fix(kms): make a disabled os image verification visible

dstack/kms/kms.toml

@@ -74,6 +74,8 @@ insecure_allow_external_trust_anchors = false
 # sev_snp_turin = "/etc/dstack/roots/amd-turin-ark.pem"
 
 [core.image]
+# Verify os_image_hash against the booted image. If false, os_image_hash is
+# caller-supplied, so allowedOsImages is not enforced. Never disable in production.
 verify = true
 cache_dir = "/usr/share/dstack/images"
 download_url = "http://localhost:8000/{OS_IMAGE_HASH}.tar.gz"

dstack/kms/rpc/proto/kms_rpc.proto

@@ -58,6 +58,9 @@ message GetMetaResponse {
   optional string kms_contract_address = 7;
   optional uint64 chain_id = 8;
   optional string app_auth_implementation = 9;
+  // `[core.image] verify`: whether `os_image_hash` is checked against the
+  // booted image. Unset on older KMS; do not treat unset as true.
+  optional bool os_image_verification = 10;
 }
 
 message GetKmsKeyRequest {

dstack/kms/src/main_service.rs

@@ -30,7 +30,7 @@ use ra_tls::{
 };
 use scale::Decode;
 use tokio::sync::OnceCell;
-use tracing::{info, warn};
+use tracing::{debug, warn};
 use upgrade_authority::{
     build_boot_info, ensure_app_id_len, local_kms_boot_info, BootInfo, GetInfoResponse,
 };
@@ -178,6 +178,11 @@ impl KmsState {
                 "self-authorization is disabled; trusted RPCs will not be gated by KMS self-attestation - do not use in production TEE deployments"
             );
         }
+        if !config.image.verify {
+            warn!(
+                "os image verification is disabled; os_image_hash is caller-supplied and unverified - do not use in production TEE deployments"
+            );
+        }
         Ok(Self {
             inner: Arc::new(KmsStateInner {
                 config,
@@ -336,7 +341,7 @@ impl RpcHandler {
         report: &VerifiedAttestation,
     ) -> Result<()> {
         if !self.state.config.image.verify {
-            info!("Image verification is disabled");
+            debug!("os image verification is disabled");
             return Ok(());
         }
         let mut detail = VerificationDetails::default();
@@ -521,6 +526,7 @@ impl KmsRpc for RpcHandler {
             chain_id: info.chain_id,
             gateway_app_id: info.gateway_app_id,
             app_auth_implementation: info.app_implementation,
+            os_image_verification: Some(self.state.config.image.verify),
         })
     }