refactor(attestation): remove AWS review churn

Restore the established string-error measurement API while using or_panic for invariant-only CBOR encoding. Consolidate TCB and key-release policy helpers, move AWS image-binding tests to the verifier, and remove redundant tests, dead accessors, and unrelated TPM/NSM diff noise.

Author: kvinwang

dstack/Cargo.lock

@@ -489,20 +489,6 @@ impl DstackVerifiedReport {
             | DstackVerifiedReport::DstackAwsNitroTpm(_) => None,
         }
     }
-
-    pub fn aws_nitro_tpm_public_key(&self) -> Option<&[u8]> {
-        match self {
-            DstackVerifiedReport::DstackAwsNitroTpm(report) => report.public_key.as_deref(),
-            _ => None,
-        }
-    }
-
-    pub fn aws_nitro_tpm_nonce(&self) -> Option<&[u8]> {
-        match self {
-            DstackVerifiedReport::DstackAwsNitroTpm(report) => report.nonce.as_deref(),
-            _ => None,
-        }
-    }
 }
 
 /// Represents a verified attestation
@@ -1111,27 +1097,20 @@ impl DstackNitroQuote {
 const AWS_NITRO_TPM_BOOT_PCRS: &[u16] = &[4, 7, 12];
 /// All dstack measured events (TDX RTMR3 analogue). Non-resettable on NitroTPM.
 const AWS_NITRO_TPM_EVENT_PCR: u16 = 14;
-/// Optional config commitment PCR (mr_config-like). Extended from shared-disk config only.
-pub const AWS_NITRO_TPM_CONFIG_PCR: u16 = 8;
+/// Optional config commitment PCR, extended once from the guest-computed MrConfig V2 id.
+pub(crate) const AWS_NITRO_TPM_CONFIG_PCR: u16 = 8;
 
 fn aws_nitro_tpm_pcr(pcrs: &std::collections::BTreeMap<u16, Vec<u8>>, index: u16) -> Result<&[u8]> {
     pcrs.get(&index)
         .map(Vec::as_slice)
         .with_context(|| format!("PCR {index} not found"))
 }
 
-/// Replay boundary for AWS event PCR, aligned with bare TDX RTMR3:
-/// - `boottime_mr`: stop at `boot-mr-done` (early / KMS pin snapshot)
-/// - otherwise: replay the full event log present in the quote
-fn aws_nitro_tpm_event_boundary(boottime_mr: bool) -> Option<&'static str> {
-    boottime_mr.then_some("boot-mr-done")
-}
-
 fn aws_nitro_tpm_replayed_event_pcr(
     runtime_events: &[RuntimeEvent],
     boottime_mr: bool,
 ) -> <Sha384 as Hasher>::Output {
-    replay_runtime_events::<Sha384>(runtime_events, aws_nitro_tpm_event_boundary(boottime_mr))
+    replay_runtime_events::<Sha384>(runtime_events, boottime_mr.then_some("boot-mr-done"))
 }
 
 /// Bind the event log to the quoted PCR14 register.
@@ -1180,7 +1159,7 @@ pub fn aws_nitro_tpm_boot_pcr_digest(
 }
 
