refactor: drop merged CCEL event-log export

Remove the event_log_ccel GetQuote field and the TCG merge/encode/parse
machinery. The core of this change is the v2 self-describing digest
pre-image; the merged binary CCEL export can land separately if a
TCG-native verifier integration needs it.

This also restores TdxEvent::digest() to always recompute runtime-event
digests from the structured (name, payload, version) tuple: the stored-
digest precedence existed only for records parsed back from the merged
CCEL, which no longer occurs.

- remove build_ccel_event_log / encode_runtime_events_as_tcg /
  ccel_content_len / read_ccel_raw and the round-trip test; the tcg
  module is private again
- remove Attestation::get_tdx_event_log_ccel and the guest-agent
  fail-open plumbing
- drop event_log_ccel from agent_rpc.proto and the four SDKs
  (runtime-event version/preimage fields are unchanged)

Author: kvinwang

dstack/cc-eventlog/src/lib.rs

@@ -10,16 +10,13 @@ pub use tdx::TdxEvent;
 
 mod codecs;
 mod runtime_events;
-pub mod tcg;
+mod tcg;
 pub mod tdx;
 pub mod tpm;
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use dstack_types::EventLogVersion;
-    use ez_hash::{Hasher, Sha384};
-    use tdx::TdxEvent;
 
     #[test]
     fn parse_ccel() {
@@ -30,63 +27,4 @@ mod tests {
         let json = serde_json::to_string_pretty(&tdx_event_logs).unwrap();
         insta::assert_snapshot!(json);
     }
-
-    #[test]
-    fn encode_runtime_events_roundtrip() {
-        // Synthesize a CCEL: sample boot-time bytes + encoded runtime events.
-        // Decode with the same TcgEventLog parser and verify:
-        // 1. all boot-time events are preserved
-        // 2. runtime events appear with the expected pcrIndex / event_type / digest
-        // 3. sha384(event_data) == digest (the property we document)
-        let boot_raw = include_bytes!("../samples/ccel.bin");
-        let valid = tcg::ccel_content_len(boot_raw).unwrap();
-
-        let runtime_v1: TdxEvent = RuntimeEvent::new(
-            "app-id".to_string(),
-            vec![0xaa, 0xbb, 0xcc],
-            EventLogVersion::V1,
-        )
-        .into();
-        let runtime_v2: TdxEvent = RuntimeEvent::new(
-            "compose-hash".to_string(),
-            vec![0xde, 0xad, 0xbe, 0xef],
-            EventLogVersion::V2,
-        )
-        .into();
-        let runtime_events = vec![runtime_v1.clone(), runtime_v2.clone()];
-
-        let mut merged = boot_raw[..valid].to_vec();
-        merged.extend_from_slice(&tcg::encode_runtime_events_as_tcg(&runtime_events));
-        merged.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes());
-
-        let parsed = tcg::TcgEventLog::decode(&mut merged.as_slice()).unwrap();
-        let boot_count = tcg::TcgEventLog::decode(&mut boot_raw.as_slice())
-            .unwrap()
-            .event_logs
-            .len();
-        assert_eq!(parsed.event_logs.len(), boot_count + 2);
-
-        // Convert and verify runtime tail matches what we put in.
-        let converted = parsed.to_cc_event_log().unwrap();
-        let tail = &converted[converted.len() - 2..];
-        for (orig, got) in runtime_events.iter().zip(tail.iter()) {
-            assert_eq!(got.imr, orig.imr);
-            assert_eq!(got.event_type, orig.event_type);
-            assert_eq!(got.digest, orig.digest());
-            // The event_payload carried in TdxEvent after TCG round-trip is the
-            // preimage bytes we stored as TCG event data.
-            let runtime = orig.to_runtime_event().unwrap();
-            assert_eq!(got.event_payload, runtime.preimage());
-            assert_eq!(
-                got.preimage.as_deref(),
-                Some(hex::encode(&got.event_payload).as_str())
-            );
-            // Decoded CCEL records do not retain the structured dstack event
-            // tuple, so digest() must use the authoritative stored digest.
-            assert_eq!(got.digest(), got.digest);
-            // Property: sha384(event_data) == digest
-            let h = Sha384::hash([got.event_payload.as_slice()]);
-            assert_eq!(h.as_slice(), got.digest.as_slice());
-        }
-    }
 }

