test: add KMS E2E integration tests with TCB policy validation

Add end-to-end test suite that exercises the full KMS stack:
Hardhat node → contract deployment → auth-eth server → KMS server.

Tests cover auth-eth boot authorization (KMS/app allowed/denied),
KMS unauthenticated APIs (GetMeta, GetAppEnvEncryptPubKey, GetTempCaCert),
KMS authenticated APIs via RA-TLS (GetAppKey, SignCert), and TCB policy
scenarios including Intel QAL rules for dynamic_platform, cached_keys,
and TCB status validation.

Author: kvinwang

Cargo.lock

@@ -53,6 +53,7 @@ members = [
     "no_std_check",
     "size-parser",
     "port-forward",
+    "kms/e2e",
 ]
 resolver = "2"
 

Cargo.toml

@@ -800,6 +800,8 @@ pub fn default_policy(now_secs: u64) -> SimplePolicy {
         .platform_grace_period(Duration::from_secs(30 * 24 * 3600))
         .qe_grace_period(Duration::from_secs(30 * 24 * 3600))
         .allow_smt(true)
+        .allow_dynamic_platform(true)
+        .allow_cached_keys(true)
         .reject_advisory("INTEL-SA-01397")
         .reject_advisory("INTEL-SA-01367")
         .reject_advisory("INTEL-SA-01314")

dstack-attest/src/attestation.rs

@@ -0,0 +1,26 @@
+[package]
+name = "kms-e2e-client"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[[bin]]
+name = "kms-e2e-client"
+path = "src/main.rs"
+
+[dependencies]
+ra-tls = { workspace = true }
+ra-rpc = { workspace = true, features = ["client"] }
+dstack-kms-rpc = { workspace = true }
+dstack-guest-agent-rpc = { workspace = true }
+dstack-attest = { workspace = true }
+http-client = { workspace = true, features = ["prpc"] }
+anyhow = { workspace = true, features = ["std"] }
+serde_json = "1"
+serde = { workspace = true }
+hex = { workspace = true }
+tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
+clap = { workspace = true, features = ["env"] }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+scale = { workspace = true }

kms/e2e/Cargo.toml

@@ -0,0 +1,49 @@
+# KMS E2E test configuration template
+# Placeholders are replaced by run-e2e.sh at runtime
+
+[default]
+workers = 2
+max_blocking = 8
+ident = "DStack KMS E2E"
+temp_dir = "/tmp"
+keep_alive = 10
+log_level = "info"
+
+[rpc]
+address = "0.0.0.0"
+port = {{KMS_PORT}}
+
+[rpc.tls]
+key = "{{CERT_DIR}}/rpc.key"
+certs = "{{CERT_DIR}}/rpc.crt"
+
+[rpc.tls.mutual]
+ca_certs = "{{CERT_DIR}}/tmp-ca.crt"
+mandatory = false
+
+[core]
+cert_dir = "{{CERT_DIR}}"
+subject_postfix = ".dstack-e2e"
+admin_token_hash = ""
+
+[core.image]
+verify = false
+cache_dir = "{{IMAGE_CACHE_DIR}}"
+download_url = "http://localhost:8000/{OS_IMAGE_HASH}.tar.gz"
+download_timeout = "2m"
+
+[core.auth_api]
+type = "webhook"
+
+[core.auth_api.webhook]
+url = "http://127.0.0.1:{{AUTH_ETH_PORT}}"
+
+[core.auth_api.dev]
+gateway_app_id = "any"
+
+[core.onboard]
+enabled = true
+auto_bootstrap_domain = "e2e-test.local"
+quote_enabled = true
+address = "0.0.0.0"
+port = {{KMS_PORT}}