Repository navigation
Conversation
…ing it One OS image hash can boot on several TEE platforms (a release ships both TDX and SEV-SNP firmware), and app keys derive from the app ID alone, so an app approved on bare-metal TDX could be served on any platform the KMS enables. The KMS already sends teeVariant; auth-eth dropped it. - Rename the unreleased IAppEpochAuth to IAppAuthV2. AuthorizationRequest carries BootInfoV2: the legacy AppInfo plus a uint8 teeVariant, numbered as dstack's TeeVariant enum (TeeVariant.sol). DstackKms still forwards AppInfo to policies without IAppAuthV2. - DstackApp and DstackKms get allowedTeeVariants(): bit n allows platform n, at every epoch, since which platforms may hold keys is a trust decision rather than a property of a key generation. It is stored as its complement, so new and upgraded proxies read TeeVariant.ANY (all bits) and 0 means what it says. A restricted mask refuses the legacy isAppAllowed/isKmsAllowed, whose callers report no platform; the 0.6.x KMS also serves SEV-SNP and Nitro, so they cannot be taken as TDX. - auth-eth requires teeVariant on /authorizeKms and /authorizeApp, rejects unknown platforms and passes the number on. - Manage.s.sol SetKmsAllowedTeeVariants/SetAllowedTeeVariants take TEE_VARIANTS=any or a list of names; Query.s.sol prints the masks. BREAKING CHANGE: unreleased ABI only: authorizeKms/authorizeApp, and the IAppAuthV2 and IAppEpochManagement (now 0xb5cb3ab1) interface IDs. Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
force-pushed
the
feat/iappauth-v2
branch
from
November 12, 2026 10:53
796efb5 to
e5a597f
Compare
kvinwang
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One OS image hash can boot on several TEE platforms, and app keys derive from the app ID alone, so a policy that cannot see the platform cannot keep an app on, say, bare-metal TDX. The KMS already sends
teeVariant; auth-eth dropped it before the contract call.IAppEpochAuthtoIAppAuthV2;AuthorizationRequestcarriesBootInfoV2(legacyAppInfo+uint8 teeVariant, numbered as dstack'sTeeVariantenum, seeTeeVariant.sol). LegacyIAppAuthpolicies still getAppInfo.DstackAppandDstackKms:allowedTeeVariants()/setAllowedTeeVariants(mask), one bitmask covering every epoch (bitnallows platformn). Stored as its complement, so new and upgraded proxies readTeeVariant.ANYand0literally allows nothing. A restricted mask refuses the legacyisAppAllowed/isKmsAllowed, whose callers report no platform.teeVarianton/authorizeKmsand/authorizeAppand rejects unknown platforms.Manage.s.sol:SetKmsAllowedTeeVariants/SetAllowedTeeVariants(TEE_VARIANTS=anyor names);Query.s.solprints the masks.Breaking only for unreleased ABI:
authorizeKms/authorizeApp,IAppAuthV2,IAppEpochManagement(now0xb5cb3ab1).Tests:
forge clean && forge test --ffi(113 passed),vitest run(58 passed).