refactor(attestation-types): move DstackAttestation, Collateral, QuoteBytes into the no-dcap-qvl crate - #3246
Merged
jackson-harris-iii merged 0 commit intoAug 1, 2026
Conversation
This was referenced May 15, 2026
jackson-harris-iii
force-pushed
the
feat/attestation-types-collateral-quote-move
branch
from
August 1, 2026 11:22
7fbf80c to
93c9ab5
Compare
jackson-harris-iii
merged commit Aug 1, 2026
93c9ab5
into
feat/attestation-types-split
363 of 421 checks passed
jackson-harris-iii
force-pushed
the
feat/attestation-types-split
branch
from
August 1, 2026 11:22
6d62b22 to
93c9ab5
Compare
jackson-harris-iii
deleted the
feat/attestation-types-collateral-quote-move
branch
August 1, 2026 11:22
andrei-near
pushed a commit
that referenced
this pull request
Aug 1, 2026
…back verifier integration Headline WASM size impact (non-reproducible release-contract profile): main baseline: 1,470,007 bytes PR C2b (dcap-qvl removed): 1,066,917 bytes Delta: -403,090 bytes (-27.4%) `dcap-qvl`, `ring`, `webpki`, and `x509-cert` are no longer in `mpc-contract`'s wasm32 dep graph (verified via cargo tree --target wasm32-unknown-unknown -e no-proc-macro). Architecture `submit_participant_info` now dispatches by attestation variant: - Attestation::Mock — synchronous in-contract validation, same as before; returns PromiseOrValue::Value(()). - Attestation::Dstack — extracts (quote, collateral), stashes a PendingAttestation, schedules a cross-contract Promise to tee-verifier.near's verify_quote, then resumes in the new on_attestation_verified callback with the parsed VerifiedReport. The callback runs the post-DCAP checks (RTMR3 replay, app_compose validation, image-hash / launcher-hash matching) against fresh allowlists from TeeState, then inserts into stored_attestations or refunds the deposit on failure. Re-submissions while a prior is in flight are rejected (no silent overwrite + deposit loss). mpc-attestation - Attestation::verify split into: * extract_dcap_inputs(&Attestation) -> Option<(QuoteBytes, Collateral)> * finish_verify(&Attestation, &VerifiedReport, ...) -> Result<VerifiedAttestation, _> - attestation crate dep gated behind new `local-verify` feature. mpc-contract doesn't enable it; off-chain consumers (tee-authority, attestation-cli) do. - DstackVerify::verify (the dcap-qvl-using call) stays in the attestation crate as a trait method on the now-foreign DstackAttestation struct. mpc-contract state shape - New pending_attestations: IterableMap<AccountId, PendingAttestation> field. Storage prefix StorageKey::PendingAttestations (appended; back-compat preserved). - v3_9_1_state migration initializes pending_attestations empty. Per-network verifier account - VERIFIER_ACCOUNT_ID hardcoded: tee-verifier.near (mainnet default) or tee-verifier.testnet (cfg(not(feature = "mainnet"))). - Sandbox builds disable default features to opt into testnet name. Known follow-up in this same PR Compile passes for wasm32 (mpc-contract proper). Tests across mpc-contract, attestation-cli, tee-authority, and mpc-attestation/tests still call the deleted Attestation::verify / TeeState::add_participant APIs. Fixing them mechanically is the next commit on this branch. Stacked on #3246.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3268
Pure crate split, no behavior change. Stacked on #3245. Sets up the next PR to drop
dcap-qvlfrommpc-contract's WASM build graph (currentlympc-contract -> mpc-attestation -> attestation -> dcap-qvl).What moves into
attestation-typesDstackAttestation— the wasm-friendly bundle struct (quote,collateral,tcb_info). No methods on the struct itself; thedcap_qvl::verify::verifyentry point is a trait method on theattestationside.Collateral— field-for-field mirror ofdcap_qvl::QuoteCollateralV3. Borsh wire layout matches the upstream type whendcap-qvlis built with itsborshfeature, so on-chain state that previously stored anattestation::collateral::Collateral(newtype arounddcap_qvl::QuoteCollateralV3) decodes into this type byte-identical without migration.QuoteBytes— unchanged.What stays in
attestationDstackVerifytrait +impl DstackVerify for DstackAttestation, which is the one and onlydcap_qvl::verify::verifycall site. Defined as a trait because inherent impls on foreign types are forbidden in Rust.collateral_from_dcap/collateral_to_dcapfree functions for converting betweendcap_qvl::QuoteCollateralV3and the mirror. Used by off-chain code (tee-authority's PCCS fetch path, integration tests) and re-exported throughmpc_attestationso the call sites don't need to add a directattestationdep.Why a trait instead of an inherent method
The
DstackAttestationstruct lives inattestation-types. Theverifymethod requiresdcap-qvl(heavy crypto closure). Rust forbids inherent impls on foreign types. A trait lets theverifymethod be added fromattestation(which has thedcap-qvldep) to a type defined inattestation-types(which doesn't).Callers using
dstack_attestation.verify(...)syntax now need to bringDstackVerifyinto scope.mpc-attestationdoes this internally; no other consumers were affected.Drive-bys
IntoContractType<Collateral>/IntoInterfaceType<dtos::Collateral>impls inmpc-contractandmpc-nodesimplified to direct field assignment (no moreCollateral::from(QuoteCollateralV3 { ... })).attestationcrate's deps pruned: dropsborsh,derive_more,serde,hex,thiserror(no longer used after the body shrank to the trait + conversion helpers);serde_jsonmoved to dev-deps.WASM size impact
Non-reproducible
release-contractprofile: 1,470,007 → 1,471,144 bytes (+1,137 bytes / 0.07%). Negligible. The next PR dropsdcap-qvlfrom the contract entirely.Follow-up
Next PR (C2b): feature-gate
mpc-attestation'sattestationdep behindlocal-verify, refactorsubmit_participant_infoto delegate to the verifier contract via Promise + callback, and confirmdcap-qvldrops out ofmpc-contract's WASM build graph.