feat: on-chain TCB policy with dcap-qvl two-phase verification by kvinwang · Pull Request #538 · Dstack-TEE/dstack

kvinwang · 2026-03-12T09:18:29Z

Summary

Upgrade dcap-qvl to policy branch with two-phase verification API (QuoteVerificationResult → policy validation → VerifiedReport)
Propagate QuoteVerificationResult up through DstackVerifiedReport so KMS/verifier can apply app-specific TCB policies
Add IAppTcbPolicy interface: both DstackApp.sol and DstackKms.sol store a versioned JSON TCB policy string on-chain
auth-eth middleware reads policy from contract (with try-catch for backward compatibility with old contracts) and attaches it to BootResponse
KMS parses the policy JSON ({"version": 1, "intel_qal": [...]}) and validates QVR against RegoPolicySet
Fail-close: unknown policy versions are rejected
Baseline policy rejects high-risk advisories: INTEL-SA-01397, INTEL-SA-01367, INTEL-SA-01314, INTEL-SA-00837

Changes across layers

Layer	Files	What
Solidity	`IAppTcbPolicy.sol`, `DstackApp.sol`, `DstackKms.sol`	On-chain policy storage (ERC-165 detectable)
TypeScript	`ethereum.ts`, `server.ts`, `types.ts`	Read policy from contract, pass in response
Rust (attest)	`attestation.rs`, `host_api.rs`, `verification.rs`	QVR propagation, baseline policy, advisory blacklist
Rust (kms)	`main_service.rs`, `upgrade_authority.rs`	Parse on-chain policy, RegoPolicySet validation

Depends on

feat: two-phase verify with Policy trait Phala-Network/dcap-qvl#112 (will switch to crates.io version once released)

Test plan

cargo check passes (verified)
hardhat compile passes (verified)
tsc --noEmit passes (verified)
Integration test with contract deploying TCB policy and KMS validating against it
Backward compatibility: KMS works with old contracts that don't implement IAppTcbPolicy
Fail-close: KMS rejects boot when policy version is unknown

…upport - Update dcap-qvl dependency to policy branch (two-phase verification API) - Propagate QuoteVerificationResult through DstackVerifiedReport for flexible policy validation by business layer - Add baseline TCB policy with high-risk advisory rejection (INTEL-SA-01397, INTEL-SA-01367, INTEL-SA-01314, INTEL-SA-00837) - Add IAppTcbPolicy interface for on-chain TCB policy storage - Update DstackApp.sol and DstackKms.sol to store versioned TCB policy JSON - auth-eth reads policy from contracts and passes in BootResponse - KMS validates QuoteVerificationResult against on-chain RegoPolicySet - Fail-close on unknown policy version (version != 1 is rejected)

kvinwang · 2026-03-12T09:19:20Z

dstack-attest/src/attestation.rs

+    /// Get a [`TdxVerifiedReport`] without additional policy checks.
+    ///
+    /// Safe to call because the baseline policy was already validated during verification.
+    pub fn tdx_report(&self) -> Option<TdxVerifiedReport> {


Better remove this function.

kvinwang · 2026-03-12T09:20:04Z

dstack-attest/src/attestation.rs

        match self {
-            DstackVerifiedReport::DstackTdx(tdx_report) => tdx_report.ppid.to_vec(),
+            DstackVerifiedReport::DstackTdx(qvr) => {
+                qvr.clone().into_report_unchecked().ppid


More lightweight way?

kvinwang · 2026-03-12T10:13:42Z

kms/src/main_service.rs

        }
+        // Apply on-chain TCB policy (if set) to the TDX QuoteVerificationResult
+        if let Some(qvr) = att.report.tdx_qvr() {
+            validate_onchain_tcb_policy(qvr, &response.tcb_policy)


Better move this before the traditional is_app_allowed verification.
I'am not a fan of the is_app_allowed returning the policy. we should add a new api in auth_api.get_app_policy. As well for kms, auth_api.get_kms_policy.

- Remove tdx_report() method, callers use tdx_qvr()+supplemental() instead - Fix ppid access: use supplemental().platform.pck.ppid (no QVR clone) - Split TCB policy into separate API endpoints: - GET /policy/app/:appId and GET /policy/kms - auth_api.get_app_policy() and auth_api.get_kms_policy() in Rust - Remove tcbPolicy from BootResponse (separate concern) - Move policy validation before is_app_allowed check - Fix cargo fmt issues

dcap-qvl now provides QuoteVerificationResult::ppid() and report() accessors, avoiding the heavyweight supplemental() computation or clone+into_report_unchecked() just to read the PPID.

…port

- Unit tests for validate_onchain_tcb_policy: empty policy, version checks, malformed JSON, invalid Rego, TcbPolicyDoc deserialization - Serde contract tests with shared JSON fixtures (kms/tests/fixtures/) validated by both Rust and TypeScript to catch field naming drift - TDX quote sample fixtures for building QuoteVerificationResult in tests - url_join utility test

Move Rust tests from rust.yml (now lint-only) into a new tests.yml workflow. Add auth-eth Jest tests as a parallel CI job.

