rust-sdk: Remove some methods from TappdClient

Author: kvinwang

Cargo.lock

@@ -13,7 +13,7 @@ trap "kill $SIMULATOR_PID 2>/dev/null || true" EXIT
 popd
 
 pushd rust/
-cargo test
+cargo test -- --show-output
 popd
 
 pushd go/

sdk/run-tests.sh

@@ -9,15 +9,15 @@ authors = ["Encifher <encifher@rizelabs.io>"]
 [dependencies]
 alloy = { workspace = true, features = ["signers", "signer-local"] }
 anyhow.workspace = true
-base64.workspace = true
 bon.workspace = true
-hex.workspace = true 
-http.workspace = true 
+hex.workspace = true
+http.workspace = true
 http-client-unix-domain-socket = "0.1.1"
 reqwest = { workspace = true, features = ["json"] }
-serde.workspace = true 
-serde_json.workspace = true 
-sha2.workspace = true 
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+x509-parser.workspace = true
 
 [dev-dependencies]
 dcap-qvl.workspace = true

sdk/rust/Cargo.toml

@@ -45,7 +45,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 ### TappdClient (Legacy API)
 
 ```rust
-use dstack_sdk::tappd_client::{TappdClient, QuoteHashAlgorithm};
+use dstack_sdk::tappd_client::TappdClient;
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -61,22 +61,18 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("Key: {}", key_resp.key);
     println!("Certificate Chain: {:?}", key_resp.certificate_chain);
 
-    // Generate TDX quote with default SHA512
-    let quote_resp = client.tdx_quote(b"test-data".to_vec()).await?;
+    // Decode the key to bytes (extracts raw ECDSA P-256 private key - 32 bytes)
+    let key_bytes = key_resp.to_bytes()?;
+    println!("ECDSA P-256 private key bytes (32 bytes): {:?}", key_bytes.len());
+
+    // Generate quote (exactly 64 bytes of report data required)
+    let mut report_data = b"test-data".to_vec();
+    report_data.resize(64, 0); // Pad to 64 bytes
+    let quote_resp = client.get_quote(report_data).await?;
     println!("Quote: {}", quote_resp.quote);
     let rtmrs = quote_resp.replay_rtmrs()?;
     println!("Replayed RTMRs: {:?}", rtmrs);
 
-    // Generate TDX quote with specific hash algorithm
-    let quote_resp = client.tdx_quote_with_hash_algorithm(
-        b"test-data".to_vec(),
-        QuoteHashAlgorithm::Sha256
-    ).await?;
-
-    // Generate raw quote (exactly 64 bytes)
-    let raw_data = vec![0u8; 64];
-    let raw_quote = client.raw_quote(raw_data).await?;
-
     Ok(())
 }
 ```
@@ -131,22 +127,17 @@ Fetches metadata and measurements about the CVM instance.
 
 #### `derive_key(path: &str) -> DeriveKeyResponse`
 Derives a key for a specified path.
-- `key`: Private key (PEM or hex format)
+- `key`: ECDSA P-256 private key in PEM format
 - `certificate_chain`: Vec of X.509 certificate chain entries
+- `to_bytes()`: Extracts and returns the raw ECDSA P-256 private key bytes (32 bytes)
 
 #### `derive_key_with_subject(path: &str, subject: &str) -> DeriveKeyResponse`
 Derives a key with a custom certificate subject.
 
 #### `derive_key_with_subject_and_alt_names(path: &str, subject: Option<&str>, alt_names: Option<Vec<String>>) -> DeriveKeyResponse`
 Derives a key with full certificate customization.
 
-#### `tdx_quote(report_data: Vec<u8>) -> TdxQuoteResponse`
-Generates a TDX quote using SHA512 hash algorithm.
-
-#### `tdx_quote_with_hash_algorithm(report_data: Vec<u8>, algorithm: QuoteHashAlgorithm) -> TdxQuoteResponse`
-Generates a TDX quote with a specific hash algorithm (SHA256, SHA384, SHA512, etc.).
-
-#### `raw_quote(report_data: Vec<u8>) -> TdxQuoteResponse`
+#### `get_quote(report_data: Vec<u8>) -> TdxQuoteResponse`
 Generates a TDX quote with exactly 64 bytes of raw report data.
 
 ### Structures

sdk/rust/README.md

@@ -1,4 +1,4 @@
-use dstack_sdk::tappd_client::{QuoteHashAlgorithm, TappdClient};
+use dstack_sdk::tappd_client::TappdClient;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -29,34 +29,21 @@ async fn main() -> anyhow::Result<()> {
         }
     }
 
-    // 2. Get a TDX quote
-    let report_data = b"Hello, world!".to_vec();
-    match client.tdx_quote(report_data).await {
+    // 2. Get a quote with 64 bytes of report data
+    let mut report_data = b"Hello, world!".to_vec();
+    // Pad to exactly 64 bytes for get_quote
+    report_data.resize(64, 0);
+    match client.get_quote(report_data).await {
         Ok(response) => {
-            println!("TDX quote generated successfully!");
+            println!("Quote generated successfully!");
             println!("Quote length: {}", response.quote.len());
         }
         Err(e) => {
-            println!("Failed to get TDX quote: {}", e);
+            println!("Failed to get quote: {}", e);
         }
     }
 
-    // 3. Get a TDX quote with specific hash algorithm
-    let report_data = b"Hello, world!".to_vec();
-    match client
-        .tdx_quote_with_hash_algorithm(report_data, QuoteHashAlgorithm::Sha256)
-        .await
-    {
-        Ok(response) => {
-            println!("TDX quote with SHA256 generated successfully!");
-            println!("Quote length: {}", response.quote.len());
-        }
-        Err(e) => {
-            println!("Failed to get TDX quote with SHA256: {}", e);
-        }
-    }
-
-    // 4. Get instance info
+    // 3. Get instance info
     match client.info().await {
         Ok(info) => {
             println!("Instance info retrieved successfully!");

sdk/rust/examples/tappd_client_usage.rs

@@ -1,4 +1,4 @@
-use anyhow::Result;
+use anyhow::{bail, Context as _, Result};
 use hex::{encode as hex_encode, FromHexError};
 use http_client_unix_domain_socket::{ClientUnix, Method};
 use reqwest::Client;
@@ -86,32 +86,52 @@ pub struct DeriveKeyResponse {
 }
 
 impl DeriveKeyResponse {
-    /// Decodes the key from PEM/base64 format to bytes, optionally truncating to max_length
-    pub fn to_bytes(&self, max_length: Option<usize>) -> Result<Vec<u8>, anyhow::Error> {
-        let mut content = self.key.clone();
-
-        // Remove PEM headers if present
-        content = content.replace("-----BEGIN PRIVATE KEY-----", "");
-        content = content.replace("-----END PRIVATE KEY-----", "");
-        content = content.replace('\n', "");
-
-        let binary = if content.chars().all(|c| c.is_ascii_hexdigit()) {
-            // Handle hex-encoded content
-            hex::decode(content)?
-        } else {
-            // Handle base64-encoded content
-            use base64::Engine;
-            base64::engine::general_purpose::STANDARD
-                .decode(content)
-                .map_err(|e| anyhow::anyhow!("Failed to decode base64: {}", e))?
-        };
+    /// Decodes the key from PEM format and extracts the raw ECDSA P-256 private key bytes
+    pub fn to_bytes(&self) -> Result<Vec<u8>, anyhow::Error> {
+        use x509_parser::der_parser::der::parse_der;
+        use x509_parser::pem::parse_x509_pem;
+
+        let key_content = self.key.trim();
+
+        let (_, pem) = parse_x509_pem(key_content.as_bytes()).context("Failed to parse PEM")?;
+        // Parse PKCS#8 PrivateKeyInfo structure
+        // PKCS#8 format: SEQUENCE { version, algorithm, privateKey }
+        let (_, der_seq) = parse_der(&pem.contents).context("Failed to parse DER")?;
+        let sequence = der_seq.as_sequence().context("Expected SEQUENCE")?;
+        if sequence.len() < 3 {
+            bail!("Invalid PKCS#8 structure: expected at least 3 elements");
+        }
 
-        if let Some(max_len) = max_length {
-            if binary.len() > max_len {
-                return Ok(binary[..max_len].to_vec());
-            }
+        // The privateKey is the 3rd element (index 2) and should be an OCTET STRING
+        let private_key_data = sequence[2]
+            .content
+            .as_slice()
+            .context("Could not extract privateKey data")?;
+
+        // For ECDSA keys, the private key is wrapped in another DER structure
+        // Parse the inner ECDSA private key structure
+        let (_, inner_der) = parse_der(private_key_data).context("Failed to parse inner DER")?;
+
+        let inner_sequence = inner_der.as_sequence().context("Expected inner SEQUENCE")?;
+
+        if inner_sequence.len() < 2 {
+            return Err(anyhow::anyhow!("Invalid ECDSA private key structure"));
+        }
+
+        // The actual private key value is the 2nd element (index 1) as OCTET STRING
+        let key_bytes = inner_sequence[1]
+            .content
+            .as_slice()
+            .context("Could not extract key bytes")?;
+
+        if key_bytes.len() != 32 {
+            bail!(
+                "Expected 32-byte ECDSA P-256 private key, got {} bytes",
+                key_bytes.len()
+            );
         }
-        Ok(binary)
+
+        Ok(key_bytes.to_vec())
     }
 }
 
@@ -298,68 +318,10 @@ impl TappdClient {
         Ok(response)
     }
 
-    /// Sends a TDX quote request using SHA512 as the default hash algorithm
-    pub async fn tdx_quote(&self, report_data: Vec<u8>) -> Result<TdxQuoteResponse> {
-        self.tdx_quote_with_hash_algorithm(report_data, QuoteHashAlgorithm::Sha512)
-            .await
-    }
-
-    /// Sends a TDX quote request with a specific hash algorithm
-    pub async fn tdx_quote_with_hash_algorithm(
-        &self,
-        mut report_data: Vec<u8>,
-        hash_algorithm: QuoteHashAlgorithm,
-    ) -> Result<TdxQuoteResponse> {
-        // For RAW algorithm, ensure report_data is exactly 64 bytes
-        if matches!(hash_algorithm, QuoteHashAlgorithm::Raw) {
-            if report_data.len() > 64 {
-                anyhow::bail!("Report data is too large, it should be at most 64 bytes when hash_algorithm is RAW");
-            }
-            if report_data.len() < 64 {
-                // Left-pad with zeros
-                let mut padded = vec![0u8; 64 - report_data.len()];
-                padded.extend_from_slice(&report_data);
-                report_data = padded;
-            }
-        }
-
-        let payload = json!({
-            "report_data": hex_encode(report_data),
-            "hash_algorithm": hash_algorithm.as_str(),
-        });
-
-        let response = self
-            .send_rpc_request("/prpc/Tappd.TdxQuote", &payload)
-            .await?;
-        Ok(response)
-    }
-
-    /// Sends a TDX quote request with custom prefix and hash algorithm
-    pub async fn tdx_quote_with_prefix(
-        &self,
-        report_data: Vec<u8>,
-        hash_algorithm: QuoteHashAlgorithm,
-        prefix: Option<&str>,
-    ) -> Result<TdxQuoteResponse> {
-        let mut payload = json!({
-            "report_data": hex_encode(report_data),
-            "hash_algorithm": hash_algorithm.as_str(),
-        });
-
-        if let Some(prefix) = prefix {
-            payload["prefix"] = json!(prefix);
-        }
-
-        let response = self
-            .send_rpc_request("/prpc/Tappd.TdxQuote", &payload)
-            .await?;
-        Ok(response)
-    }
-
     /// Sends a raw quote request with 64 bytes of report data
-    pub async fn raw_quote(&self, report_data: Vec<u8>) -> Result<TdxQuoteResponse> {
+    pub async fn get_quote(&self, report_data: Vec<u8>) -> Result<TdxQuoteResponse> {
         if report_data.len() != 64 {
-            anyhow::bail!("Report data must be exactly 64 bytes for raw quote");
+            bail!("Report data must be exactly 64 bytes for raw quote");
         }
 
         let payload = json!({