(
config: &Config,
tls_config: &TlsConfig,
alt_names: Vec<String>,
)
| 136 | } |
| 137 | |
| 138 | async fn gen_debug_certs( |
| 139 | config: &Config, |
| 140 | tls_config: &TlsConfig, |
| 141 | alt_names: Vec<String>, |
| 142 | ) -> Result<()> { |
| 143 | let kms_url = config.kms_url.clone(); |
| 144 | if kms_url.is_empty() { |
| 145 | info!("KMS URL is empty, skipping cert generation"); |
| 146 | return Ok(()); |
| 147 | } |
| 148 | |
| 149 | // Check if debug key file is configured |
| 150 | if config.debug.key_file.is_empty() { |
| 151 | info!("Debug key file not configured, skipping cert generation"); |
| 152 | return Ok(()); |
| 153 | } |
| 154 | |
| 155 | // Load pre-generated key pair and quote data from JSON file |
| 156 | info!("Loading debug key data from: {}", config.debug.key_file); |
| 157 | let ctx = "Failed to read debug key, run `cargo run --bin gen_debug_key -- <simulator_url>` to generate it"; |
| 158 | let json_content = fs_err::read_to_string(&config.debug.key_file).context(ctx)?; |
| 159 | let debug_data: DebugKeyData = |
| 160 | serde_json::from_str(&json_content).context("Failed to parse debug key JSON")?; |
| 161 | |
| 162 | let key_pem = debug_data.key_pem; |
| 163 | let quote_bin = STANDARD |
| 164 | .decode(&debug_data.quote_base64) |
| 165 | .context("Failed to decode quote from base64")?; |
| 166 | let event_log_json = debug_data.event_log; |
| 167 | let vm_config_json = debug_data.vm_config; |
| 168 | |
| 169 | // Parse key pair |
| 170 | let key = KeyPair::from_pem(&key_pem).context("Failed to parse debug key")?; |
| 171 | let pubkey = key.public_key_der(); |
| 172 | |
| 173 | // Build CSR with attestation from debug quote |
| 174 | let attestation = |
| 175 | ra_tls::attestation::Attestation::from_tdx_quote(quote_bin, event_log_json.as_bytes()) |
| 176 | .context("Failed to create attestation from debug quote")? |
| 177 | .into_versioned(); |
| 178 | |
| 179 | let csr = CertSigningRequestV2 { |
| 180 | confirm: "please sign cert:".to_string(), |
| 181 | pubkey, |
| 182 | config: CertConfigV2 { |
| 183 | org_name: None, |
| 184 | subject: "dstack-gateway".to_string(), |
| 185 | subject_alt_names: alt_names, |
| 186 | usage_server_auth: true, |
| 187 | usage_client_auth: true, |
| 188 | ext_quote: true, |
| 189 | ext_app_info: true, |
| 190 | not_before: None, |
| 191 | not_after: None, |
| 192 | }, |
| 193 | attestation, |
| 194 | }; |
| 195 | let signature = csr.signed_by(&key).context("Failed to sign CSR")?; |
no test coverage detected