feat: Add GCP TDX support with event log compatibility fix#416
Open
lalalune wants to merge 5 commits intoDstack-TEE:masterfrom
Open
feat: Add GCP TDX support with event log compatibility fix#416lalalune wants to merge 5 commits intoDstack-TEE:masterfrom
lalalune wants to merge 5 commits intoDstack-TEE:masterfrom
Conversation
- Fix cc-eventlog to handle GCP's 0-based IMR indices using saturating_sub - Add Terraform configuration for GCP Confidential VMs (Intel TDX) - Add deployment scripts and comprehensive test suite (12 tests) - Add Base Sepolia network to hardhat config - Full backward compatibility with Phala/standard TDX deployments Tested on GCP c3-standard-8 with real Intel TDX hardware attestation.
Contributor
|
Very good start point. It pulls the GCP's in-stock Ubuntu image, and install the dstack agent and docker runtime in the VM startup script. It largely works because GCP CC VM also offers standard TDX attestation API. The missing pieces in this approach:
There's a tracking issue that covers the missing pieces: #125 |
kvinwang
reviewed
Dec 23, 2025
| // However, some cloud platforms (notably GCP) may include events with IMR index 0 | ||
| // in their CCEL tables. Rather than failing on these, we pass them through as RTMR 0. | ||
| // This maintains compatibility with both standard TCG format and GCP's implementation. | ||
| let imr = value.imr_index.saturating_sub(1); |
Collaborator
There was a problem hiding this comment.
Merging imr 0 and 1 would cause RMTR replay mismatches. We've dropped imr 0 events in an internal dev branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tested on GCP c3-standard-8 with real Intel TDX hardware attestation.
Feel free to just pick out the fixes to the lib.rs since that's the main actual fix