From 2f31e8604429f859253285a609c922eb68991731 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 24 Jul 2026 19:59:34 +0000 Subject: [PATCH 1/2] fix(simulator): detect Nitro Enclave DMI --- dstack/dstack-types/src/lib.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dstack/dstack-types/src/lib.rs b/dstack/dstack-types/src/lib.rs index 55b81984f..dcf5bcf08 100644 --- a/dstack/dstack-types/src/lib.rs +++ b/dstack/dstack-types/src/lib.rs @@ -2227,6 +2227,7 @@ impl Platform { match product_name.map(str::trim) { Some("dstack" | "qemu") => return Some(Self::Dstack), Some("Google Compute Engine") => return Some(Self::Gcp), + Some("Nitro Enclave") => return Some(Self::NitroEnclave), _ => {} } @@ -2284,6 +2285,14 @@ mod platform_tests { Some(Platform::Gcp) ); } + + #[test] + fn detects_nitro_enclave_from_simulated_dmi() { + assert_eq!( + Platform::detect_from_dmi(Some("Nitro Enclave"), Some("AWS Nitro Enclaves")), + Some(Platform::NitroEnclave) + ); + } } #[cfg(test)] From 4943289e1ff727c74dea56119f7fab84cb148b86 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 24 Jul 2026 20:20:51 +0000 Subject: [PATCH 2/2] fix(guest): skip TDX config check on Nitro Enclave --- .../src/system_setup/config_id_verifier.rs | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/dstack/dstack-util/src/system_setup/config_id_verifier.rs b/dstack/dstack-util/src/system_setup/config_id_verifier.rs index 89f888b8c..3e71cd76c 100644 --- a/dstack/dstack-util/src/system_setup/config_id_verifier.rs +++ b/dstack/dstack-util/src/system_setup/config_id_verifier.rs @@ -94,6 +94,9 @@ fn verify_mr_config_id_for_mode(mode: TeeVariant, local: LocalMrConfigValues<'_> // in measure_app_info); there is no host-supplied claim to cross-check. // The key_provider_id pin is enforced by verify_key_provider_id. TeeVariant::DstackAwsNitroTpm => Ok(()), + // Nitro Enclave binds the image through the signed NSM document and + // the app ID through its runtime event. It has no TDX mr_config_id. + TeeVariant::DstackNitroEnclave => Ok(()), _ => verify_tdx_mr_config_id(local), } } @@ -438,4 +441,23 @@ mod tests { }; verify_mr_config_v3_document(&document.to_string(), local_with_script).unwrap(); } + + #[test] + fn nitro_enclave_does_not_require_tdx_mr_config() -> Result<()> { + let compose_hash = [0u8; 32]; + let gpu_policy_hash = [0u8; 32]; + let app_id = [0u8; 20]; + let instance_id = [0u8; 20]; + let local = LocalMrConfigValues { + compose_hash: &compose_hash, + gpu_policy_hash: &gpu_policy_hash, + init_script_hashes: &[], + app_id: &app_id, + instance_id: &instance_id, + key_provider: KeyProviderKind::None, + key_provider_id: &[], + }; + + verify_mr_config_id_for_mode(TeeVariant::DstackNitroEnclave, local) + } }