fix(attestation): preserve TDX V2 event integrity

[kvinwang]

Summary

• populate canonical digest preimages before serializing TDX V2 runtime events
• preserve runtime-event digests when producing stripped attestations
• verify that serialized and stripped V2 evidence retains its digest-to-preimage binding

Context

TDX V2 runtime events are extended into RTMR3 using the SHA-384 digest of a canonical preimage. Versioned and RA-TLS stripped attestations must carry enough information for relying parties to independently verify that binding. Previously the versioned conversion could omit the preimage, and stripping could clear the corresponding digest.

Testing

• cargo fmt --all -- --check
• cargo test -p cc-eventlog -p dstack-attest
• cargo clippy -p cc-eventlog -p dstack-attest -- -D warnings
• git diff --check origin/next...HEAD

[Copilot]

Pull request overview

This PR fixes a correctness gap in TDX V2 attestation handling so that serialized/stripped evidence preserves the digest-to-canonical-preimage binding required to independently verify RTMR3 runtime events.

Changes:

• Ensure TDX V2 event preimages are populated before projecting an Attestation into a versioned wire format.
• Preserve TDX event digests when stripping event logs for RA-TLS / size-reduced representations.
• Add tests asserting stripped/serialized V2 events remain verifiable via digest ↔ preimage validation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
dstack/dstack-attest/src/attestation.rs	Populates V2 preimages before versioned serialization; strengthens versioning/stripping test to validate digest↔preimage binding survives round-trip.
dstack/cc-eventlog/src/tdx.rs	Fixes TdxEvent::stripped() to preserve the digest (and adds a test ensuring stripped V2 runtime events remain verifiable).

Suppressed comments (1)

dstack/dstack-attest/src/attestation.rs:2426

• into_versioned() only upgrades to the V1/msgpack wire format based on self.runtime_events, but TDX V2 events can also exist in the embedded TDX quote event log (tdx_quote.event_log). If a caller has V2 events only in the quote log (common when runtime_events is empty), this will still choose the V0/SCALE format, which cannot encode TdxEvent.version/preimage (#[codec(skip)]) and will break the intended digest-to-preimage binding.

        let has_v2 = self
            .runtime_events
            .iter()
            .any(|e| !matches!(e.version, EventLogVersion::V1));
        if has_v2 {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.