Merge pull request #819 from Dstack-TEE/fix/full-stack-local-pccs

fix(e2e): use host PCCS configuration

Author: kvinwang

test-suites/full-stack-compose/.env.example

@@ -50,8 +50,9 @@ DSTACK_E2E_CID_START=15000
 DSTACK_E2E_QGS_PORT=4050
 DSTACK_E2E_QEMU_PATH=/usr/bin/qemu-system-x86_64
 
-# SGX QCNL config used by the Local-Key-Provider that seals each KMS CVM disk.
-DSTACK_E2E_QCNL_CONF=../../dstack/local-key-provider/build/sgx_default_qcnl.conf
+# Host SGX QCNL config used by the Local-Key-Provider that seals each KMS CVM disk.
+# It should point at a PCCS provisioned for this physical platform.
+DSTACK_E2E_QCNL_CONF=/etc/sgx_default_qcnl.conf
 
 # Runner behaviour.
 DSTACK_E2E_CLEAN_START=true

test-suites/full-stack-compose/README.md

@@ -63,7 +63,10 @@ would make a passing result irrelevant to production:
 
    - `/dev/kvm`, `/dev/vhost-vsock`, Intel TDX, and QGS (default port `4050`)
    - `/dev/sgx_enclave` and `/dev/sgx_provision`
-   - a working SGX QCNL/PCCS configuration
+   - a working host SGX QCNL configuration at `/etc/sgx_default_qcnl.conf`
+     whose PCCS is provisioned for this physical platform; override its path
+     with `DSTACK_E2E_QCNL_CONF` when needed. A public PCCS only works after
+     this platform's PCK certificate has been registered there.
    - an IPv4/DNS name for the host that is reachable from both the host-side
      deployment client and QEMU user-networked CVMs; the suite derives
      `<default-route-ip>.nip.io`, or accepts `DSTACK_E2E_KMS_RPC_DOMAIN`

test-suites/full-stack-compose/compose.yml

@@ -109,7 +109,7 @@ services:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
       - "/dev/sgx_provision:/dev/sgx_provision"
     volumes:
-      - ${DSTACK_E2E_QCNL_CONF:-../../dstack/local-key-provider/build/sgx_default_qcnl.conf}:/etc/sgx_default_qcnl.conf:ro
+      - ${DSTACK_E2E_QCNL_CONF:-/etc/sgx_default_qcnl.conf}:/etc/sgx_default_qcnl.conf:ro
       - aesmd-sock:/var/run/aesmd/
     restart: unless-stopped