Add end-to-end test suite that exercises the full KMS stack: Hardhat node → contract deployment → auth-eth server → KMS server. Tests cover auth-eth boot authorization (KMS/app allowed/denied), KMS unauthenticated APIs (GetMeta, GetAppEnvEncryptPubKey, GetTempCaCert), KMS authenticated APIs via RA-TLS (GetAppKey, SignCert), and TCB policy scenarios including Intel QAL rules for dynamic_platform, cached_keys, and TCB status validation.

.github/workflows/tests.yml

+    name: Rust tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+
+      - name: Run tests
+        run: ./run-tests.sh
+
+  auth-eth-tests:


Generally, to fix this issue you add an explicit permissions block either at the top level of the workflow (applies to all jobs) or per job, granting only the scopes needed. In this workflow, the jobs only need to read repository contents for actions/checkout; they don’t appear to require any write permissions or access to other privileged scopes.

The best fix without changing functionality is to add a root-level permissions block specifying contents: read. This ensures GITHUB_TOKEN is restricted to read-only repository contents for all jobs in this workflow. No job-specific overrides or additional scopes are required based on the shown steps. Concretely, in .github/workflows/tests.yml, insert:

permissions: contents: read

between the name: Tests line and the on: section. No imports or additional definitions are needed, as this is purely a YAML configuration change.

.github/workflows/tests.yml

+    name: auth-eth tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+          cache-dependency-path: kms/auth-eth/package-lock.json
+
+      - name: Install dependencies
+        run: |
+          cd kms/auth-eth
+          npm ci
+
+      - name: Run tests
+        run: |
+          cd kms/auth-eth
+          npm test
+
+  kms-e2e-tests:


In general, the fix is to add an explicit permissions block that restricts the GITHUB_TOKEN to the least privileges needed. For these test jobs (rust-tests, auth-eth-tests, kms-e2e-tests), they only need to read the repository contents to run tests, so contents: read at the workflow (root) level is sufficient and will apply to all jobs.

The best fix without changing functionality is to add a single permissions block at the root of .github/workflows/tests.yml, alongside name: and on:, configuring contents: read. This documents the required access and ensures the workflow will not gain broader permissions even if repository defaults change. No other changes to steps, jobs, or actions are required.

Concretely:

Edit .github/workflows/tests.yml.

After the name: Tests line (line 5), insert:
permissions: contents: read

Leave all jobs (rust-tests, auth-eth-tests, kms-e2e-tests) unchanged so functionality stays identical, but with a read-only token.

.github/workflows/tests.yml

+    name: KMS E2E tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+          cache-dependency-path: kms/auth-eth/package-lock.json
+
+      - name: Run KMS E2E tests
+        run: bash kms/e2e/run-e2e.sh


To fix the problem, add an explicit permissions block that limits the GITHUB_TOKEN to the least privilege needed. Since the jobs only check out code and run tests, contents: read is sufficient. The cleanest way is to define permissions at the workflow root (top level, alongside name, on, and env), so it applies to all jobs that don’t override it. This preserves existing functionality while constraining the token.

Concretely, in .github/workflows/tests.yml, insert a permissions: section after the on: block (or before env:) with contents: read. No other changes, imports, or additional definitions are required. Individual jobs do not need their own permissions blocks unless they require different scopes.

kvinwang commented Mar 12, 2026

View reviewed changes

kvinwang added 2 commits March 12, 2026 10:20

refactor: use upstream ppid() accessor instead of supplemental()

879ba19

dcap-qvl now provides QuoteVerificationResult::ppid() and report() accessors, avoiding the heavyweight supplemental() computation or clone+into_report_unchecked() just to read the PPID.

kvinwang force-pushed the policy branch from 3e81c68 to 879ba19 Compare March 12, 2026 10:28

kvinwang added 6 commits March 12, 2026 10:58

fix: use explicit match arms instead of wildcard for DstackVerifiedRe…

945b330

…port

test: add auth-eth tests for IAppTcbPolicy and policy API endpoints

27c5d55

ci: extract tests into dedicated workflow and add auth-eth tests

df262e5

Move Rust tests from rust.yml (now lint-only) into a new tests.yml workflow. Add auth-eth Jest tests as a parallel CI job.

ci: add KMS E2E tests to CI workflow

c006e36

github-advanced-security bot found potential problems Mar 13, 2026

View reviewed changes

@@ -10,6 +10,9 @@
               pull_request:
                 branches: [ master, next, dev-* ]
+            permissions:
+              contents: read
             env:
               CARGO_TERM_COLOR: always

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: on-chain TCB policy with dcap-qvl two-phase verification#538

feat: on-chain TCB policy with dcap-qvl two-phase verification#538
kvinwang wants to merge 9 commits intomasterfrom
policy

kvinwang commented Mar 12, 2026

Uh oh!

kvinwang Mar 12, 2026

Uh oh!

kvinwang Mar 12, 2026

Uh oh!

kvinwang Mar 12, 2026

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

@@ -3,6 +3,8 @@
             # SPDX-License-Identifier: Apache-2.0
             name: Tests
+            permissions:
+              contents: read
             on:
               push:

Conversation

kvinwang commented Mar 12, 2026

Summary

Changes across layers

Depends on

Test plan

Uh oh!

kvinwang Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

kvinwang Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

kvinwang Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant