Skip to content

[rust-launcher] Verify EmitEvent payload parity between Python and Rust launchers #2603

@barakeinav1

Description

@barakeinav1

Context

Follow-up from PR #2326 (port node launcher to Rust). Tracked in #2598.

Problem

The Python and Rust launchers may produce different RTMR3 measurements for the same image, breaking attestation continuity.

  • Python: Sends bare hex string (without sha256: prefix) via get_bare_digest() as the EmitEvent payload
  • Rust: Sends image_hash.as_ref().to_vec() as bytes

If as_ref() returns the full sha256:... string or raw binary (not the bare hex), the RTMR3 measurement will differ.

Action

  1. Confirm what DockerSha256Digest::as_ref() returns (bare hex? full prefixed string? raw bytes?)
  2. Compare against Python's get_bare_digest() output for the same image
  3. If they differ, fix the Rust side to match Python (or coordinate a migration)

Impact

If measurements differ, remote attestation verifiers expecting Python-era measurements will reject Rust-launcher nodes.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions