "https://kdsintf.amd.com/vcek/v1"

[attestation.root_ca]
# tdx = "..."
# gcp_tpm = "..."
# aws_nitro_enclave = "..."
# aws_nitro_tpm = "..."
# sev_snp_milan = "..."
# sev_snp_genoa = "..."
# sev_snp_turin = "..."

Missing CA paths select the corresponding QVL production root. Missing URLs select the production PCCS/AMD KDS defaults. Loaded verifiers contain no paths, optional roots, insecure flag, or environment lookups.

Safety

production defaults retain vendor roots
external root paths without the explicit insecure opt-in fail during startup
no Root CA or AMD KDS environment-variable overrides
production SEV-SNP roots continue through the sev crate's AMD-specific chain validation; generic X.509 fallback is restricted to explicitly supplied roots
mock HTTP transport has connect/read/write timeouts and a bounded response size

Validation

cargo check --workspace
targeted tests for dstack-attest, RA-TLS/RPC, KMS, Gateway, Verifier, mock-attestation, simulator, and SEV-SNP QVL
strict Clippy (-D warnings) for affected libraries and production binaries

…y-compose # Conflicts: # dstack/local-key-provider/build/Dockerfile.key-provider

Copilot

Pull request overview

This PR extends dstack’s attestation stack to support externally configured verification trust anchors (while keeping vendor roots as the secure default), and adds a deterministic mock-attestation toolkit + E2E coverage to exercise TDX, TPM, NSM, and SEV-SNP verification paths.

Changes:

Add configurable attestation root trust anchors guarded by an explicit insecure_allow_external_trust_anchors opt-in across KMS, gateway, and verifier.
Introduce mock-attestation + dstack-tee-simulator integration for cryptographically valid, deterministic evidence/collateral across TDX/TPM/NSM/SEV-SNP.
Add a production-style full-stack Compose E2E suite to validate stateful upgrades and HA gateway behavior.

Reviewed changes

Copilot reviewed 62 out of 64 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test-suites/full-stack-compose/state/.gitkeep	Keep state dir in repo.
test-suites/full-stack-compose/scripts/runner.sh	Orchestrate full-stack rolling upgrade + assertions.
test-suites/full-stack-compose/scripts/render-config.sh	Render pinned E2E config + artifacts.
test-suites/full-stack-compose/scripts/network-probe.sh	HA probe during gateway rolling restart.
test-suites/full-stack-compose/scripts/app_compose.py	Generate measured app-compose manifests.
test-suites/full-stack-compose/scripts/allowlist.py	Manage mutable auth allowlist JSON.
test-suites/full-stack-compose/runtime/requirements.txt	Runtime Python deps for E2E tooling.
test-suites/full-stack-compose/runtime/Dockerfile	Build E2E runtime container image.
test-suites/full-stack-compose/run-upgrade-e2e.sh	Driver script for the upgrade E2E.
test-suites/full-stack-compose/README.md	Documentation for running the E2E suite.
test-suites/full-stack-compose/mock-cf-dns/server.py	Mock Cloudflare DNS API + UDP TXT server.
test-suites/full-stack-compose/mock-cf-dns/Dockerfile	Containerize mock DNS service.
test-suites/full-stack-compose/compose.yml	Compose stack for infra + runner.
test-suites/full-stack-compose/.gitignore	Ignore local env/state artifacts.
test-suites/full-stack-compose/.env.example	Example env overrides for E2E.
os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service	Export simulator env vars to systemd environment.
dstack/vmm/src/vmm-cli.py	Support updating KMS URL list via UpgradeApp.
dstack/vmm/src/tests/test_vmm_cli.py	Regression test for CLI upgrade params.
dstack/vmm/src/config.rs	Add optional `tee_simulator` config in CVM config.
dstack/vmm/src/app.rs	Include `tee_simulator` in guest sys-config JSON.
dstack/verifier/src/verification.rs	Refactor/prune image cache contents more safely + test.
dstack/verifier/src/main.rs	Load/apply configured root CA paths at startup.
dstack/verifier/dstack-verifier.toml	Document root CA overrides + opt-in gate.
dstack/tpm-qvl/src/lib.rs	Add TPM QVL `QuoteVerifier` with injectable root CA.
dstack/tpm-attest/src/lib.rs	Route to mock TPM path when mock-attestation enabled.
dstack/tpm-attest/src/gcp_ak.rs	Allow mock TPM quote generation via mock service.
dstack/tee-simulator/tests/process_e2e.rs	E2E test for separate simulator process + all platforms.
dstack/tee-simulator/src/tdx.rs	Generate TDX quotes from deterministic mock PKI seed.
dstack/tee-simulator/src/main.rs	Select platform from sys-config + run mock collateral service.
dstack/tee-simulator/Cargo.toml	Add deps for mock attestation and HTTP service.
dstack/tdx-attest/src/linux.rs	Allow mock TDX quote generation via mock service.
dstack/tdx-attest/Cargo.toml	Add `dstack-types` dependency for mock client.
dstack/sev-snp-qvl/src/lib.rs	Add injectable ARKs + adjust chain verification logic.
dstack/sev-snp-qvl/Cargo.toml	Add x509 parsing deps for chain verification.
dstack/sev-snp-attest/src/lib.rs	Support mock SEV-SNP evidence via mock service.
dstack/sev-snp-attest/Cargo.toml	Add serde + mock client deps.
dstack/nsm-qvl/src/lib.rs	Add NSM QVL `QuoteVerifier` with injectable root CA.
dstack/nsm-attest/src/lib.rs	Support mock NSM docs + safe drop when fd is synthetic.
dstack/nsm-attest/Cargo.toml	Add `dstack-types` dependency for mock client.
dstack/local-key-provider/build/Dockerfile.key-provider	Generate Gramine signing key via OpenSSL workaround.
dstack/kms/src/main.rs	Apply configured root CA paths at startup.
dstack/kms/src/config.rs	Add `root_ca` + opt-in gate to KMS config.
dstack/kms/kms.toml	Document root CA overrides + opt-in gate.
dstack/kms/Cargo.toml	Move `dstack-attest` to non-dev dependency.
dstack/gateway/src/main.rs	Apply configured root CA paths at startup.
dstack/gateway/src/config.rs	Add `root_ca` + opt-in gate to gateway config.
dstack/gateway/gateway.toml	Document root CA overrides + opt-in gate.
dstack/gateway/Cargo.toml	Add `dstack-attest` dependency.
dstack/dstack-types/src/mock_attestation.rs	Add minimal mock-attestation HTTP client.
dstack/dstack-types/src/lib.rs	Add `tee_simulator` sys-config types and module export.
dstack/dstack-types/Cargo.toml	Add `anyhow` dependency.
dstack/dstack-attest/src/attestation.rs	Root CA path support + simulator platform detection + verifier wiring.
dstack/dstack-attest/Cargo.toml	Add PEM parsing dependency.
dstack/crates/mock-attestation/src/tpm.rs	Generate verifiable mock TPM evidence/collateral.
dstack/crates/mock-attestation/src/tdx.rs	Generate verifiable mock TDX/DCAP evidence/collateral.
dstack/crates/mock-attestation/src/sev_snp.rs	Generate verifiable mock SEV-SNP evidence/cert chain.
dstack/crates/mock-attestation/src/server.rs	Serve mock PCCS/KDS/AIA endpoints + attest endpoints.
dstack/crates/mock-attestation/src/nsm.rs	Generate verifiable mock NSM COSE documents.
dstack/crates/mock-attestation/src/main.rs	CLI for generate/serve workflows.
dstack/crates/mock-attestation/src/lib.rs	Seed parsing + deterministic key generation + assets manifest.
dstack/crates/mock-attestation/README.md	Usage docs for mock-attestation + dev image flow.
dstack/crates/mock-attestation/Cargo.toml	Add new crate + deps.
dstack/Cargo.toml	Add mock-attestation crate to workspace.
dstack/Cargo.lock	Lockfile updates for new deps.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    let standard_x509_result = verify_x509_chain(&ark_bytes, &ask_bytes, &vcek_bytes);
    let ark = parse_certificate(&ark_bytes, "ark")?;
    let ask = parse_certificate(&ask_bytes, "ask")?;
    let vcek = parse_certificate(&vcek_bytes, "vcek")?;
-
-    let chain = Chain {
-        ca: ca::Chain { ark, ask },
-        vek: vcek.clone(),
-    };
-    chain
+    if standard_x509_result.is_err() {
+        Chain {
+            ca: ca::Chain { ark, ask },
+            vek: vcek.clone(),
+        }
        .verify()
        .map_err(|err| anyhow::anyhow!("amd cert chain verification failed: {err:?}"))?;
+    }


