refactor(verifier): make TCB policy sources exhaustive - #950
Merged
Conversation
Base automatically changed from
codex/refactor-verifier-image-strategies
to
master
August 5, 2026 04:57
TCB policy source handling used a catch-all match arm, so a newly added DstackVerifiedReport variant would silently inherit another platform's trust semantics instead of requiring an explicit decision. Match all report variants exhaustively in policy_tcb_fields so adding a platform fails the build here, and document why each platform reads the source it does: GCP has a bundled TPM report with no TCB surface, SNP derives its status from TCB version comparison rather than a field, AWS NitroTPM is normalized to "UpToDate" to match the KMS bootAuth payload, and Nitro Enclave stays empty so an "UpToDate" gate fails closed. Cover the mapping with a decision table over constructed attestations. The table exercises policy_tcb_fields itself rather than a helper, since the report-to-policy mapping is where a wrong source can silently downgrade the auth gate.
kvinwang
force-pushed
the
codex/refactor-verifier-tcb-policy
branch
from
August 5, 2026 13:11
07bb2bb to
627b4a0
Compare
kvinwang
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
TCB policy source handling used a catch-all
_ =>match arm, so a newly addedDstackVerifiedReportvariant would silently inherit another platform's trustsemantics instead of requiring an explicit decision.
Root cause and fix
Match all report variants exhaustively in
policy_tcb_fields, so adding aplatform fails the build at this call site rather than defaulting into a
neighbouring platform's TCB surface.
Each arm now documents why it reads the source it does:
report.status/report.advisory_idstdx_report.*tcb_info.tcb_status()"UpToDate""UpToDate"auth gate passes."UpToDate"requirement fails closed.This is a behavior-preserving refactor. The previous
_ =>arm resolved throughDstackVerifiedReport::tdx_report(), which returnsSomefor TDX and GCP TDXand
Nonefor Nitro Enclave;unwrap_or_default()then produced("", [])—exactly what the explicit
DstackNitroEnclavearm now returns.Tests
Adds a decision table over constructed
VerifiedAttestationvalues thatexercises
policy_tcb_fieldsitself rather than an internal helper, because thereport-to-policy mapping is where a wrong source can silently downgrade the auth
gate. SEV-SNP is covered in both the matching (
UpToDate) and mismatched(
OutOfDate) TCB-version shapes, since its status is computed rather than read.Nitro Enclave is asserted separately for the opposite property: it must not
report
"UpToDate", so an auth gate fails closed.Each arm of the mapping was mutation-checked (GCP flattened to empty, Nitro
Enclave forged to
"UpToDate", SNP hardcoded to"UpToDate", NitroTPMemptied, TDX advisories dropped); all five mutations are caught by the table.
Scope
One logical
verifierfinding, one file:dstack/verifier/src/verification.rs.Verification
cargo fmt --all -- --check: passed.cargo clippy -p dstack-verifier --all-features -- -D warnings: passed.cargo test -p dstack-verifier --all-features: 24 passed, 0 failed.cargo check --workspace --all-features: passed.policy_tcb_fieldskeeps itssignature, so the KMS caller in
kms/src/main_service/upgrade_authority.rsisunaffected.