fix(verifier): a DebugSwap guest verifies, and four more ways host bytes reach a measurement unchecked - #1275

Open

kvinwang wants to merge 8 commits into

nextfrom

fix/verifier-input-canonicalization

Commits on Sep 20, 2026

fix(dstack-mr): constrain sev guest_features to the bits dstack launches with
kvinwang
committed
dbeaab9
fix(tpm-qvl): check every quoted PCR against the attested bank
kvinwang
committed
3969d7a
fix(dstack-types): reject trailing bytes after a CBOR measurement document
kvinwang
committed
7acfe0e
fix(dstack-types): require an explicit version in an mr_config document
kvinwang
committed
dc7c32d
fix(dstack-mr): reject a duplicated dstack.rootfs_hash instead of resolving it
kvinwang
committed
54a4038
fix(dstack-types): version the AWS measurement document like its siblings
kvinwang
committed
7e6e92d
refactor(dstack-attest): delete the unused sev_snp_mr_config accessor
kvinwang
committed
08cb412
refactor(sev-snp-qvl): rename parse_amd_snp_report to say it verifies nothing
kvinwang
committed
5a66157