dstack/cc-eventlog/src/tcg.rs

@@ -4,7 +4,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::{codecs::VecOf, runtime_events::DSTACK_RUNTIME_EVENT_TYPE, tdx::TdxEvent};
+use crate::{codecs::VecOf, tdx::TdxEvent};
 use anyhow::{bail, Context, Result};
 use scale::Decode;
 use std::path::PathBuf;
@@ -302,8 +302,10 @@ impl TcgEventLog {
     }
 
     pub fn decode_from_ccel_file() -> Result<Self> {
-        let data = read_ccel_raw()?;
-        Self::decode(&mut data.as_slice())
+        let path = ccel_file_path()?;
+        let data = fs_err::read(&path)
+            .with_context(|| format!("failed to read CCEL from {}", path.display()))?;
+        Self::decode(&mut data.as_slice()).context("failed to decode CCEL")
     }
 
     pub fn to_cc_event_log(&self) -> Result<Vec<TdxEvent>> {
@@ -318,8 +320,8 @@ impl TcgEventLog {
 
 /// Resolve the CCEL path, honoring `DSTACK_CCEL_FILE` when set.
 ///
-/// Overrides must be non-empty absolute paths so relative values cannot
-/// silently resolve against the process working directory.
+/// Overrides must be non-empty absolute paths so relative values cannot silently
+/// resolve against the process working directory.
 fn ccel_file_path() -> Result<PathBuf> {
     let Some(value) = std::env::var_os(CCEL_FILE_ENV) else {
         return Ok(PathBuf::from(CCEL_FILE));
@@ -337,52 +339,6 @@ fn ccel_file_path() -> Result<PathBuf> {
     Ok(path)
 }
 
-/// Read the raw ACPI CCEL table bytes.
-pub fn read_ccel_raw() -> Result<Vec<u8>> {
-    let path = ccel_file_path()?;
-    fs_err::read(&path).with_context(|| format!("failed to read CCEL from {}", path.display()))
-}
-
-/// Return the length of the valid TCG event log prefix within a raw CCEL buffer.
-///
-/// ACPI CCEL tables are fixed-size regions padded with 0xFF; the event stream
-/// either ends with a 0xFFFFFFFF terminator or by running into that padding.
-/// This parses the buffer to find where real events end so the trailer can be
-/// stripped before appending runtime events.
-pub fn ccel_content_len(raw: &[u8]) -> Result<usize> {
-    let input = &mut &raw[..];
-    TcgEventLog::decode(input)?;
-    Ok(raw.len() - input.len())
-}
-
-/// Encode dstack runtime events as TCG_PCR_EVENT2 records.
-///
-/// Non-runtime events in the slice are skipped. Each runtime event becomes:
-/// - pcrIndex  = imr + 1 (0-based TdxEvent -> 1-based TCG pcrIndex)
-/// - eventType = DSTACK_RUNTIME_EVENT_TYPE
-/// - digests   = [{ TPM_ALG_SHA384, <48-byte digest> }]
-/// - event     = the digest pre-image bytes (`preimage`), so that
-///   sha384(event) == digest holds for any TCG parser.
-pub fn encode_runtime_events_as_tcg(events: &[TdxEvent]) -> Vec<u8> {
-    let mut out = Vec::new();
-    for event in events {
-        let Some(runtime) = event.to_runtime_event() else {
-            continue;
-        };
-        let preimage = runtime.preimage();
-        let digest = event.digest();
-        let pcr_index = event.imr.saturating_add(1);
-        out.extend_from_slice(&pcr_index.to_le_bytes());
-        out.extend_from_slice(&event.event_type.to_le_bytes());
-        out.extend_from_slice(&1u32.to_le_bytes());
-        out.extend_from_slice(&TPM_ALG_SHA384.to_le_bytes());
-        out.extend_from_slice(&digest);
-        out.extend_from_slice(&(preimage.len() as u32).to_le_bytes());
-        out.extend_from_slice(&preimage);
-    }
-    out
-}
-
 fn parse_spec_id_event_log<I: scale::Input>(
     input: &mut I,
 ) -> Result<(TcgEvent, TcgEfiSpecIdEvent)> {
@@ -430,9 +386,6 @@ impl TryFrom<TcgEvent> for TdxEvent {
             .next()
             .context("digest not found")?
             .hash;
-        let event_payload: Vec<u8> = value.event.into();
-        let preimage =
-            (value.event_type == DSTACK_RUNTIME_EVENT_TYPE).then(|| hex::encode(&event_payload));
         Ok(TdxEvent {
             imr: value
                 .imr_index
@@ -441,29 +394,13 @@ impl TryFrom<TcgEvent> for TdxEvent {
             event_type: value.event_type,
             digest,
             event: Default::default(),
-            event_payload,
+            event_payload: value.event.into(),
             version: Default::default(),
-            preimage,
+            preimage: None,
         })
     }
 }
 
