From 456eea6cb06ef8bbfc0ecb5362c5879933da6ab9 Mon Sep 17 00:00:00 2001
From: Kevin Wang <wy721@qq.com>
Date: Tue, 28 Jul 2026 16:11:54 +0000
Subject: [PATCH] fix(util): write TPM quotes atomically

---
 dstack/dstack-util/src/main.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dstack/dstack-util/src/main.rs b/dstack/dstack-util/src/main.rs
index 5a89f6269..f2bf700e8 100644
--- a/dstack/dstack-util/src/main.rs
+++ b/dstack/dstack-util/src/main.rs
@@ -1170,7 +1170,8 @@ fn cmd_tpm_quote(args: TpmQuoteArgs) -> Result<()> {
         serde_json::to_string_pretty(&tpm_quote).context("Failed to serialize TPM quote")?;
 
     if let Some(output_path) = args.output {
-        fs::write(&output_path, quote_json).context("Failed to write quote to file")?;
+        safe_write_with_mode(&output_path, &quote_json, 0o600)
+            .context("Failed to write quote to file")?;
         eprintln!("TPM quote written to: {:?}", output_path);
     } else {
         println!("{}", quote_json);