fix: reject unknown event_log_version values instead of silent fallback

from_u32 now returns Option<Self>, rejecting unknown values like 0 or 42
rather than silently degrading to V1. A silent downgrade could produce
incorrect RTMR measurements — a security-relevant bug.

Author: kvinwang

dstack-types/src/lib.rs

@@ -24,10 +24,11 @@ pub enum EventLogVersion {
 }
 
 impl EventLogVersion {
-    pub fn from_u32(v: u32) -> Self {
+    pub fn from_u32(v: u32) -> Option<Self> {
         match v {
-            2 => EventLogVersion::V2,
-            _ => EventLogVersion::V1,
+            1 => Some(EventLogVersion::V1),
+            2 => Some(EventLogVersion::V2),
+            _ => None,
         }
     }
 }
@@ -44,7 +45,8 @@ impl Serialize for EventLogVersion {
 impl<'de> Deserialize<'de> for EventLogVersion {
     fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
         let v = u32::deserialize(deserializer)?;
-        Ok(EventLogVersion::from_u32(v))
+        EventLogVersion::from_u32(v)
+            .ok_or_else(|| serde::de::Error::custom(format!("unknown event log version: {v}")))
     }
 }
 

dstack-util/src/main.rs

@@ -228,7 +228,8 @@ fn hex_decode(hex_str: &str) -> Result<Vec<u8>> {
 
 fn cmd_extend(extend_args: ExtendArgs) -> Result<()> {
     let payload = hex_decode(&extend_args.payload).context("Failed to decode payload")?;
-    let version = dstack_types::EventLogVersion::from_u32(extend_args.event_log_version);
+    let version = dstack_types::EventLogVersion::from_u32(extend_args.event_log_version)
+        .context("unsupported event log version")?;
     emit_runtime_event(&extend_args.event, &payload, version).context("Failed to extend RTMR")
 }