fix: address CI failures and PR review comments

- Replace expect() with manual JSON escaping to satisfy clippy::expect_used
- Add #[codec(skip)] on RuntimeEvent.version to preserve scale binary compat
  with existing attestation fixtures
- Pass EventLogVersion from caller in Attestation::quote_with_app_id
- Read event_log_version from app-compose.json in extend-rtmr CLI instead
  of hardcoded default
- from_u32 now returns Option, rejecting unknown version values

Author: kvinwang

cc-eventlog/src/runtime_events.rs

@@ -33,6 +33,7 @@ pub struct RuntimeEvent {
     pub payload: Vec<u8>,
     /// Event log version
     #[serde(default, skip_serializing)]
+    #[codec(skip)]
     pub version: EventLogVersion,
 }
 
@@ -145,13 +146,29 @@ impl RuntimeEvent {
 /// Output: `{"event":"<name>","event_type":<type>,"payload":"<hex>"}`
 pub fn canonical_event_json(event: &str, event_type: u32, payload: &[u8]) -> String {
     // Per JCS, strings must use minimal JSON escaping.
-    // We use serde_json to correctly escape the event name.
-    let escaped_event = serde_json::to_string(event).expect("failed to serialize event name");
+    let escaped_event = json_escape_string(event);
     let hex_payload = hex::encode(payload);
-    format!(
-        r#"{{"event":{},"event_type":{},"payload":"{}"}}"#,
-        escaped_event, event_type, hex_payload
-    )
+    format!(r#"{{"event":"{escaped_event}","event_type":{event_type},"payload":"{hex_payload}"}}"#,)
+}
+
+/// Minimal JSON string escaping per RFC 8259.
+fn json_escape_string(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for ch in s.chars() {
+        match ch {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if c < '\x20' => {
+                use std::fmt::Write;
+                let _ = write!(out, "\\u{:04x}", c as u32);
+            }
+            c => out.push(c),
+        }
+    }
+    out
 }
 
 /// Replay event logs

dstack-attest/src/attestation.rs

@@ -1023,10 +1023,14 @@ impl Attestation {
 
     /// Create an attestation from a report data
     pub fn quote(report_data: &[u8; 64]) -> Result<Self> {
-        Self::quote_with_app_id(report_data, None)
+        Self::quote_with_app_id(report_data, None, EventLogVersion::default())
     }
 
-    pub fn quote_with_app_id(report_data: &[u8; 64], app_id: Option<[u8; 20]>) -> Result<Self> {
+    pub fn quote_with_app_id(
+        report_data: &[u8; 64],
+        app_id: Option<[u8; 20]>,
+        event_log_version: EventLogVersion,
+    ) -> Result<Self> {
         // Lock to prevent concurrent quote generation (TDX driver doesn't support it)
         let _guard = QUOTE_LOCK
             .lock()
@@ -1039,7 +1043,7 @@ impl Attestation {
             vec![RuntimeEvent::new(
                 "app-id".to_string(),
                 app_id.to_vec(),
-                EventLogVersion::V1,
+                event_log_version,
             )]
         } else {
             vec![]

dstack-types/src/lib.rs

@@ -13,7 +13,7 @@ use size_parser::human_size;
 ///
 /// Using an enum ensures exhaustive matching — adding a new version
 /// forces all match sites to be updated.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Encode, Decode)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub enum EventLogVersion {
     /// Legacy binary digest: `SHA(event_type_le || ":" || name || ":" || payload)`
     #[default]

dstack-util/src/main.rs

@@ -90,10 +90,6 @@ struct ExtendArgs {
     #[clap(short, long)]
     /// hex encoded payload of the event
     payload: String,
-
-    #[clap(long, default_value_t = 1)]
-    /// event log version (1 = legacy, 2 = JSON canonical)
-    event_log_version: u32,
 }
 
 #[derive(Parser)]
@@ -228,11 +224,22 @@ fn hex_decode(hex_str: &str) -> Result<Vec<u8>> {
 
 fn cmd_extend(extend_args: ExtendArgs) -> Result<()> {
     let payload = hex_decode(&extend_args.payload).context("Failed to decode payload")?;
-    let version = dstack_types::EventLogVersion::from_u32(extend_args.event_log_version)
-        .context("unsupported event log version")?;
+    let version = read_event_log_version();
     emit_runtime_event(&extend_args.event, &payload, version).context("Failed to extend RTMR")
 }
 
+fn read_event_log_version() -> dstack_types::EventLogVersion {
+    let path = std::path::Path::new(dstack_types::shared_filenames::HOST_SHARED_DIR)
+        .join(dstack_types::shared_filenames::APP_COMPOSE);
+    let Ok(data) = std::fs::read_to_string(&path) else {
+        return Default::default();
+    };
+    let Ok(compose) = serde_json::from_str::<dstack_types::AppCompose>(&data) else {
+        return Default::default();
+    };
+    compose.event_log_version
+}
+
 fn cmd_rand(rand_args: RandArgs) -> Result<()> {
     let mut data = vec![0u8; rand_args.bytes];
     getrandom(&mut data).context("Failed to generate random data")?;

ra-tls/src/cert.rs

@@ -542,7 +542,7 @@ pub fn generate_ra_cert_with_app_id(
 
     let report_data = QuoteContentType::RaTlsCert.to_report_data(&pubkey);
 
-    let attestation = Attestation::quote_with_app_id(&report_data, app_id)
+    let attestation = Attestation::quote_with_app_id(&report_data, app_id, Default::default())
         .context("Failed to get quote for cert pubkey")?
         .into_versioned();