feat: add include_hash_inputs parameter to GetQuote and Attest RPCs

Allow relying parties to opt-in to receiving the digest pre-image
(hash_input) for each event, enabling digest verification and
content inspection without knowing the dstack event schema.

Proto changes:
- RawQuoteArgs.include_hash_inputs: new bool field (default false)

Runtime changes:
- RuntimeEvent::hash_input() returns the bytes that get hashed:
  - V1: binary concatenation event_type_le || ":" || name || ":" || payload
  - V2: UTF-8 bytes of the JCS canonical JSON
- TdxEvent gains optional hash_input: Option<String> (hex-encoded)
- TdxEvent::fill_hash_input() populates it for runtime events
- When include_hash_inputs=true, guest-agent fills hash_input before
  returning the event log (in GetQuote) or serializing the attestation
  (in Attest)

Compatibility:
- Default off: existing clients see no change
- scale codec: hash_input is #[codec(skip)], derivable from other fields
- serde: hash_input uses skip_serializing_if Option::is_none — only
  appears in JSON when populated

Author: kvinwang

cc-eventlog/src/runtime_events.rs

@@ -114,18 +114,28 @@ impl RuntimeEvent {
     /// - V1: `SHA(event_type_le || ":" || event_name || ":" || payload)`
     /// - V2: `SHA(canonical_json({"event":"...","event_type":134217729,"payload":"hex...","version":2}))`
     pub fn digest<H: Hasher>(&self) -> H::Output {
+        H::hash([self.hash_input().as_slice()])
+    }
+
+    /// The exact byte sequence that gets hashed to produce the digest.
+    ///
+    /// Useful for relying parties that want to verify the digest computation
+    /// or inspect event content without knowing the dstack schema.
+    ///
+    /// - V1: binary concatenation `event_type_le || ":" || name || ":" || payload`
+    /// - V2: UTF-8 bytes of the JCS canonical JSON
+    pub fn hash_input(&self) -> Vec<u8> {
         match self.version {
-            EventLogVersion::V1 => H::hash([
-                &DSTACK_RUNTIME_EVENT_TYPE.to_ne_bytes()[..],
-                b":",
-                self.event.as_bytes(),
-                b":",
-                &self.payload,
-            ]),
-            EventLogVersion::V2 => {
-                let canonical = canonical_event_json_v2(&self.event, &self.payload);
-                H::hash([canonical.as_bytes()])
+            EventLogVersion::V1 => {
+                let mut buf = Vec::with_capacity(4 + 1 + self.event.len() + 1 + self.payload.len());
+                buf.extend_from_slice(&DSTACK_RUNTIME_EVENT_TYPE.to_ne_bytes());
+                buf.push(b':');
+                buf.extend_from_slice(self.event.as_bytes());
+                buf.push(b':');
+                buf.extend_from_slice(&self.payload);
+                buf
             }
+            EventLogVersion::V2 => canonical_event_json_v2(&self.event, &self.payload).into_bytes(),
         }
     }
 

cc-eventlog/src/tcg.rs

@@ -371,6 +371,7 @@ impl TryFrom<TcgEvent> for TdxEvent {
             event: Default::default(),
             event_payload: value.event.into(),
             version: Default::default(),
+            hash_input: None,
         })
     }
 }

cc-eventlog/src/tdx.rs

@@ -41,6 +41,17 @@ pub struct TdxEvent {
     #[serde(default, skip_serializing_if = "is_v1")]
     #[codec(skip)]
     pub version: EventLogVersion,
+
+    /// Optional digest pre-image, hex-encoded.
+    ///
+    /// The exact bytes hashed to produce `digest`. Only populated when
+    /// explicitly requested (e.g., via RPC opt-in) so that relying parties can
+    /// verify the digest computation or inspect v2 JSON content without
+    /// knowing the dstack schema.
+    /// Never included in scale encoding (derivable from other fields).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[codec(skip)]
+    pub hash_input: Option<String>,
 }
 
 fn is_v1(v: &EventLogVersion) -> bool {
@@ -56,6 +67,7 @@ impl TdxEvent {
             event,
             event_payload,
             version: EventLogVersion::default(),
+            hash_input: None,
         }
     }
 
