Repository navigation
fix: #1533 review round 2 (dstack-auth handover, KMS tests, docs) - #1560
Merged
Merged
Conversation
Signed-off-by: Kevin Wang <wy721@qq.com>
…rt issuance Report a backend rejection before the epoch fields are checked, require attestation in GetAppKey and the key handover before the KMS self check reaches the auth backend, and add audit lines for SignCert and GetTempCaCert. Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
…checked logic The root_epoch and app_epoch tamper cases failed while generating the RA-TLS certificate for the historical key request, so they passed even without the epoch checks. Rename the test to what it checks, and report both epochs when a sealed env is ahead of the current ones; the error printed the root epoch even when the app epoch was the one exceeding. Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Add the deployment order, the GET /app/:appId backend requirement, the per-epoch setter semantics from #1561, the removed DstackKms setters and legacy KMS info setters, two-step ownership for v0.5.9 proxies, dstack-auth pending-epoch handover, and the reorg caveat of non-finalized block tags. Signed-off-by: Kevin Wang <wy721@qq.com>
…support Follow #1561: DstackApp loses its epoch-less setters and IAppAuthBasicManagement, reports IAppEpochManagement, and app policies predating app epochs keep working at app epoch 0. Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
force-pushed
the
fix/pr1533-round2
branch
from
November 11, 2026 12:41
dd0e3c4 to
e8e8ff2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the second-round review of #1533. This PR covers the non-contract fixes; contract changes, the CI changes and the sealed-env integration cases are handled in other PRs.
dstack-auth pending root epoch
currentRootEpoch. KMS handover always authorizes at the highest epoch the keyring holds, so a pending epoch could not be handed to other nodes before activation (kms_import_keys at the pending epoch 1: requested root epoch is not active). The contract backend already allows this.kms_export_keys/kms_import_keysmay request up to the latest registered epoch. Key-issuing operations (kms_serve,app_get_key,app_get_cert) stay capped at current. Epochs beyond latest are always rejected. Adds test T1 from the review.KMS
authorized_epochreports a backend rejection before it checks the chain hash, so the rejection reason is no longer hidden.GetAppKeyand key handover runensure_attestedbefore the KMS self check, so anonymous requests no longer reach the auth backend.SignCertandGetTempCaCertnow write audit lines in the existingdstack_kms::auditstyle, and their releases are counted in metrics.GetAppKeyafter rotation: requested epochs are used and not mixed up with the current ones; a backend rejection fails the RPC;requested app epoch is not active; anonymous callers are refused without any backend call.SignCertwith a mock Nitro attestation: issued under the current root and app epoch; fails when the backend rejects.Guest
SDKs
Docs
ETH_BLOCK_TAG=latest/safe: a reorg can roll back both activations and revocations. Documents theETH_FINALITY_CONFIRMATIONStradeoff and limits the "survives reorgs" claim tofinalized. Updates the auth-eth README anddocs/deployment.md.deployment.mdcurl line matches docs(kms): require admin TLS for onboarding handover #1558.setKmsInfo; on-chain compose and Helios in the rc testing runbook; dstack-auth pending-epoch handover inapp-key-epochs.mdanddstack-auth-operations.md.console.logfrom auth-ethGET /.Tests (local)