refactor(attestation): pass verifier trust configuration explicitly

Author: kvinwang

dstack/Cargo.lock

@@ -2,11 +2,16 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
+use std::sync::Arc;
+
 use anyhow::{Context, Result};
 use dstack_kms_rpc::{kms_client::KmsClient, SignCertRequest};
 use dstack_types::{AppKeys, KeyProvider};
 use ra_rpc::client::{RaClient, RaClientConfig};
-use ra_tls::cert::{generate_ra_cert, CaCert, CertSigningRequestV2};
+use ra_tls::{
+    attestation::AttestationVerifier,
+    cert::{generate_ra_cert, CaCert, CertSigningRequestV2},
+};
 
 pub enum CertRequestClient {
     Local {
@@ -54,7 +59,7 @@ impl CertRequestClient {
 
     pub async fn create(
         keys: &AppKeys,
-        pccs_url: Option<&str>,
+        attestation_verifier: Arc<AttestationVerifier>,
         vm_config: String,
     ) -> Result<CertRequestClient> {
         match &keys.key_provider {
@@ -79,7 +84,7 @@ impl CertRequestClient {
                     .tls_client_key(client_cert.key_pem)
                     .tls_ca_cert(keys.ca_cert.clone())
                     .tls_built_in_root_certs(false)
-                    .maybe_pccs_url(pccs_url.map(|s| s.to_string()))
+                    .attestation_verifier(attestation_verifier)
                     .build()
                     .into_client()
                     .context("Failed to create RA client")?;

dstack/cert-client/src/lib.rs

@@ -45,7 +45,3 @@ time.workspace = true
 [dev-dependencies]
 tempfile.workspace = true
 nsm-qvl.workspace = true
-tdx-attest.workspace = true
-sev-snp-attest.workspace = true
-nsm-attest.workspace = true
-tpm-attest.workspace = true

dstack/crates/mock-attestation/Cargo.toml

@@ -43,19 +43,27 @@ Select the platform in `.sys-config.json`; omission defaults to TDX:
 ```json
 {
   "tee_simulator": {
-    "platform": "sev-snp",
+    "platform": "dstack-amd-sev-snp",
     "mock_attestation_seed": "<64 hex characters>",
     "collateral_base_url": "http://HOST_REACHABLE_FROM_VERIFIER:8088"
   }
 }
 ```
 
-Valid values are `tdx`, `sev-snp`, `tpm`, and `nsm`. The guest only reads the
+Valid values mirror the supported attestation modes: `dstack-tdx`, `gcp-tdx`,
+`amd-sev-snp`, `aws-nitro-enclave`, and `aws-nitro-tpm`. The simulator exposes
+the production guest ABI for the selected platform (TSM configfs, vTPM, or an
+NSM CUSE character device); attester libraries contain no mock HTTP or
+environment-variable path. The guest only reads the
 seed from `.sys-config.json`; it never writes credentials or roots back into
 `/dstack/.host-shared`. CI retains the generated public roots and mounts them
 into verifier/KMS/gateway. The independently running host collateral service
-reconstructs the same hierarchy from the seed. TDX uses it as `pccs_url` and
-SEV-SNP uses its `/vcek/v1` path as the KDS base.
+reconstructs the same hierarchy from the seed. Configure it under
+`[attestation.urls]`: TDX uses `pccs`, and SEV-SNP uses `amd_kds`.
+
+Every verifier process must also explicitly set
+`attestation.insecure_allow_external_trust_anchors = true`. Merely mounting and
+configuring a mock root is rejected at startup while this flag remains false.
 
 The seed adds only 64 hex bytes (the generated fragment is well below 1 KiB),
 so the existing 32 KiB sys-config copy limit does not need to be enlarged.