 impl DstackAwsNitroTpmQuote {
-    pub fn decode_pcrs(&self) -> Result<std::collections::BTreeMap<u16, Vec<u8>>> {
+    pub(crate) fn decode_pcrs(&self) -> Result<std::collections::BTreeMap<u16, Vec<u8>>> {
         let cose = nsm_qvl::CoseSign1::from_bytes(&self.attestation_doc)
             .context("failed to decode NitroTPM COSE document")?;
         let doc = nsm_qvl::AttestationDocument::from_cbor(&cose.payload)
@@ -2036,12 +2015,11 @@ impl Attestation {
             AttestationMode::DstackNitroEnclave => String::new(),
         };
         let runtime_events = match mode {
-            AttestationMode::DstackTdx | AttestationMode::DstackGcpTdx => {
+            AttestationMode::DstackTdx
+            | AttestationMode::DstackGcpTdx
+            | AttestationMode::DstackAwsNitroTpm => {
                 RuntimeEvent::read_all().context("Failed to read runtime events")?
             }
-            AttestationMode::DstackAwsNitroTpm => {
-                RuntimeEvent::read_all().context("failed to read runtime events")?
-            }
             AttestationMode::DstackAmdSevSnp => vec![],
             AttestationMode::DstackNitroEnclave => match app_id {
                 Some(app_id) => vec![RuntimeEvent::new("app-id".to_string(), app_id.to_vec())],
@@ -2085,12 +2063,8 @@ impl Attestation {
             AttestationMode::DstackAwsNitroTpm => {
                 // Challenge binding is report_data → NitroTPM user_data only
                 // (same role as TDX/GCP report_data; no separate nonce/public_key).
-                let attestation_doc = crate::aws_nitro_tpm::attestation_document(
-                    Some(report_data.to_vec()),
-                    None,
-                    None,
-                )
-                .context("failed to get NitroTPM attestation document")?;
+                let attestation_doc = crate::aws_nitro_tpm::attestation_document(report_data)
+                    .context("failed to get NitroTPM attestation document")?;
                 AttestationQuote::DstackAwsNitroTpm(DstackAwsNitroTpmQuote { attestation_doc })
             }
         };
@@ -2123,9 +2097,11 @@ impl Attestation {
                     .context("vm_config.aws_measurement is required on AWS NitroTPM")?;
                 document
                     .verify(&vm_config.os_image_hash)
+                    .map_err(anyhow::Error::msg)
                     .context("aws_measurement does not match os_image_hash")?;
                 let measurement = document
                     .decode_measurement()
+                    .map_err(anyhow::Error::msg)
                     .context("failed to decode aws_measurement")?;
                 let quoted_digest = aws_nitro_tpm_boot_pcr_digest(&pcrs)
                     .context("failed to compute boot_pcr_digest from attestation")?;
@@ -2699,6 +2675,13 @@ mod tests {
         assert_eq!(mrs.mr_system, changed_mrs.mr_system);
         assert_ne!(mrs.mr_aggregated, changed_mrs.mr_aggregated);
 
+        let mut changed_pcrs = pcrs.clone();
+        changed_pcrs.insert(12, vec![0x99; 48]);
+        let changed_pcr12 =
+            decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &changed_pcrs, &events)?;
+        assert_ne!(mrs.mr_system, changed_pcr12.mr_system);
+        assert_ne!(mrs.mr_aggregated, changed_pcr12.mr_aggregated);
+
         let mut missing_pcrs = pcrs.clone();
         missing_pcrs.remove(&AWS_NITRO_TPM_EVENT_PCR);
         let err = match decode_mr_aws_nitro_tpm_from_pcrs(
@@ -2727,89 +2710,6 @@ mod tests {
         Ok(())
     }
 
