gcp: unify OS image hash measurement

[kvinwang]

Summary

• add GCP-specific OS image measurement material (measurement.gcp.cbor) that carries the UKI Authenticode SHA-256 measured by GCP TPM PCR2
• extend VmConfig / measurement documents with gcp_measurement, and make the GCP verifier bind it to the unified os_image_hash = sha256(sha256sum.txt)
• update dstack-mr to generate/inspect GCP measurement CBOR
• update dstack-cloud to read digest.txt and attach gcp_measurement instead of using auth_hash.txt as the OS image hash
• document the unified GCP attestation flow

Testing

• cargo fmt --check
• cargo check -p dstack-types -p dstack-mr -p dstack-verifier
• python3 -m py_compile scripts/bin/dstack-cloud
• built the paired meta-dstack image with make dist FLAVORS=prod DIST_DIR=images
• deployed the image to GCP project wuhan-workshop and confirmed the app starts
• called /Attest on the GCP VM and verified the returned attestation with this branch's verifier:
  • tee_platform = gcp-tdx
  • quote_verified = true
  • event_log_verified = true
  • os_image_hash_verified = true

[Copilot]

Pull request overview

This PR updates the GCP TDX attestation flow to use a unified OS image identity (os_image_hash = sha256(sha256sum.txt)) consistent with other platforms, while still binding the GCP-measured UKI Authenticode hash (from TPM PCR2) via new GCP-specific measurement material.

Changes:

• Introduces measurement.gcp.cbor and a new gcp_measurement field in VmConfig / measurement documents to bind GCP’s UKI Authenticode hash to the unified os_image_hash.
• Updates the verifier’s GCP TDX path to require and validate vm_config.gcp_measurement against vm_config.os_image_hash and TPM event log contents.
• Updates dstack-mr and dstack-cloud to generate, attach, and inspect the new GCP measurement material; updates documentation to reflect the unified flow.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vmm/src/app.rs	Adds the new gcp_measurement field (default None) when building VmConfig.
verifier/src/verification.rs	Requires/validates vm_config.gcp_measurement and compares decoded UKI Authenticode hash against the GCP TPM PCR2 event.
verifier/README.md	Documents GCP alongside TDX-lite and SNP for unified os_image_hash verification behavior.
scripts/bin/dstack-cloud	Reads digest.txt + sha256sum.txt + measurement.gcp.cbor and emits vm_config.gcp_measurement instead of using auth_hash.txt.
dstack-types/src/lib.rs	Extends VmConfig and measurement document types to include gcp_measurement; adds GCP CBOR measurement/document types and filename constant.
dstack-mr/src/measurement.rs	Includes measurement.gcp.cbor in the generated OsImageMeasurementDocument when present.
dstack-mr/src/main.rs	Adds gcp support to inspect-measurement and introduces gcp-measurement-cbor utility subcommand.
docs/security/security-model.md	Extends the unified no-image-download model description to cover GCP TDX and measurement.gcp.cbor.
docs/attestation-gcp.md	Documents the new binding step between unified os_image_hash and the GCP TPM UKI event using gcp_measurement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.