-/// Build a merged TCG binary event log: raw ACPI CCEL (boot-time) followed by
-/// the given runtime events encoded as TCG_PCR_EVENT2 records.
-///
-/// Non-runtime entries in `events` are ignored; only events with
-/// `event_type == DSTACK_RUNTIME_EVENT_TYPE` are appended.
-pub fn build_ccel_event_log(events: &[TdxEvent]) -> Result<Vec<u8>> {
-    let raw = read_ccel_raw()?;
-    let end = ccel_content_len(&raw)?;
-    let mut out = raw[..end].to_vec();
-    out.extend_from_slice(&encode_runtime_events_as_tcg(events));
-    // Append the 0xFFFFFFFF terminator so parsers know where the event
-    // stream ends (the original ACPI table has trailing 0xFF padding).
-    out.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes());
-    Ok(out)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

dstack/cc-eventlog/src/tdx.rs

@@ -122,11 +122,6 @@ impl TdxEvent {
     }
 
     pub fn digest(&self) -> Vec<u8> {
-        // Parsed TCG/CCEL records already carry the authoritative digest, but
-        // do not necessarily retain dstack's structured event name/payload.
-        if !self.digest.is_empty() {
-            return self.digest.clone();
-        }
         if let Some(runtime_event) = self.to_runtime_event() {
             return runtime_event.sha384_digest().to_vec();
         }

dstack/dstack-attest/src/attestation.rs

@@ -1483,18 +1483,6 @@ impl<T> Attestation<T> {
             .and_then(|q| Quote::parse(&q.quote).ok())
             .and_then(|quote| quote.report.as_td10().cloned())
     }
-
-    /// Get the merged TCG binary CCEL event log (boot-time CCEL + runtime
-    /// events encoded as TCG_PCR_EVENT2 records).
-    ///
-    /// Returns an empty `Vec` on platforms without a TDX quote (e.g. Nitro).
-    /// Propagates errors from reading or parsing the ACPI CCEL file.
-    pub fn get_tdx_event_log_ccel(&self) -> Result<Vec<u8>> {
-        let Some(q) = self.tdx_quote() else {
-            return Ok(Vec::new());
-        };
-        cc_eventlog::tcg::build_ccel_event_log(&q.event_log)
-    }
 }
 
 pub trait GetDeviceId {

dstack/guest-agent-simulator/src/simulator.rs

@@ -45,7 +45,6 @@ pub fn simulated_quote_response(
         report_data: report_data.to_vec(),
         vm_config: vm_config.to_string(),
         attestation: versioned,
-        event_log_ccel: Vec::new(),
     })
 }
 

dstack/guest-agent/rpc/proto/agent_rpc.proto

@@ -210,27 +210,6 @@ message GetQuoteResponse {
   // Platform-adaptive versioned attestation (SCALE/msgpack encoded). Populated
   // on non-TDX platforms; TDX uses quote + event_log above.
   bytes attestation = 5;
-  // TCG binary Confidential Computing Event Log (CCEL) containing both
-  // boot-time events (from the ACPI CCEL table) and dstack runtime events
-  // (RTMR3) merged into a single stream.
-  //
-  // Encoding per TCG PC Client Platform Firmware Profile:
-  // - Starts with a Spec ID header event (TCG_PCClientPCREvent).
-  // - Boot-time events are copied verbatim from the ACPI CCEL table
-  //   (TCG_PCR_EVENT2 with the digests the firmware wrote).
-  // - Runtime events (event_type = 0x08000001) are appended as
-  //   TCG_PCR_EVENT2 records with:
-  //     * pcrIndex  = imr + 1 (so RTMR3 becomes 4)
-  //     * eventType = 0x08000001
-  //     * digests   = [{ algId: TPM_ALG_SHA384 (0xC), hash: 48 bytes }]
-  //     * event     = the digest pre-image bytes, so that
-  //                   sha384(event) == digest holds independently of the
-  //                   dstack schema. The pre-image is:
-  //                     V1: event_type_le || ":" || name || ":" || payload
-  //                     V2: canonical JSON (UTF-8)
-  //
-  // Empty on platforms without an ACPI CCEL table (e.g. Nitro Enclaves).
-  bytes event_log_ccel = 6;
 }
 
