fix(verifier): a DebugSwap guest verifies, and four more ways host bytes reach a measurement unchecked

[kvinwang]

Summary

Hardens verifier and measurement inputs that are controlled by the host. The main security fix prevents a consistently measured SEV-SNP guest with unsupported SEV_FEATURES (for example DebugSwap) from passing verification and receiving keys.

Changes

1. Restrict SEV-SNP guest features

   • Require SNPActive and reject every other SEV_FEATURES bit.
   • dstack's only launch path emits guest_features = 1; existing SEV measurement vectors are unchanged.

2. Validate quoted TPM PCR values

   • Require every PCR to be labelled sha256 and contain exactly 32 bytes.
   • Prevents re-splitting the concatenated PCR preimage into values the TPM never held while preserving the signed digest.

3. Reject trailing CBOR bytes

   • Measurement decoders now require the input to contain exactly one CBOR document.

4. Require MrConfigV3.version

   • A document without version no longer silently defaults to version 3.

5. Reject duplicate dstack.rootfs_hash parameters

   • Avoids disagreement between the measurement parser (previously first value) and initramfs (last value).

6. Version the AWS measurement document

   • Adds version: 1 and rejects unsupported versions, matching the TDX, SEV, and GCP document formats.

7. Remove an unused lossy accessor

   • Deletes sev_snp_mr_config(), which converted malformed input to None and had no callers.

8. Make unverified SNP parsing explicit

   • Renames parse_amd_snp_report to parse_unverified_amd_snp_report and documents that it does not verify signatures or the AMD certificate chain.

Compatibility

The SEV, TDX, and GCP measurement encodings do not change.

Adding the AWS version field changes measurement.aws.cbor, its sha256sum.txt entry, and therefore the AWS os_image_hash. AWS NitroTPM UKI images must be rebuilt and their image hashes re-pinned. The repository has no AWS fixture or pinned AWS image hash, and image assembly regenerates this document on every build.

Verification

cargo test -p dstack-mr -p dstack-types -p tpm-qvl -p dstack-attest -p sev-snp-qvl -p dstack-verifier
cargo test --workspace
cargo clippy -- -D warnings --allow unused_variables
cargo fmt --check

Each behavioral fix has a regression test that failed on next before the fix.