@@ -70,6 +82,7 @@ impl TdxEvent {
                 event: self.event.clone(),
                 event_payload: self.event_payload.clone(),
                 version: self.version,
+                hash_input: self.hash_input.clone(),
             }
         } else {
             Self {
@@ -79,10 +92,22 @@ impl TdxEvent {
                 event: self.event.clone(),
                 event_payload: Vec::new(),
                 version: self.version,
+                hash_input: self.hash_input.clone(),
             }
         }
     }
 
+    /// Populate `hash_input` with the digest pre-image.
+    ///
+    /// For runtime events, this is the byte sequence defined by V1/V2 digest algorithms.
+    /// For boot-time TCG events, the pre-image is inherent in the original log format
+    /// and not reconstructable from this struct, so `hash_input` stays `None`.
+    pub fn fill_hash_input(&mut self) {
+        if let Some(runtime_event) = self.to_runtime_event() {
+            self.hash_input = Some(hex::encode(runtime_event.hash_input()));
+        }
+    }
+
     pub fn digest(&self) -> Vec<u8> {
         if let Some(runtime_event) = self.to_runtime_event() {
             return runtime_event.sha384_digest().to_vec();
@@ -118,10 +143,84 @@ impl From<RuntimeEvent> for TdxEvent {
             event: value.event,
             event_payload: value.payload,
             version,
+            hash_input: None,
         }
     }
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ez_hash::{Hasher, Sha384};
+    use sha2::{Digest as _, Sha384 as Sha384Hasher};
+
+    #[test]
+    fn fill_hash_input_v1() {
+        let runtime = RuntimeEvent::new(
+            "compose-hash".to_string(),
+            vec![0xde, 0xad],
+            EventLogVersion::V1,
+        );
+        let mut tdx: TdxEvent = runtime.into();
+        assert_eq!(tdx.hash_input, None);
+        tdx.fill_hash_input();
+        let input_hex = tdx.hash_input.as_ref().expect("hash_input populated");
+        let input = hex::decode(input_hex).unwrap();
+        // Hashing the hash_input must reproduce the event digest
+        let actual = Sha384Hasher::digest(&input);
+        assert_eq!(actual.as_slice(), &tdx.digest);
+    }
+
+    #[test]
+    fn fill_hash_input_v2_is_canonical_json() {
+        let runtime = RuntimeEvent::new(
+            "compose-hash".to_string(),
+            vec![0xab, 0xcd],
+            EventLogVersion::V2,
+        );
+        let mut tdx: TdxEvent = runtime.into();
+        tdx.fill_hash_input();
+        let input_hex = tdx.hash_input.as_ref().expect("hash_input populated");
+        let input = hex::decode(input_hex).unwrap();
+        let input_str = std::str::from_utf8(&input).unwrap();
+        // V2 hash_input is the canonical JSON
+        assert!(input_str.contains(r#""event":"compose-hash""#));
+        assert!(input_str.contains(r#""version":2"#));
+        assert!(input_str.contains(r#""payload":"abcd""#));
+        // And hashing it reproduces the digest
+        let actual = Sha384::hash([input.as_slice()]);
+        assert_eq!(actual.as_slice(), &tdx.digest);
+    }
+
+    #[test]
+    fn fill_hash_input_skips_non_runtime_events() {
+        let mut boot_event = TdxEvent::new(0, 0x1, "EV_POST_CODE".to_string(), vec![1, 2, 3]);
+        boot_event.fill_hash_input();
+        assert_eq!(boot_event.hash_input, None);
+    }
+
+    #[test]
+    fn hash_input_not_serialized_by_scale() {
+        use scale::{Decode, Encode};
+        let runtime = RuntimeEvent::new("test".to_string(), vec![1, 2], EventLogVersion::V2);
+        let mut tdx: TdxEvent = runtime.into();
+        tdx.fill_hash_input();
+        assert!(tdx.hash_input.is_some());
+        let encoded = tdx.encode();
+        let decoded = TdxEvent::decode(&mut &encoded[..]).unwrap();
+        // hash_input is codec(skip) so it's None after round-trip
+        assert_eq!(decoded.hash_input, None);
+    }
+
+    #[test]
+    fn hash_input_skipped_from_json_when_none() {
+        let runtime = RuntimeEvent::new("test".to_string(), vec![1], EventLogVersion::V1);
+        let tdx: TdxEvent = runtime.into();
+        let json = serde_json::to_string(&tdx).unwrap();
+        assert!(!json.contains("hash_input"));
+    }
+}
+
 /// Read both boottime and runtime event logs.
 pub fn read_event_log() -> Result<Vec<TdxEvent>> {
     let mut event_logs = TcgEventLog::decode_from_ccel_file()?.to_cc_event_log()?;

