attestation: move schema crate back into workspace

Author: kvinwang

Cargo.toml

@@ -20,6 +20,7 @@ members = [
     "ra-tls",
     "tdx-attest",
     "dstack-attest",
+    "dstack-attestation-types",
     "dstack-util",
     "iohash",
     "guest-agent",
@@ -72,6 +73,7 @@ supervisor = { path = "supervisor" }
 supervisor-client = { path = "supervisor/client" }
 tdx-attest = { path = "tdx-attest" }
 dstack-attest = { path = "dstack-attest" }
+dstack-attestation-types = { path = "dstack-attestation-types" }
 certbot = { path = "certbot" }
 rocket-vsock-listener = { path = "rocket-vsock-listener" }
 host-api = { path = "host-api", default-features = false }

dstack-attest/Cargo.toml

@@ -14,7 +14,7 @@ anyhow.workspace = true
 cc-eventlog.workspace = true
 ciborium.workspace = true
 dcap-qvl.workspace = true
-dstack-attestation-types = { path = "../../../src/attestation-types" }
+dstack-attestation-types.workspace = true
 dstack-types.workspace = true
 ez-hash.workspace = true
 fs-err.workspace = true

dstack-attestation-types/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "dstack-attestation-types"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+ciborium.workspace = true
+cc-eventlog.workspace = true
+serde.workspace = true

dstack-attestation-types/src/lib.rs

@@ -0,0 +1,123 @@
+use anyhow::{bail, Context, Result};
+use cc_eventlog::{RuntimeEvent, TdxEvent};
+use serde::{Deserialize, Serialize};
+
+pub const ATTESTATION_VERSION: u64 = 1;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind")]
+pub enum PlatformEvidence {
+    #[serde(rename = "tdx")]
+    Tdx {
+        quote: Vec<u8>,
+        event_log: Vec<TdxEvent>,
+    },
+    #[serde(rename = "gcp-tdx")]
+    GcpTdx,
+    #[serde(rename = "nitro-enclave")]
+    NitroEnclave,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind")]
+pub enum StackEvidence {
+    #[serde(rename = "dstack")]
+    Dstack {
+        report_data: Vec<u8>,
+        runtime_events: Vec<RuntimeEvent>,
+        config: String,
+    },
+    #[serde(rename = "dstack-k8s")]
+    DstackK8s {
+        report_data: Vec<u8>,
+        runtime_events: Vec<RuntimeEvent>,
+        config: String,
+        report_data_payload: String,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Attestation {
+    pub version: u64,
+    pub platform: PlatformEvidence,
+    pub stack: StackEvidence,
+}
+
+impl Attestation {
+    pub fn new(platform: PlatformEvidence, stack: StackEvidence) -> Self {
+        Self {
+            version: ATTESTATION_VERSION,
+            platform,
+            stack,
+        }
+    }
+
+    pub fn to_cbor(&self) -> Result<Vec<u8>> {
+        let mut normalized = self.clone();
+        normalized.version = ATTESTATION_VERSION;
+        let mut bytes = Vec::new();
+        ciborium::into_writer(&normalized, &mut bytes)
+            .context("Failed to encode attestation as CBOR")?;
+        Ok(bytes)
+    }
+
+    pub fn from_cbor(bytes: &[u8]) -> Result<Self> {
+        let value: Self =
+            ciborium::from_reader(bytes).context("Failed to decode attestation from CBOR")?;
+        if value.version != ATTESTATION_VERSION {
+            bail!(
+                "Unsupported attestation version: expected {}, got {}",
+                ATTESTATION_VERSION,
+                value.version
+            );
+        }
+        Ok(value)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cbor_roundtrip_preserves_attestation() {
+        let attestation = Attestation::new(
+            PlatformEvidence::Tdx {
+                quote: vec![1u8, 2, 3],
+                event_log: Vec::new(),
+            },
+            StackEvidence::DstackK8s {
+                report_data: vec![7u8; 64],
+                runtime_events: Vec::new(),
+                config: "{}".into(),
+                report_data_payload: "{\"hello\":\"world\"}".into(),
+            },
+        );
+
+        let encoded = attestation.to_cbor().expect("encode cbor");
+        assert!(matches!(encoded.first(), Some(0xa0..=0xbf)));
+        let decoded = Attestation::from_cbor(&encoded).expect("decode cbor");
+        assert_eq!(decoded.version, ATTESTATION_VERSION);
+        match decoded.platform {
+            PlatformEvidence::Tdx { quote, event_log } => {
+                assert_eq!(quote, vec![1u8, 2, 3]);
+                assert!(event_log.is_empty());
+            }
+            _ => panic!("expected tdx platform evidence"),
+        }
+        match decoded.stack {
+            StackEvidence::DstackK8s {
+                report_data,
+                runtime_events,
+                config,
+                report_data_payload,
+            } => {
+                assert_eq!(report_data, vec![7u8; 64]);
+                assert!(runtime_events.is_empty());
+                assert_eq!(config, "{}");
+                assert_eq!(report_data_payload, "{\"hello\":\"world\"}");
+            }
+            _ => panic!("expected dstack-k8s stack evidence"),
+        }
+    }
+}