From ca86236e9cc36a4869d33348e02a100d96832966 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Wed, 11 Nov 2026 07:02:07 -0800 Subject: [PATCH] fix(dstack-util): verify the KMS in get-keys as system setup does Since the KMS RPC certificate must carry a verified attestation, get-keys verifies it, but with a production verifier that ignores the guest's sys-config. On a host that configures its own PCCS, or in a guest whose TEE simulator published trust anchors, get-keys then rejected the KMS that the guest's own setup had just accepted. Build the verifier from the sys-config collateral URLs and the published trust anchors, falling back to the production defaults outside a CVM. Signed-off-by: Kevin Wang --- dstack/dstack-util/src/main.rs | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/dstack/dstack-util/src/main.rs b/dstack/dstack-util/src/main.rs index e6c49f271..cd375fb21 100644 --- a/dstack/dstack-util/src/main.rs +++ b/dstack/dstack-util/src/main.rs @@ -638,6 +638,23 @@ fn cmd_attest_strip(args: AttestStripArgs) -> Result<()> { Ok(()) } +/// Verify the KMS as system setup does: with the collateral service from the +/// guest's sys-config and any trust anchors published in the guest. +fn get_keys_verifier() -> Result> { + use dstack_types::shared_filenames::{host_shared_dir, SYS_CONFIG}; + let path = host_shared_dir().join(SYS_CONFIG); + let collateral_urls = match fs::read_to_string(&path) { + Ok(text) => serde_json::from_str::(&text) + .context("failed to parse sys-config")? + .collateral_urls(), + Err(err) if err.kind() == std::io::ErrorKind::NotFound => Default::default(), + Err(err) => return Err(err).context("failed to read sys-config"), + }; + Ok(std::sync::Arc::new(dstack_attest::default_verifier( + &collateral_urls, + )?)) +} + async fn cmd_get_keys(args: GetKeysArgs) -> Result<()> { let kms_url = normalize_prpc_url(&args.kms_url); @@ -661,7 +678,7 @@ async fn cmd_get_keys(args: GetKeysArgs) -> Result<()> { root_epoch: None, }, cert_pair, - std::sync::Arc::new(ra_tls::attestation::AttestationVerifier::new_prod(None)?), + get_keys_verifier()?, root_ca_pem.clone(), ) .await