dstack-attest/src/attestation.rs

@@ -476,9 +476,21 @@ pub trait TdxAttestationExt {
     fn tdx_event_log(&self) -> Option<&[TdxEvent]>;
 
     /// Returns the TDX event log serialized as JSON.
-    fn tdx_event_log_string(&self) -> Option<String> {
-        self.tdx_event_log()
-            .map(|event_log| serde_json::to_string(event_log).unwrap_or_default())
+    ///
+    /// When `include_hash_inputs` is true, each runtime event carries its
+    /// digest pre-image (hex-encoded) so relying parties can verify it directly.
+    fn tdx_event_log_string(&self, include_hash_inputs: bool) -> Option<String> {
+        self.tdx_event_log().map(|event_log| {
+            if include_hash_inputs {
+                let mut events: Vec<TdxEvent> = event_log.to_vec();
+                for event in &mut events {
+                    event.fill_hash_input();
+                }
+                serde_json::to_string(&events).unwrap_or_default()
+            } else {
+                serde_json::to_string(event_log).unwrap_or_default()
+            }
+        })
     }
 
     /// Returns the parsed TD10 report from the embedded TDX quote.
@@ -699,6 +711,18 @@ impl<T> Attestation<T> {
         self.tdx_quote().map(|q| q.quote.clone())
     }
 
+    /// Populate `hash_input` on every runtime event in the TDX event log.
+    ///
+    /// Useful before serializing an attestation so relying parties get the
+    /// digest pre-images alongside events.
+    pub fn fill_event_hash_inputs(&mut self) {
+        if let Some(q) = self.tdx_quote_mut() {
+            for event in &mut q.event_log {
+                event.fill_hash_input();
+            }
+        }
+    }
+
     /// Get TDX event log bytes
     pub fn get_tdx_event_log_bytes(&self) -> Option<Vec<u8>> {
         self.tdx_quote()
@@ -707,9 +731,17 @@ impl<T> Attestation<T> {
 
     /// Get TDX event log string with RTMR[0-2] payloads stripped to reduce size.
     /// Only digests are kept for boot-time events; runtime events (RTMR3) retain full payload.
-    pub fn get_tdx_event_log_string(&self) -> Option<String> {
+    ///
+    /// When `include_hash_inputs` is true, each runtime event carries its digest
+    /// pre-image (hex-encoded) so relying parties can verify or inspect it directly.
+    pub fn get_tdx_event_log_string(&self, include_hash_inputs: bool) -> Option<String> {
         self.tdx_quote().map(|q| {
-            let stripped: Vec<_> = q.event_log.iter().map(|e| e.stripped()).collect();
+            let mut stripped: Vec<_> = q.event_log.iter().map(|e| e.stripped()).collect();
+            if include_hash_inputs {
+                for event in &mut stripped {
+                    event.fill_hash_input();
+                }
+            }
             serde_json::to_string(&stripped).unwrap_or_default()
         })
     }

dstack-attest/src/v1.rs

@@ -37,6 +37,13 @@ impl PlatformEvidence {
         }
     }
 
+    pub fn tdx_event_log_mut(&mut self) -> Option<&mut Vec<TdxEvent>> {
+        match self {
+            Self::Tdx { event_log, .. } => Some(event_log),
+            _ => None,
+        }
+    }
+
     pub fn into_stripped(self) -> Self {
         match self {
             Self::Tdx { quote, event_log } => Self::Tdx {

gateway/src/distributed_certbot.rs

@@ -378,6 +378,7 @@ impl DistributedCertBot {
         let quote = match agent
             .get_quote(RawQuoteArgs {
                 report_data: report_data.clone(),
+                include_hash_inputs: false,
             })
             .await
         {
@@ -389,7 +390,13 @@ impl DistributedCertBot {
         };
 