-    #[test]
-    fn aws_nitro_tpm_mr_aggregated_binds_pcr12() -> Result<()> {
-        let pcr4 = vec![0x04; 48];
-        let pcr7 = vec![0x07; 48];
-        let pcr12 = vec![0x12; 48];
-        let events = vec![
-            RuntimeEvent::new("app-id".into(), vec![0x11; 20]),
-            RuntimeEvent::new("compose-hash".into(), vec![0x22; 32]),
-            RuntimeEvent::new("instance-id".into(), vec![0x33; 20]),
-            RuntimeEvent::new("key-provider".into(), b"tpm".to_vec()),
-        ];
-        let replayed_pcr14 = cc_eventlog::replay_events::<Sha384>(&events, None);
-        let mr_key_provider = sha256(b"aws nitrotpm key provider");
-
-        let mut pcrs = std::collections::BTreeMap::from([
-            (4u16, pcr4.clone()),
-            (7u16, pcr7.clone()),
-            (12u16, pcr12.clone()),
-            (AWS_NITRO_TPM_EVENT_PCR, replayed_pcr14.to_vec()),
-        ]);
-        let base = decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &pcrs, &events)?;
-
-        pcrs.insert(12u16, vec![0x99; 48]);
-        let changed_pcr12 =
-            decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &pcrs, &events)?;
-        assert_ne!(base.mr_system, changed_pcr12.mr_system);
-        assert_ne!(base.mr_aggregated, changed_pcr12.mr_aggregated);
-
-        pcrs.remove(&12u16);
-        let err = match decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &pcrs, &events) {
-            Ok(_) => panic!("missing PCR12 must be rejected"),
-            Err(err) => err,
-        };
-        assert!(
-            format!("{err:#}").contains("PCR 12 not found"),
-            "unexpected error: {err:#}"
-        );
-        Ok(())
-    }
-
-    #[test]
-    fn aws_nitro_tpm_rejects_reordered_or_replayed_runtime_events() -> Result<()> {
-        let events = vec![
-            RuntimeEvent::new("app-id".into(), vec![0x11; 20]),
-            RuntimeEvent::new("compose-hash".into(), vec![0x22; 32]),
-            RuntimeEvent::new("instance-id".into(), vec![0x33; 20]),
-            RuntimeEvent::new("key-provider".into(), b"tpm".to_vec()),
-        ];
-        let quoted_pcr14 = cc_eventlog::replay_events::<Sha384>(&events, None);
-        let mr_key_provider = sha256(b"aws nitrotpm key provider");
-        let pcrs = std::collections::BTreeMap::from([
-            (4u16, vec![0x04; 48]),
-            (7u16, vec![0x07; 48]),
-            (12u16, vec![0x12; 48]),
-            (AWS_NITRO_TPM_EVENT_PCR, quoted_pcr14.to_vec()),
-        ]);
-
-        let mut reordered = events.clone();
-        reordered.swap(1, 2);
-        let err =
-            match decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &pcrs, &reordered) {
-                Ok(_) => panic!("runtime event reordering must be rejected"),
-                Err(err) => err,
-            };
-        assert!(
-            format!("{err:#}").contains("PCR14 mismatch"),
-            "unexpected error: {err:#}"
-        );
-
-        let mut replayed = events.clone();
-        replayed.push(RuntimeEvent::new("compose-hash".into(), vec![0x22; 32]));
-        let err = match decode_mr_aws_nitro_tpm_from_pcrs(false, &mr_key_provider, &pcrs, &replayed)
-        {
-            Ok(_) => panic!("runtime event replay/duplication must be rejected"),
-            Err(err) => err,
-        };
-        assert!(
-            format!("{err:#}").contains("PCR14 mismatch"),
-            "unexpected error: {err:#}"
-        );
-        Ok(())
-    }
-
     #[test]
     fn aws_nitro_tpm_pcr14_replays_full_event_log_like_rtmr3() -> Result<()> {
         // Single PCR14 lane: all events (including after system-ready) are

dstack/dstack-attest/src/attestation.rs

@@ -28,15 +28,11 @@ const TPMA_SESSION_CONTINUE_SESSION: u8 = 1 << 0;
 
 type HmacSha512 = Hmac<Sha512>;
 
-pub(crate) fn attestation_document(
-    user_data: Option<Vec<u8>>,
-    nonce: Option<Vec<u8>>,
-    public_key: Option<Vec<u8>>,
-) -> Result<Vec<u8>> {
+pub(crate) fn attestation_document(report_data: &[u8]) -> Result<Vec<u8>> {
     let request = nsm_api::Request::Attestation {
-        user_data: user_data.map(Into::into),
-        nonce: nonce.map(Into::into),
-        public_key: public_key.map(Into::into),
+        user_data: Some(report_data.to_vec().into()),
+        nonce: None,
+        public_key: None,
     };
 
     let device_path = tpm_device_path();

dstack/dstack-attest/src/aws_nitro_tpm.rs

@@ -110,7 +110,7 @@ pub fn measure_aws_config_pcr(config_id: &[u8; 48]) -> anyhow::Result<()> {
 /// The config id is extended as-is (it is already 48 bytes, the SHA384 bank
 /// digest size), so a verifier that recovers the claimed `config_id` can parse
 /// its version byte and recompute this value directly.
-pub fn expected_aws_config_pcr(config_id: &[u8; 48]) -> [u8; 48] {
+fn expected_aws_config_pcr(config_id: &[u8; 48]) -> [u8; 48] {
     use sha2::{Digest, Sha384};
     let mut material = [0u8; 96];
     material[48..].copy_from_slice(config_id);