+    let authority = base.trim_start_matches("http://").trim_end_matches('/');
+    let mut stream = TcpStream::connect(authority)?;
+    let path = format!("/attest/{platform}");
+    write!(stream, "POST {path} HTTP/1.1\r\nHost: {authority}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", report_data.len())?;
+    stream.write_all(report_data)?;
+    let mut response = Vec::new();
+    stream.read_to_end(&mut response)?;


 Type=notify
 ExecCondition=/bin/sh -c '! grep -qE "^(tdx_guest|sev_guest)" /sys/kernel/config/tsm/report/*/provider 2>/dev/null'
 ExecStart=/usr/bin/dstack-tee-simulator
+ExecStartPost=/bin/sh -c 'systemctl set-environment $(cat /run/dstack/tee-simulator.env)'


kvinwang added 8 commits July 12, 2026 23:31

Add host-side compose TDX E2E suite

3d88c7b

Add KMS and Gateway upgrade E2E coverage

777749f

Make upgrade E2E production-faithful

4a5ae2d

Merge remote-tracking branch 'origin/master' into e2e-host-kms-gatewa…

2a16ce5

…y-compose # Conflicts: # dstack/local-key-provider/build/Dockerfile.key-provider

Fix E2E key provider integration after workspace migration

4d014d3

feat(attestation): configure verification root CAs

44e2312

feat(test): add cryptographic mock attestation toolkit

b428bdd

feat(test): inject mock attestation PKI through sys-config

6cfa1f6

Copilot AI review requested due to automatic review settings July 21, 2026 09:25

Copilot started reviewing on behalf of kvinwang July 21, 2026 09:26 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

kvinwang force-pushed the codex/external-attestation-root-ca branch from 59d5942 to 1408f8c Compare July 21, 2026 10:46

kvinwang changed the title ~~feat(attestation): configure external trust anchors and mock E2E~~ refactor(attestation): explicit trust configuration and mock E2E Jul 21, 2026

kvinwang force-pushed the codex/external-attestation-root-ca branch 2 times, most recently from d130c73 to b5838c4 Compare July 21, 2026 14:26

refactor(attestation): pass verifier trust configuration explicitly

f081f40

kvinwang force-pushed the codex/external-attestation-root-ca branch from b5838c4 to f081f40 Compare July 21, 2026 17:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor(attestation): explicit trust configuration and mock E2E#806

refactor(attestation): explicit trust configuration and mock E2E#806
kvinwang wants to merge 9 commits into
masterfrom
codex/external-attestation-root-ca

kvinwang commented Jul 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kvinwang commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Configuration

Safety

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kvinwang commented Jul 21, 2026 •

edited

Loading