 // The request to derive a key

dstack/guest-agent/src/backend.rs

@@ -6,17 +6,6 @@ use anyhow::{Context, Result};
 use dstack_guest_agent_rpc::{AttestResponse, GetQuoteResponse};
 use ra_tls::attestation::Attestation;
 use ra_tls::attestation::{QuoteContentType, VersionedAttestation};
-use tracing::warn;
-
-fn event_log_ccel_or_empty(result: Result<Vec<u8>>) -> Vec<u8> {
-    match result {
-        Ok(event_log) => event_log,
-        Err(err) => {
-            warn!(error = ?err, "failed to build TDX CCEL event log");
-            Vec::new()
-        }
-    }
-}
 
 pub trait PlatformBackend: Send + Sync {
     fn attestation_for_info(&self) -> Result<VersionedAttestation>;
@@ -46,7 +35,6 @@ impl PlatformBackend for RealPlatform {
         let attestation = Attestation::quote(&report_data).context("Failed to get quote")?;
         let tdx_quote = attestation.get_tdx_quote_bytes();
         let tdx_event_log = attestation.get_tdx_event_log_string();
-        let event_log_ccel = event_log_ccel_or_empty(attestation.get_tdx_event_log_ccel());
         let versioned = if tdx_quote.is_some() {
             Vec::new()
         } else {
@@ -61,7 +49,6 @@ impl PlatformBackend for RealPlatform {
             report_data: report_data.to_vec(),
             vm_config: vm_config.to_string(),
             attestation: versioned,
-            event_log_ccel,
         })
     }
 
@@ -74,14 +61,3 @@ impl PlatformBackend for RealPlatform {
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ccel_export_failure_is_fail_open() {
-        let event_log = event_log_ccel_or_empty(Err(anyhow::anyhow!("CCEL unavailable")));
-        assert!(event_log.is_empty());
-    }
-}

dstack/guest-agent/src/rpc_service.rs

@@ -885,7 +885,6 @@ pNs85uhOZE8z2jr8Pg==
                     report_data: report_data.to_vec(),
                     vm_config: vm_config.to_string(),
                     attestation: Vec::new(),
-                    event_log_ccel: Vec::new(),
                 })
             }
 

sdk/go/dstack/client.go

@@ -86,12 +86,11 @@ func (r *GetKeyResponse) DecodeSignatureChain() ([][]byte, error) {
 
 // Represents the response from a quote request.
 type GetQuoteResponse struct {
-	Quote        string `json:"quote"`
-	EventLog     string `json:"event_log"`
-	ReportData   string `json:"report_data"`
-	VmConfig     string `json:"vm_config"`
-	Attestation  string `json:"attestation"`
-	EventLogCCEL string `json:"event_log_ccel"`
+	Quote       string `json:"quote"`
+	EventLog    string `json:"event_log"`
+	ReportData  string `json:"report_data"`
+	VmConfig    string `json:"vm_config"`
+	Attestation string `json:"attestation"`
 }
 
 // DecodeQuote returns the quote bytes
@@ -115,10 +114,6 @@ func (r *GetQuoteResponse) DecodeEventLog() ([]EventLog, error) {
 	return events, err
 }
 
-// DecodeEventLogCCEL returns the TCG binary CCEL event log bytes.
-func (r *GetQuoteResponse) DecodeEventLogCCEL() ([]byte, error) {
-	return hex.DecodeString(r.EventLogCCEL)
-}
 
 // Represents the response from an attestation request.
 type AttestResponse struct {

sdk/js/src/index.ts

@@ -101,7 +101,6 @@ export interface GetQuoteResponse {
   report_data?: Hex
   vm_config?: string
   attestation?: Hex
-  event_log_ccel?: Hex
 
   replayRtmrs: () => string[]
 }