         // Get attestation
-        let attestation_str = match agent.attest(RawQuoteArgs { report_data }).await {
+        let attestation_str = match agent
+            .attest(RawQuoteArgs {
+                report_data,
+                include_hash_inputs: false,
+            })
+            .await
+        {
             Ok(resp) => serde_json::to_string(&resp).unwrap_or_default(),
             Err(err) => {
                 warn!("failed to get attestation for ACME account: {err:?}");
@@ -448,6 +455,7 @@ impl DistributedCertBot {
         let quote = match agent
             .get_quote(RawQuoteArgs {
                 report_data: report_data.clone(),
+                include_hash_inputs: false,
             })
             .await
         {
@@ -459,7 +467,13 @@ impl DistributedCertBot {
         };
 
         // Get attestation
-        let attestation = match agent.attest(RawQuoteArgs { report_data }).await {
+        let attestation = match agent
+            .attest(RawQuoteArgs {
+                report_data,
+                include_hash_inputs: false,
+            })
+            .await
+        {
             Ok(resp) => serde_json::to_string(&resp).unwrap_or_default(),
             Err(err) => {
                 warn!(domain, "failed to get attestation: {err:?}");

gateway/src/gen_debug_key.rs

@@ -50,6 +50,7 @@ async fn main() -> Result<()> {
     let quote_response = simulator_client
         .get_quote(RawQuoteArgs {
             report_data: report_data.to_vec(),
+            include_hash_inputs: false,
         })
         .await
         .context("Failed to get quote from simulator")?;

guest-agent-simulator/src/main.rs

@@ -78,17 +78,32 @@ impl PlatformBackend for SimulatorPlatform {
         )
     }
 
-    fn quote_response(&self, report_data: [u8; 64], vm_config: &str) -> Result<GetQuoteResponse> {
+    fn quote_response(
+        &self,
+        report_data: [u8; 64],
+        vm_config: &str,
+        include_hash_inputs: bool,
+    ) -> Result<GetQuoteResponse> {
         simulator::simulated_quote_response(
             &self.attestation,
             report_data,
             vm_config,
             self.patch_report_data,
+            include_hash_inputs,
         )
     }
 
-    fn attest_response(&self, report_data: [u8; 64]) -> Result<AttestResponse> {
-        simulator::simulated_attest_response(&self.attestation, report_data, self.patch_report_data)
+    fn attest_response(
+        &self,
+        report_data: [u8; 64],
+        include_hash_inputs: bool,
+    ) -> Result<AttestResponse> {
+        simulator::simulated_attest_response(
+            &self.attestation,
+            report_data,
+            self.patch_report_data,
+            include_hash_inputs,
+        )
     }
 
     fn emit_event(&self, event: &str, _payload: &[u8], _version: EventLogVersion) -> Result<()> {
@@ -169,7 +184,7 @@ mod tests {
     fn simulator_attest_response_uses_supplied_report_data() {
         let platform = load_fixture_platform();
         let report_data = [0x5a; 64];
-        let response = platform.attest_response(report_data).unwrap();
+        let response = platform.attest_response(report_data, false).unwrap();
         let patched = VersionedAttestation::from_bytes(&response.attestation)
             .unwrap()
             .into_v1();
@@ -186,7 +201,7 @@ mod tests {
         let original = fixture.clone().into_v1().report_data().unwrap();
         let platform = SimulatorPlatform::new(fixture, false);
         let report_data = [0x5a; 64];
-        let response = platform.attest_response(report_data).unwrap();
+        let response = platform.attest_response(report_data, false).unwrap();
         let patched = VersionedAttestation::from_bytes(&response.attestation)
             .unwrap()
             .into_v1();