dstack/dstack-attest/src/lib.rs

@@ -119,13 +119,6 @@ impl PlatformEvidence {
         }
     }
 
-    pub fn aws_nitro_tpm_attestation_doc(&self) -> Option<&[u8]> {
-        match self {
-            Self::AwsNitroTpm { attestation_doc } => Some(attestation_doc.as_slice()),
-            _ => None,
-        }
-    }
-
     pub fn sev_snp_report(&self) -> Option<&[u8]> {
         match self {
             Self::SevSnp { report, .. } => Some(report.as_slice()),

dstack/dstack-attest/src/v1.rs

@@ -148,8 +148,7 @@ fn upgrade_snp_config_for_split_measurement(config: &str) -> String {
         serde_json::from_value(measurement_value).expect("legacy SNP measurement input");
     let measurement = sev_os_image_measurement_from_input(&input)
         .expect("image measurement")
-        .to_cbor_vec()
-        .expect("image measurement cbor");
+        .to_cbor_vec();
     let sha256sum = format!(
         "{}  {}\n",
         hex::encode(Sha256::digest(&measurement)),
@@ -200,7 +199,7 @@ fn with_image_measurement(
     let mut image = dstack_types::SevOsImageMeasurement::from_cbor_slice(&document.measurement)
         .expect("decode measurement.snp.cbor");
     f(&mut image);
-    document.measurement = image.to_cbor_vec().expect("image measurement cbor");
+    document.measurement = image.to_cbor_vec();
     document.checksum_file = format!(
         "{}  {}\n",
         hex::encode(Sha256::digest(&document.measurement)),

dstack/dstack-attest/tests/sev_snp_verify.rs

@@ -75,7 +75,7 @@ fn main() -> Result<()> {
                 hex::decode(hash.trim()).context("GCP UKI Authenticode hash is not valid hex")?;
             let cbor = dstack_types::GcpOsImageMeasurement::new(hash)
                 .map_err(anyhow::Error::msg)?
-                .to_cbor_vec()?;
+                .to_cbor_vec();
             std::io::stdout()
                 .write_all(&cbor)
                 .context("failed to write GCP measurement CBOR")?;
@@ -128,11 +128,15 @@ fn main() -> Result<()> {
 fn inspect_measurement(kind: &str, path: &Path) -> Result<Value> {
     let cbor = fs_err::read(path).with_context(|| format!("failed to read {}", path.display()))?;
     match kind {
-        "tdx" => dstack_types::TdxOsImageMeasurement::cbor_json_value_from_slice(&cbor),
-        "snp" | "sev" => dstack_types::SevOsImageMeasurement::cbor_json_value_from_slice(&cbor),
-        "gcp" => dstack_types::GcpOsImageMeasurement::cbor_json_value_from_slice(&cbor),
+        "tdx" => dstack_types::TdxOsImageMeasurement::cbor_json_value_from_slice(&cbor)
+            .map_err(anyhow::Error::msg),
+        "snp" | "sev" => dstack_types::SevOsImageMeasurement::cbor_json_value_from_slice(&cbor)
+            .map_err(anyhow::Error::msg),
+        "gcp" => dstack_types::GcpOsImageMeasurement::cbor_json_value_from_slice(&cbor)
+            .map_err(anyhow::Error::msg),
         "aws" => {
-            let measurement = dstack_types::AwsOsImageMeasurement::from_cbor_slice(&cbor)?;
+            let measurement = dstack_types::AwsOsImageMeasurement::from_cbor_slice(&cbor)
+                .map_err(anyhow::Error::msg)?;
             serde_json::to_value(measurement).context("failed to convert AWS measurement to JSON")
         }
         other => bail!("unknown measurement kind {other:?}; expected tdx, snp, gcp, or aws"),
@@ -161,7 +165,7 @@ fn aws_measurement_cbor(pcr4_hex: &str, pcr7_hex: &str, pcr12_hex: &str) -> Resu
         &decode_sha384_pcr_hex("pcr12", pcr12_hex)?,
     )
     .map_err(anyhow::Error::msg)?;
-    measurement.to_cbor_vec()
+    Ok(measurement.to_cbor_vec())
 }
 
