Conversation
…upport - Update dcap-qvl dependency to policy branch (two-phase verification API) - Propagate QuoteVerificationResult through DstackVerifiedReport for flexible policy validation by business layer - Add baseline TCB policy with high-risk advisory rejection (INTEL-SA-01397, INTEL-SA-01367, INTEL-SA-01314, INTEL-SA-00837) - Add IAppTcbPolicy interface for on-chain TCB policy storage - Update DstackApp.sol and DstackKms.sol to store versioned TCB policy JSON - auth-eth reads policy from contracts and passes in BootResponse - KMS validates QuoteVerificationResult against on-chain RegoPolicySet - Fail-close on unknown policy version (version != 1 is rejected)
kvinwang
commented
Mar 12, 2026
- Remove tdx_report() method, callers use tdx_qvr()+supplemental() instead - Fix ppid access: use supplemental().platform.pck.ppid (no QVR clone) - Split TCB policy into separate API endpoints: - GET /policy/app/:appId and GET /policy/kms - auth_api.get_app_policy() and auth_api.get_kms_policy() in Rust - Remove tcbPolicy from BootResponse (separate concern) - Move policy validation before is_app_allowed check - Fix cargo fmt issues
dcap-qvl now provides QuoteVerificationResult::ppid() and report() accessors, avoiding the heavyweight supplemental() computation or clone+into_report_unchecked() just to read the PPID.
- Unit tests for validate_onchain_tcb_policy: empty policy, version checks, malformed JSON, invalid Rego, TcbPolicyDoc deserialization - Serde contract tests with shared JSON fixtures (kms/tests/fixtures/) validated by both Rust and TypeScript to catch field naming drift - TDX quote sample fixtures for building QuoteVerificationResult in tests - url_join utility test
Move Rust tests from rust.yml (now lint-only) into a new tests.yml workflow. Add auth-eth Jest tests as a parallel CI job.
Add end-to-end test suite that exercises the full KMS stack: Hardhat node → contract deployment → auth-eth server → KMS server. Tests cover auth-eth boot authorization (KMS/app allowed/denied), KMS unauthenticated APIs (GetMeta, GetAppEnvEncryptPubKey, GetTempCaCert), KMS authenticated APIs via RA-TLS (GetAppKey, SignCert), and TCB policy scenarios including Intel QAL rules for dynamic_platform, cached_keys, and TCB status validation.
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dcap-qvltopolicybranch with two-phase verification API (QuoteVerificationResult→ policy validation →VerifiedReport)QuoteVerificationResultup throughDstackVerifiedReportso KMS/verifier can apply app-specific TCB policiesIAppTcbPolicyinterface: bothDstackApp.solandDstackKms.solstore a versioned JSON TCB policy string on-chainauth-ethmiddleware reads policy from contract (with try-catch for backward compatibility with old contracts) and attaches it toBootResponse{"version": 1, "intel_qal": [...]}) and validates QVR againstRegoPolicySetChanges across layers
IAppTcbPolicy.sol,DstackApp.sol,DstackKms.solethereum.ts,server.ts,types.tsattestation.rs,host_api.rs,verification.rsmain_service.rs,upgrade_authority.rsDepends on
Test plan
cargo checkpasses (verified)hardhat compilepasses (verified)tsc --noEmitpasses (verified)IAppTcbPolicy