atlas_rs/dstack/
config.rs

1//! Configuration types for DStack TDX verification.
2
3use crate::tdx::ExpectedBootchain;
4
5/// Configuration for DstackTDXVerifier.
6///
7/// This struct holds all the expected values and settings for TDX verification.
8#[derive(Debug, Clone)]
9pub struct DstackTDXVerifierConfig {
10    /// Expected app compose configuration (as JSON Value for hash calculation).
11    ///
12    /// The verifier will compute the hash of this configuration and compare
13    /// it against the hash in the TCB info and event log.
14    pub app_compose: Option<serde_json::Value>,
15
16    /// Allowed TCB statuses.
17    ///
18    /// Only attestations with TCB status in this list will be accepted.
19    /// Default: `["UpToDate"]`
20    pub allowed_tcb_status: Vec<String>,
21
22    /// Disable runtime verification (NOT RECOMMENDED).
23    ///
24    /// When true, bootchain, app_compose, and os_image_hash verification
25    /// will be skipped. This should only be used for testing.
26    pub disable_runtime_verification: bool,
27
28    /// Expected bootchain measurements.
29    ///
30    /// If provided, the verifier will check that the attestation's MRTD
31    /// and RTMR0-2 match these expected values.
32    pub expected_bootchain: Option<ExpectedBootchain>,
33
34    /// Expected OS image hash.
35    ///
36    /// The SHA256 hash of the OS image that should be running in the TD.
37    pub os_image_hash: Option<String>,
38
39    /// PCCS URL for collateral fetching.
40    ///
41    /// If None, uses Intel's default PCS endpoint.
42    pub pccs_url: Option<String>,
43
44    /// Cache collateral to avoid repeated PCS fetches.
45    ///
46    /// When true (default), collateral fetched from PCS will be cached
47    /// and reused for subsequent verifications.
48    pub cache_collateral: bool,
49}
50
51impl Default for DstackTDXVerifierConfig {
52    fn default() -> Self {
53        Self {
54            app_compose: None,
55            allowed_tcb_status: vec!["UpToDate".to_string()],
56            disable_runtime_verification: false,
57            expected_bootchain: None,
58            os_image_hash: None,
59            pccs_url: None,
60            cache_collateral: true,
61        }
62    }
63}
64
65/// Builder for DstackTDXVerifierConfig.
66///
67/// Provides a fluent API for constructing verifier configurations.
68///
69/// # Example
70///
71/// ```
72/// use atlas_rs::dstack::{DstackTDXVerifierBuilder};
73/// use atlas_rs::tdx::ExpectedBootchain;
74/// use serde_json::json;
75///
76/// let verifier = DstackTDXVerifierBuilder::new()
77///     .app_compose(json!({
78///         "runner": "docker-compose",
79///         "docker_compose_file": "..."
80///     }))
81///     .expected_bootchain(ExpectedBootchain {
82///         mrtd: "abc123...".to_string(),
83///         rtmr0: "def456...".to_string(),
84///         rtmr1: "ghi789...".to_string(),
85///         rtmr2: "jkl012...".to_string(),
86///     })
87///     .os_image_hash("sha256:...".to_string())
88///     .build()
89///     .unwrap();
90/// ```
91pub struct DstackTDXVerifierBuilder {
92    config: DstackTDXVerifierConfig,
93}
94
95impl Default for DstackTDXVerifierBuilder {
96    fn default() -> Self {
97        Self::new()
98    }
99}
100
101impl DstackTDXVerifierBuilder {
102    /// Create a new builder with default configuration.
103    pub fn new() -> Self {
104        Self {
105            config: DstackTDXVerifierConfig::default(),
106        }
107    }
108
109    /// Set the expected app compose configuration.
110    pub fn app_compose(mut self, value: serde_json::Value) -> Self {
111        self.config.app_compose = Some(value);
112        self
113    }
114
115    /// Set the expected bootchain measurements.
116    pub fn expected_bootchain(mut self, bootchain: ExpectedBootchain) -> Self {
117        self.config.expected_bootchain = Some(bootchain);
118        self
119    }
120
121    /// Set the expected OS image hash.
122    pub fn os_image_hash(mut self, hash: impl Into<String>) -> Self {
123        self.config.os_image_hash = Some(hash.into());
124        self
125    }
126
127    /// Set the allowed TCB statuses.
128    pub fn allowed_tcb_status(mut self, statuses: Vec<String>) -> Self {
129        self.config.allowed_tcb_status = statuses;
130        self
131    }
132
133    /// Set the PCCS URL for collateral fetching.
134    pub fn pccs_url(mut self, url: impl Into<String>) -> Self {
135        self.config.pccs_url = Some(url.into());
136        self
137    }
138
139    /// Disable runtime verification (NOT RECOMMENDED).
140    pub fn disable_runtime_verification(mut self) -> Self {
141        self.config.disable_runtime_verification = true;
142        self
143    }
144
145    /// Enable or disable collateral caching.
146    pub fn cache_collateral(mut self, enabled: bool) -> Self {
147        self.config.cache_collateral = enabled;
148        self
149    }
150
151    /// Get the built configuration.
152    pub fn into_config(self) -> DstackTDXVerifierConfig {
153        self.config
154    }
155
156    /// Build the DstackTDXVerifier with the configured settings.
157    pub fn build(self) -> Result<super::DstackTDXVerifier, crate::AtlsVerificationError> {
158        super::DstackTDXVerifier::new(self.config)
159    }
160}
atlas_rs/dstack/config.rs

atlas_rs/dstack/
config.rs