 fn read_hex_file(path: &str) -> Result<String> {

dstack/dstack-mr/src/main.rs

@@ -890,12 +890,12 @@ pub fn sev_os_image_measurement_for_image_dir(
 
 /// Compute the AMD SEV-SNP measurement-material hash from an OS image directory.
 pub fn sev_measurement_hash_for_image_dir(image_dir: &Path) -> Result<[u8; 32]> {
-    sev_os_image_measurement_for_image_dir(image_dir)?.measurement_hash()
+    Ok(sev_os_image_measurement_for_image_dir(image_dir)?.measurement_hash())
 }
 
 /// Generate the raw `measurement.snp.cbor` bytes for an image directory.
 pub fn sev_os_image_measurement_cbor_for_image_dir(image_dir: &Path) -> Result<Vec<u8>> {
-    sev_os_image_measurement_for_image_dir(image_dir)?.to_cbor_vec()
+    Ok(sev_os_image_measurement_for_image_dir(image_dir)?.to_cbor_vec())
 }
 
 /// `sha256(MEASUREMENT || HOST_DATA)` — the SNP aggregated identity digest.
@@ -966,6 +966,7 @@ pub fn measurement_input_from_snp_document(
     document: &SnpMeasurementDocument,
 ) -> Result<MeasurementInput> {
     let image = dstack_types::SevOsImageMeasurement::from_cbor_slice(&document.measurement)
+        .map_err(anyhow::Error::msg)
         .context("invalid measurement.snp.cbor")?;
     Ok(MeasurementInput {
         base_cmdline: image.base_cmdline,
@@ -1043,6 +1044,7 @@ pub fn parse_snp_inputs_from_vm_config(vm_config: &str) -> Result<SnpLaunchInput
         document.measurement.clone(),
     )
     .verify(&os_image_hash)
+    .map_err(anyhow::Error::msg)
     .context("amd sev-snp measurement material does not match os_image_hash")?;
     let input = measurement_input_from_snp_document(&document)?;
     validate_measurement_input(&input)?;
@@ -1232,8 +1234,7 @@ mod tests {
     fn snp_document(input: &MeasurementInput) -> SnpMeasurementDocument {
         let measurement = sev_os_image_measurement_from_input(input)
             .expect("image measurement")
-            .to_cbor_vec()
-            .expect("image measurement cbor");
+            .to_cbor_vec();
         let sha256sum = format!(
             "{}  {}\n",
             hex::encode(Sha256::digest(&measurement)),

dstack/dstack-mr/src/sev.rs

@@ -324,12 +324,12 @@ pub fn tdx_os_image_measurement_for_image_dir(image_dir: &Path) -> Result<TdxOsI
 
 /// Generate the raw `measurement.tdx.cbor` bytes for an image directory.
 pub fn tdx_os_image_measurement_cbor_for_image_dir(image_dir: &Path) -> Result<Vec<u8>> {
-    tdx_os_image_measurement_for_image_dir(image_dir)?.to_cbor_vec()
+    Ok(tdx_os_image_measurement_for_image_dir(image_dir)?.to_cbor_vec())
 }
 
 /// Compute the TDX static measurement-material hash for an image directory.
 pub fn tdx_measurement_hash_for_image_dir(image_dir: &Path) -> Result<[u8; 32]> {
-    tdx_os_image_measurement_for_image_dir(image_dir)?.measurement_hash()
+    Ok(tdx_os_image_measurement_for_image_dir(image_dir)?.measurement_hash())
 }
 
 /// Compute expected TDX measurements from self-contained TDX measurement
@@ -358,6 +358,7 @@ pub fn tdx_measurements_from_measurement_document(
 
     let measurement = document
         .decode_measurement()
+        .map_err(anyhow::Error::msg)
         .context("failed to decode TDX measurement CBOR")?;
     let mrtd = select_mrtd(&measurement, vm_config)?;
 

dstack/dstack-mr/src/tdx.rs

@@ -10,7 +10,6 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
-anyhow.workspace = true
 ciborium.workspace = true
 hex = { workspace = true, features = ["std"] }
 or-panic.workspace = true