test(gpu): avoid hard-coded attestation nonces

Author: kvinwang

dstack/dstack-util/src/system_setup.rs

@@ -1601,7 +1601,8 @@ mod gpu {
 
         #[test]
         fn proxy_routes_ocsp_and_rim_and_selects_outpost_policy() {
-            let args = nvattest_args("abcd", Some("http://10.0.2.2:8090/")).unwrap();
+            let nonce = format!("test-nonce-{}", std::process::id());
+            let args = nvattest_args(&nonce, Some("http://10.0.2.2:8090/")).unwrap();
             assert!(args
                 .windows(2)
                 .any(|args| args == ["--ocsp-url", "http://10.0.2.2:8090/ocsp"]));
@@ -1612,17 +1613,18 @@ mod gpu {
                 .windows(2)
                 .any(|args| args == ["--relying-party-policy", TRUST_OUTPOST_POLICY]));
 
-            let direct = nvattest_args("abcd", None).unwrap();
+            let direct = nvattest_args(&nonce, None).unwrap();
             assert!(!direct.iter().any(|arg| arg == "--ocsp-url"));
             assert!(!direct.iter().any(|arg| arg == "--relying-party-policy"));
         }
 
         #[test]
         fn proxy_url_validation_is_fail_closed() {
-            assert!(nvattest_args("abcd", Some("file:///tmp/proxy")).is_err());
-            assert!(nvattest_args("abcd", Some("https://user@example.com")).is_err());
-            assert!(nvattest_args("abcd", Some("https://example.com?q=1")).is_err());
-            assert!(nvattest_args("abcd", Some("https://example.com/base")).is_err());
+            let nonce = format!("test-nonce-{}", std::process::id());
+            assert!(nvattest_args(&nonce, Some("file:///tmp/proxy")).is_err());
+            assert!(nvattest_args(&nonce, Some("https://user@example.com")).is_err());
+            assert!(nvattest_args(&nonce, Some("https://example.com?q=1")).is_err());
+            assert!(nvattest_args(&nonce, Some("https://example.com/base")).is_err());
             assert!(normalize_proxy_url(Some("  ")).unwrap().is_none());
         }
 

dstack/gpu-attest-proxy/src/lib.rs

@@ -595,19 +595,22 @@ mod tests {
         };
 
         let proxy = Proxy::new(config.clone()).await.unwrap();
-        let miss = proxy.handle_ocsp(ocsp_request(1)).await;
+        let nonce = std::process::id() as u8;
+        let miss = proxy.handle_ocsp(ocsp_request(nonce)).await;
         assert_eq!(miss.headers()["x-dstack-cache"], "MISS");
         assert_eq!(
             miss.into_body().collect().await.unwrap().to_bytes(),
             response
         );
-        let hit = proxy.handle_ocsp(ocsp_request(2)).await;
+        let hit = proxy.handle_ocsp(ocsp_request(nonce.wrapping_add(1))).await;
         assert_eq!(hit.headers()["x-dstack-cache"], "HIT");
         assert_eq!(requests.load(Ordering::SeqCst), 1);
 
         drop(proxy);
         let reopened = Proxy::new(config).await.unwrap();
-        let hit = reopened.handle_ocsp(ocsp_request(3)).await;
+        let hit = reopened
+            .handle_ocsp(ocsp_request(nonce.wrapping_add(2)))
+            .await;
         assert_eq!(hit.headers()["x-dstack-cache"], "HIT");
         assert_eq!(requests.load(Ordering::SeqCst), 1);
         upstream.abort();

dstack/gpu-attest-proxy/src/ocsp.rs

@@ -313,9 +313,10 @@ mod tests {
 
     #[test]
     fn cache_key_ignores_ocsp_nonce() {
+        let nonce = std::process::id() as u8;
         assert_eq!(
-            request_cache_key(&request(1)).unwrap(),
-            request_cache_key(&request(2)).unwrap()
+            request_cache_key(&request(nonce)).unwrap(),
+            request_cache_key(&request(nonce.wrapping_add(1))).unwrap()
         );
     }