Repository navigation

feat: stage AMD SEV-SNP attestation support - #703

Merged

kvinwang merged 81 commits into

Dstack-TEE:masterfrom

clawdbot-glitch003:feat/amd-sev-snp-conversion

Jun 23, 2026

Merged

feat: stage AMD SEV-SNP attestation support#703
kvinwang merged 81 commits into
Dstack-TEE:masterfrom
clawdbot-glitch003:feat/amd-sev-snp-conversion

Commits on Jun 12, 2026
- feat: add amd sev-snp attestation support
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  77aa2c2
- fix: harden sev-snp report data binding
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  87c78d7
- fix: address sev-snp draft review findings
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  0701e63
- feat: add sev-snp verifier core
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  ce4aa6d
- fix: normalize sev-snp cert collateral
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  c0b442b
- fix: add fail-closed sev-snp measurement binding
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  1adfa2b
- fix: recompute sev-snp launch measurement
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  0e9f586
- fix: add sev-snp boot info helper
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  5755441
- test: add sev-snp measurement golden vector
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  4b31c97
- fix: add sev-snp auth policy helper
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  7dda8ff
- fix: bind sev-snp app id into measurement
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  6c2d817
- fix: connect sev-snp verified attestation to boot info
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  be054d8
- fix: parse sev-snp measurement inputs from vm config
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  ace8753
- fix: route kms snp attestation through dry-run auth
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  2b73095
- fix: report sev-snp onboarding attestation info
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  922afd7
- fix: use sev-snp boot info for kms self auth
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  5b36b4c
- fix: make auth-simple tcb policy explicit
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  a8f0e88
- fix: block sev-snp temp ca release
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  058fd29
- fix: derive sev-snp tcb policy from report
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  73d857b
- chore: satisfy sev-snp workspace clippy
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  52d3fac
- docs: add sev-snp review readiness note
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  0077ec9
- feat: enable guarded sev-snp key release
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  3792eb1
- fix: bind sev-snp vm launch inputs
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  027077b
- fix: complete sev-snp key release smoke path
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  cfe476b
- fix: satisfy ci lint checks
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  40396b7
- fix: satisfy prek shellcheck
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  5cb4566
- test: add sev-snp e2e smoke script
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  409c4c5
- test: harden sev-snp smoke script
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  2aa70e8
- docs: document sev-snp smoke host matrix
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  fc22673
- docs: clarify sev-snp smoke image requirements
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  0303256
- docs: clarify sev-snp fresh-box smoke
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  1850e37
- docs: record sev-snp smoke gate boundary
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  2e88b58
- fix: complete sev-snp smoke proxy path
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  ac5fbf5
- docs: clarify sev-snp proxy smoke state
  
  ChrisWorkBot
  authored and
  kvinwang
  committed
  1660d98
Commits on Jun 15, 2026
- Remove fallback DNS override in prepare script
  kvinwang
  committed
  e00bdd4
- Remove AMD KDS proxy from CVM boot path
  kvinwang
  committed
  91267dc
- Keep SEV-SNP attestation variants last
  kvinwang
  committed
  57d0f02
- Use imported AMD SNP report type
  kvinwang
  committed
  93d07ea
- Split SEV-SNP attestation crates
  kvinwang
  committed
  6361168
- Bind SNP app config via HOST_DATA
  kvinwang
  committed
  8bbade4
Commits on Jun 16, 2026
- Select SEV-SNP KDS product from report
  kvinwang
  committed
  3f71e7d
- Use self-contained SNP measurement input
  kvinwang
  committed
  c5d4910
- Detect SEV-SNP C-bit position from CPUID
  kvinwang
  committed
  48fa211
- Detect SEV-SNP launch params from QEMU
  kvinwang
  committed
  02865d0
Commits on Jun 17, 2026
Commits on Jun 18, 2026
- dstack-types: single source of truth for host-shared dir & mr_config
  kvinwang
  committed
  2553ab9
- guest: read SEV mr_config from the real host-shared copy dir
  kvinwang
  committed
  8413966
- vmm: use launch-measurement os_image_hash for SEV-SNP
  kvinwang
  committed
  e0f1fe4
- dstack-util: report real mr_system/mr_aggregated for SEV in show-mrs
  kvinwang
  committed
  b085a52
- kms: drop SNP key-release self-authorization config gate
  kvinwang
  committed
  3642d08
- dstack-attest: offline SEV-SNP attestation verification test
  kvinwang
  committed
  ae5f561
- dstack-mr: add shared AMD SEV-SNP launch-measurement module
  kvinwang
  committed
  2e3aca5
- kms: source SEV-SNP measurement from dstack-mr::sev
  kvinwang
  committed
  81379af
- verifier: verify AMD SEV-SNP os_image_hash
  kvinwang
  committed
  678bb8a
- guest, dstack-util: platform-adaptive quote (incl. AMD SEV-SNP)
  kvinwang
  committed
  59b7220
- dstack-attest: offline end-to-end SEV-SNP os_image_hash test
  kvinwang
  committed
  b2dc95a
- reuse: license SEV-SNP test fixtures (CC0-1.0)
  kvinwang
  committed
  d80daeb
- test: AMD SEV-SNP forged-quote / tampered-input coverage
  kvinwang
  committed
  719370a
- dstack-mr: own SEV os_image_hash CLI; vmm reads digest.sev.txt
  kvinwang
  committed
  776f2ab
- vmm: reuse dstack-mr OVMF measurement for sev_snp_measurement
  kvinwang
  committed
  a9f4b36
- vmm: drop TeePlatform::Auto, model auto as Option<TeePlatform>
  kvinwang
  committed
  52f277f
Commits on Jun 20, 2026
- docs(snp): reconcile review-readiness doc with current implementation
  kvinwang
  committed
  fe7972c
Commits on Jun 22, 2026
- refactor(attest): make app info source explicit
  kvinwang
  committed
  d13546f
- refactor(attest): simplify app info source flow
  kvinwang
  committed
  bc37540
- refactor(attest): derive app info directly from platform
  kvinwang
  committed
  c736247
- fix(vmm): share effective vcpu count
  kvinwang
  committed
  58210db
- refactor(kms): leave snp tcb policy to auth api
  kvinwang
  committed
  485cbac
- refactor(kms): make snp release gate a bool
  kvinwang
  committed
  f1e7633
- refactor(snp): drop app identity from measurement input
  kvinwang
  committed
  ec6a5d2
- refactor(snp): derive rootfs from measured cmdline
  kvinwang
  committed
  70b6cd1
- refactor(snp): drop legacy measurement document parser
  kvinwang
  committed
  f1f3a89
- refactor(snp): split ovmf parsing helpers
  kvinwang
  committed
  f70bddc
- refactor(snp): parse ovmf metadata with binrw
  kvinwang
  committed
  ab89844
- test(snp): cover ovmf parser golden vector
  kvinwang
  committed
  f189110
- test(snp): pin KMS provider id in smoke
  kvinwang
  committed
  439e3d5

Commits

Commits on Jun 12, 2026

Commits on Jun 15, 2026

Commits on Jun 16, 2026

Commits on Jun 17, 2026

Commits on Jun 18, 2026

Commits on Jun 20, 2026

Commits on Jun 22, 2026