fix(simulator): replay measured NitroTPM boot PCRs

[kvinwang]

Summary

• replay measured NitroTPM boot PCR values in the simulator
• carry the measured replay configuration through the VMM simulator path
• generate the AWS PCR replay artifact during image assembly

Context

This supersedes #960, which was accidentally merged into its stacked base branch instead of master. This replacement is based directly on the latest master.

Verification

• cargo fmt --manifest-path dstack/Cargo.toml --all --check
• cargo check --manifest-path dstack/Cargo.toml -p dstack-types -p dstack-vmm -p dstack-tee-simulator
• python3 -m py_compile os/image/aws-pcr-replay.py
• bash -n os/image/assemble.sh
• git diff --check origin/master...HEAD

[Copilot]

Pull request overview

This PR makes the TEE simulator reproduce the measured AWS NitroTPM boot PCR state (PCR4/7/12) by generating a replay artifact at image-assembly time, carrying it through the VMM simulator configuration path, and replaying the events into swtpm before producing simulated NSM evidence.

Changes:

• Generate and package measurement.aws.replay.json from nitro-tpm-pcr-compute debug trace during os/image assembly, and include it in checksums and image archives.
• Add typed representation of the replay document (AwsPcrReplay) and transport it through VMM into TeeSimulatorConfig.
• Replay the recorded SHA-384 PCR extensions into the simulator TPM backend and validate the resulting PCR values match the expected final PCRs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
os/image/README.md	Documents the new AWS replay artifact and its role in simulator PCR reproduction.
os/image/aws-pcr-replay.py	New script to convert AWS tool trace into a replay document and verify final PCRs.
os/image/assemble.sh	Captures AWS tool trace, generates measurement.aws.replay.json, and packages it into image artifacts/checksums.
dstack/vmm/src/app/qemu.rs	Updates test struct initialization to include the new AWS replay field.
dstack/vmm/src/app/image.rs	Loads optional measurement.aws.replay.json alongside AWS measurement material.
dstack/vmm/src/app.rs	Plumbs replay config through vm_config/simulator config, and cross-checks replay PCRs match measurement.aws.cbor.
dstack/tee-simulator/src/tpm.rs	Replays AWS boot PCR events into swtpm and verifies PCR4/7/12 against expected values.
dstack/dstack-types/src/lib.rs	Adds AwsPcrReplay types and includes them in TeeSimulatorConfig.

Suppressed comments (1)

dstack/tee-simulator/src/tpm.rs:413

• This anyhow::ensure! message uses {index} without providing an index formatting argument, which will not compile. Pass index as a formatting argument (or switch to positional formatting).

            actual == *expected,
            "replayed PCR{index} mismatch: expected={}, actual={}",
            hex::encode(expected),
            hex::encode(actual)
        );

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.