Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Dstack spike — boot the universal image in a CVM, verify the chain end-to-end

Aperta
  • Qualcosa non va?
#491 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
15/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cloud, docker, github, typescript
Ambito
infrastructure, security

Direzione di ricerca

Start with ADR 0027 and the deploy train that produces BOS_IMAGE_DIGEST; issue #490 must land first. The spike requires provisioning a Phala Dstack TDX CVM, booting the pinned universal image, and checking attestation, trustless verification, and in-CVM TLS. Record the Path B feasibility verdict and findings in ADR 0027, then update its status.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

ready-for-human

Blocked by: #490 (ADR 0027 must exist first)

What to build

A throwaway spike proving the confidential verified-serving tier (ADR 0027) end to end: deploy the universal image to a testnet Phala Dstack CVM and verify the full chain of trust. Output is spike notes appended to ADR 0027 and a go/no-go on its strong version — then promote the ADR to Accepted or amend it.

Steps

  1. Prereqs (human-side): Phala Cloud account + TDX CVM provisioning; decide instance sizing. No platform code changes expected — the universal image is already the right artifact.
  2. Boot Path A first (self-contained): build/push a testnet image whose compose pins the GHCR digest (the deploy train already produces BOS_IMAGE_DIGEST); stage the tenant namespace so the instance boots self-contained; run it in the CVM with BOS_ACCOUNT/BOS_GATEWAY env.
  3. Verify the chain:
    • compose-hash (RTMR3) ↔ pushed GHCR digest ↔ the exact bytes CI built
    • /.well-known/attestation returns quote + event log + VM config; nonce freshness via reportData works
    • Trustless verification locally with dcap-qvl / dstack-verifier (not just Phala's hosted API)
    • TLS terminated inside the CVM (ZT-TLS pattern): enclave-held ACME keys, /evidences/ bound to the quote, CAA records set
  4. Go/no-go: config-hash runtime-data binding (Path B's anchor). Can the enclave report the resolved FastKV config hash (+ registry height) in runtime data, and hard-gate CDN-fetched bundles against the config's SRI pins? If awkward, record the fallback: Path A-only verification (compose-hash ↔ digest, no config binding).
  5. Write up: append spike notes to ADR 0027 with findings, friction points, and the Path B verdict; update the ADR Status (Proposed → Accepted, or amend). Flag future work: bos deploy --confidential, bos verify <domain>, on-chain DCAP verification, FastKV-published measurement allowlist.

Acceptance criteria

  • Universal image boots in a testnet Dstack CVM, self-contained, identity-driven (BOS_ACCOUNT/BOS_GATEWAY)
  • Compose-hash verified against the pushed GHCR digest
  • /.well-known/attestation verified trustlessly (local dcap-qvl/dstack-verifier), nonce-fresh
  • TLS termination inside the CVM with evidence binding demonstrated
  • Path B (config-hash runtime-data binding + in-enclave SRI pin gating) verdict recorded: feasible or fallback
  • Spike notes appended to ADR 0027; Status updated
Lingua principale
TypeScript
Stelle
5
Fork
3
Merge medio
10h 12m
PR unite (30g)
102

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NEARBuilders/everything-dev

Tutte le issue di NEARBuilders/everything-dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.