From 845af547a0faeeedcda9e729fb945ea9436f8ee0 Mon Sep 17 00:00:00 2001
From: Kevin Wang <wy721@qq.com>
Date: Thu, 30 Jul 2026 08:11:07 +0000
Subject: [PATCH] fix(guest): isolate local key providers from KMS inventory

---
 dstack/dstack-util/src/system_setup.rs | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/dstack/dstack-util/src/system_setup.rs b/dstack/dstack-util/src/system_setup.rs
index c593976c9..31fa8ef89 100644
--- a/dstack/dstack-util/src/system_setup.rs
+++ b/dstack/dstack-util/src/system_setup.rs
@@ -2040,6 +2040,13 @@ struct Stage1<'a> {
     keys: AppKeys,
 }
 
+fn validate_key_provider_inputs(kind: KeyProviderKind, kms_urls: &[String]) -> Result<()> {
+    if kind.is_kms() && kms_urls.is_empty() {
+        bail!("No KMS URLs are set");
+    }
+    Ok(())
+}
+
 impl<'a> Stage0<'a> {
     fn host_api(&self) -> HostApi {
         HostApi::new(
@@ -2264,6 +2271,7 @@ impl<'a> Stage0<'a> {
 
     async fn request_app_keys(&self) -> Result<AppKeys> {
         let key_provider = self.shared.app_compose.key_provider();
+        validate_key_provider_inputs(key_provider, &self.shared.sys_config.kms_urls)?;
         match key_provider {
             KeyProviderKind::Kms => self.request_app_keys_from_kms().await,
             KeyProviderKind::Local => self.get_keys_from_local_key_provider().await,
@@ -3572,3 +3580,19 @@ fn test_unquote_os_release_value_handles_quoting_styles() {
     assert_eq!(unquote_os_release_value("\""), "\"");
     assert_eq!(unquote_os_release_value("\"a"), "\"a");
 }
+
+#[cfg(test)]
+mod kms_provider_inventory_tests {
+    use super::validate_key_provider_inputs;
+    use dstack_types::KeyProviderKind;
+
+    #[test]
+    fn local_key_providers_do_not_require_kms_inventory() {
+        let no_urls = Vec::new();
+        assert!(validate_key_provider_inputs(KeyProviderKind::Local, &no_urls).is_ok());
+        assert!(validate_key_provider_inputs(KeyProviderKind::Tpm, &no_urls).is_ok());
+        assert!(validate_key_provider_inputs(KeyProviderKind::None, &no_urls).is_ok());
+        let error = validate_key_provider_inputs(KeyProviderKind::Kms, &no_urls).unwrap_err();
+        assert!(error.to_string().contains("No KMS URLs are set"));
+    }
+}