[STACKED on #1020] fix(simulator): replay image-specific GCP TPM events

[kvinwang]

DEPENDENCY — merge #1020 first. This PR targets master.

Problem

The GCP vTPM simulator replayed the repository's fixed tpm_eventlog.bin fixture for every VM. The fixture contains one hard-coded UKI Authenticode digest, while vm_config.gcp_measurement describes the image that was actually selected. Arbitrary dev images therefore produced an event-log UKI measurement that did not match their image identity.

Fix

Generate and consume an image-specific GCP TPM event log:

• derive measurement.gcp.eventlog.bin from the GCP firmware event-log template during image assembly;
• replace the template's UKI measurement event with the assembled UKI Authenticode SHA-256 digest;
• generate the event log only for dev images and include it in their archives;
• keep the simulator-only event log out of sha256sum.txt, so it does not change the production image identity;
• load the event log with the image and pass it only to the development simulator;
• validate that PCR2's UKI event matches measurement.gcp.cbor before starting the simulated vTPM;
• replay the exact event log into swtpm;
• expose the same event-log bytes through /sys/kernel/security/tpm0/binary_bios_measurements.

This keeps the quoted PCRs, exposed event log, GCP measurement document, and actual image identity aligned.

Dependency

• Replacement parent PR: fix(simulator): replay measured NitroTPM boot PCRs #1020 (supersedes the mis-merged fix(simulator): replay measured NitroTPM boot PCRs #1020)
• Base branch: master
• Merge fix(simulator): replay measured NitroTPM boot PCRs #1020 first; GitHub will then narrow this PR to its image-specific event-log commit.

Verification

• cargo check -p dstack-types -p dstack-vmm -p dstack-tee-simulator
• focused simulator test for GCP event-log/measurement binding
• focused VMM simulator-config transport test
• synthetic image-specific event-log generator test
• python3 -m py_compile os/image/gcp-tpm-eventlog.py
• bash -n os/image/assemble.sh dstack/tests/e2e/attestation/run-platform.sh
• cargo fmt --all
• git diff --check

[Copilot]

Pull request overview

This PR extends the simulator/image measurement pipeline to support image-specific GCP TPM event-log replay, ensuring the simulated vTPM PCRs and exposed TPM event log align with the UKI Authenticode digest described by measurement.gcp.cbor and the selected image identity.

Changes:

• Generate measurement.gcp.eventlog.bin during image assembly by patching the GCP TPM event-log template with the assembled UKI Authenticode SHA-256 digest, and include it in checksums and release archives.
• Transport the event log to the development simulator via gcp_tpm_replay, validate it against vm_config.gcp_measurement, replay it into swtpm, and expose it via /sys/kernel/security/tpm0/binary_bios_measurements.
• Add supporting types and wiring across dstack-types, VMM image loading/config, simulator logic, and E2E attestation setup.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
os/image/README.md	Documents the new generated GCP event-log artifact.
os/image/gcp-tpm-eventlog.py	New generator to bind the GCP event-log template to the assembled UKI hash.
os/image/assemble.sh	Produces, checksums, and archives measurement.gcp.eventlog.bin alongside existing measurement artifacts.
dstack/vmm/src/app/qemu.rs	Updates test fixtures to include the new gcp_tpm_replay field.
dstack/vmm/src/app/image.rs	Loads measurement.gcp.eventlog.bin into an in-memory replay struct for simulator transport.
dstack/vmm/src/app.rs	Wires gcp_tpm_replay into VM config and syncs it into the tee-simulator config.
dstack/tests/e2e/attestation/run-platform.sh	Adds gcp_tpm_replay to simulator config for GCP TDX E2E flow.
dstack/tee-simulator/src/tpm.rs	Validates/replays the GCP event log into swtpm and installs it under /sys/kernel/security.
dstack/tee-simulator/Cargo.toml	Adds nix mount feature dependency for mounting the securityfs shadow.
dstack/dstack-types/src/lib.rs	Introduces GcpTpmReplay and adds it to TeeSimulatorConfig.
dstack/Cargo.lock	Updates lockfile for the new dependency usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.