dstack/crates/mock-attestation/README.md

@@ -123,7 +123,7 @@ pub fn generate_assets_from_seed(
     fs_err::write(
         output.join("sys-config-fragment.json"),
         serde_json::to_vec_pretty(&serde_json::json!({
-            "tee_simulator": { "platform": "tdx", "mock_attestation_seed": hex::encode(seed), "collateral_base_url": base_url }
+            "tee_simulator": { "platform": "dstack-tdx", "mock_attestation_seed": hex::encode(seed), "collateral_base_url": base_url }
         }))?,
     )?;
     Ok(manifest)

dstack/crates/mock-attestation/src/lib.rs

@@ -75,13 +75,21 @@ impl NsmGenerator {
     }
 
     pub fn attest(&self, report_data: &[u8]) -> Result<Vec<u8>> {
+        let pcrs = (0..=2)
+            .map(|index| (index, vec![index as u8; 48]))
+            .collect();
+        self.attest_with_pcrs(report_data, pcrs)
+    }
+
+    pub fn attest_with_pcrs(
+        &self,
+        report_data: &[u8],
+        pcrs: BTreeMap<u16, Vec<u8>>,
+    ) -> Result<Vec<u8>> {
         let timestamp = SystemTime::now()
             .duration_since(UNIX_EPOCH)
             .context("system clock before UNIX epoch")?
             .as_millis() as u64;
-        let pcrs = (0..=2)
-            .map(|index| (index, vec![index as u8; 48]))
-            .collect();
         let document = Document {
             module_id: "mock-nsm".into(),
             digest: "SHA384".into(),

dstack/crates/mock-attestation/src/nsm.rs

@@ -420,54 +420,4 @@ mod tests {
             .unwrap();
         task.abort();
     }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn production_attest_clients_use_dynamic_simulator_evidence() {
-        static ENV_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
-        let _guard = ENV_LOCK.lock().await;
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-        let state =
-            Arc::new(MockCollateralState::with_base_url(&format!("http://{addr}")).unwrap());
-        let task = tokio::spawn(serve_listener(listener, state.clone()));
-        std::env::set_var("DSTACK_MOCK_ATTESTATION_URL", format!("http://{addr}"));
-
-        let rd = [0x51; 64];
-        let tdx = tdx_attest::get_quote(&rd).unwrap();
-        let now = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
-            .as_secs();
-        dcap_qvl::verify::QuoteVerifier::new(state.tdx.root_ca_der())
-            .verify(&tdx, &state.tdx.sample_collateral().unwrap(), now)
-            .unwrap();
-
-        let sev = sev_snp_attest::get_report(rd).unwrap();
-        sev_snp_qvl::QuoteVerifier::new_with_root(
-            sev_snp_qvl::AmdSnpProduct::Milan,
-            state.sev_snp.root_ca_pem().into_bytes(),
-        )
-        .verify(&sev.report, &sev.cert_chain, &rd)
-        .unwrap();
-
-        let nsm = nsm_attest::NsmContext::new()
-            .unwrap()
-            .get_attestation_doc(Some(&rd), None, None)
-            .unwrap();
-        nsm_qvl::QuoteVerifier::new(state.nsm.root_ca_pem())
-            .verify(&nsm, None, None)
-            .unwrap();
-
-        let qualifying = [0x52; 32];
-        let tpm = tpm_attest::TpmContext::detect()
-            .unwrap()
-            .create_quote(&qualifying, &tpm_types::PcrSelection::sha256(&[14]))
-            .unwrap();
-        tpm_qvl::QuoteVerifier::new(state.tpm.root_ca_pem())
-            .verify(&tpm, &state.tpm.collateral())
-            .unwrap();
-
-        std::env::remove_var("DSTACK_MOCK_ATTESTATION_URL");
-        task.abort();
-    }
 }

dstack/crates/mock-attestation/src/server.rs

@@ -76,13 +76,30 @@ impl SevSnpGenerator {
     }
 
     pub fn attest(&self, report_data: [u8; 64]) -> Result<SevSnpEvidence> {
+        self.attest_with_host_data(report_data, [0x22; 32])
+    }
+
+    pub fn attest_with_host_data(
+        &self,
+        report_data: [u8; 64],
+        host_data: [u8; 32],
+    ) -> Result<SevSnpEvidence> {
+        self.attest_with_measurement(report_data, host_data, [0x33; 48])
+    }
+
+    pub fn attest_with_measurement(
+        &self,
+        report_data: [u8; 64],
+        host_data: [u8; 32],
+        measurement: [u8; 48],
+    ) -> Result<SevSnpEvidence> {
         let mut encoded = Vec::new();
         AttestationReport::default().write_bytes(&mut encoded)?;
         encoded[0..4].copy_from_slice(&2u32.to_le_bytes());
         encoded[52..56].copy_from_slice(&1u32.to_le_bytes());
         encoded[0x50..0x90].copy_from_slice(&report_data);
-        encoded[0x90..0xc0].fill(0x11);
-        encoded[0xc0..0xe0].fill(0x22);
+        encoded[0x90..0xc0].copy_from_slice(&measurement);
+        encoded[0xc0..0xe0].copy_from_slice(&host_data);
         encoded[0x1a0..0x1e0].fill(0x33);
         let signing_key = SigningKey::from_pkcs8_pem(&self.vcek_key.serialize_pem())?;
         let signature: P384Signature =

dstack/crates/mock-attestation/src/sev_snp.rs

@@ -129,6 +129,15 @@ impl TdxGenerator {
         &self,
         report_data: [u8; 64],
         rtmrs: [[u8; 48]; 4],
+    ) -> Result<TdxEvidence> {
+        self.attest_with_measurements(report_data, [0x11; 48], rtmrs)
+    }
+
+    pub fn attest_with_measurements(
+        &self,
+        report_data: [u8; 64],
+        mrtd: [u8; 48],
+        rtmrs: [[u8; 48]; 4],
     ) -> Result<TdxEvidence> {
         let auth_key = SigningKey::random(&mut rand::thread_rng());
         let auth_pub = auth_key.verifying_key().to_encoded_point(false);
@@ -175,7 +184,7 @@ impl TdxGenerator {
             seam_attributes: [0; 8],
             td_attributes: [0, 0, 0, 0x10, 0, 0, 0, 0],
             xfam: [0; 8],
-            mr_td: [0x11; 48],
+            mr_td: mrtd,
             mr_config_id: [0; 48],
             mr_owner: [0; 48],
             mr_owner_config: [0; 48],

dstack/crates/mock-attestation/src/tdx.rs

@@ -42,7 +42,6 @@ struct VerificationRequest {
     quote: String,
     event_log: String,
     vm_config: String,
-    pccs_url: Option<String>,
 }
 
 /// Response from dstack-verifier
@@ -88,7 +87,6 @@ struct AcmeInfoResponse {
 struct Monitor {
     gateway_uri: String,
     verifier_url: String,
-    pccs_url: Option<String>,
     base_domain: String,
     known_keys: BTreeSet<Vec<u8>>,
     last_checked: Option<u64>,
@@ -112,13 +110,12 @@ struct CTLog {
 impl Monitor {
     /// Create a new monitor
     /// `gateway` format: `base_domain[:port]`, e.g., `example.com` or `example.com:8443`
-    fn new(gateway: String, verifier_url: String, pccs_url: Option<String>) -> Result<Self> {
+    fn new(gateway: String, verifier_url: String) -> Result<Self> {
         let (base_domain, gateway_uri) = Self::parse_gateway(&gateway)?;
         validate_domain(&base_domain)?;
         Ok(Self {
             gateway_uri,
             verifier_url,
-            pccs_url,
             base_domain,
             known_keys: BTreeSet::new(),
             last_checked: None,
@@ -175,7 +172,6 @@ impl Monitor {
             quote: hex::encode(&quote_response.quote),
             event_log: quote_response.event_log,
             vm_config: quote_response.vm_config,
-            pccs_url: self.pccs_url.clone(),
         };
 
         // Call verifier
@@ -402,10 +398,6 @@ struct Args {
     /// The dstack-verifier URL
     #[arg(short, long, env = "VERIFIER_URL")]
     verifier_url: String,
-
-    /// PCCS URL for TDX collateral fetching (optional)
-    #[arg(long, env = "PCCS_URL")]
-    pccs_url: Option<String>,
 }
 
 #[tokio::main]
@@ -416,7 +408,7 @@ async fn main() -> anyhow::Result<()> {
         fmt().with_env_filter(filter).with_ansi(false).init();
     }
     let args = Args::parse();
-    let mut monitor = Monitor::new(args.gateway, args.verifier_url, args.pccs_url)?;
+    let mut monitor = Monitor::new(args.gateway, args.verifier_url)?;
     monitor.run().await;
     Ok(())
 }