test(test-utils): address review on the regenerated fixtures

- strip the NUL that terminates the PEM chains in the node's collateral, so
  the fixture stays valid PEM for consumers stricter than dcap-qvl, and
  regenerate the borsh arg fixture
- stop asserting the borsh fixture's final byte in .editorconfig: it is
  whatever the encoded collateral ends with
- give the secret key file a trailing newline, and confirm in the runbook that
  its account exists on no public network
- warn loudly when a pre-launch script is baked in, and document in the deploy
  guide and default.env that such a CVM cannot pass attestation
- state the DCAP verdict of the localnet verify_quote call without depending on
  today's date, in both runbooks and the sandbox module doc
- make the regeneration reminder unconditional (the committed key is normally
  present but stale), document the borsh/report-value refresh step, and drop the
  vestigial --run-ignored
- assert the compiled-in pre-launch policy through validate_app_compose_config,
  not only through the helper, and rename the new tests to the should_ form

Author: pbeza

.editorconfig

@@ -29,6 +29,8 @@ insert_final_newline = false
 # localnet verify_quote call; the text rules do not apply.
 [crates/tee-verifier/tests/fixtures/*.borsh]
 end_of_line = unset
-insert_final_newline = false
+# `unset`, not `false`: the last byte is whatever the encoded collateral ends
+# with, so asserting either way breaks on the next fixture regeneration.
+insert_final_newline = unset
 trim_trailing_whitespace = false
 charset = unset

crates/attestation/src/attestation.rs

@@ -628,7 +628,7 @@ mod tests {
     }
 
     #[test]
-    fn scripts_absent_with__rejects_pre_launch_script_when_disallowed() {
+    fn scripts_absent_with__should_reject_pre_launch_script_when_disallowed() {
         // Asserts the production policy, which test builds relax for the fixture.
 
         // Given
@@ -644,7 +644,25 @@ mod tests {
     }
 
     #[test]
-    fn scripts_absent_with__accepts_pre_launch_script_when_allowed() {
+    fn validate_app_compose_config__should_follow_the_compiled_in_pre_launch_policy() {
+        // Covers the wired-in policy at the call site, which the tests below reach
+        // only through the helper.
+
+        // Given
+        let app_compose = AppCompose {
+            pre_launch_script: Some("echo collecting fixtures".to_string()),
+            ..valid_app_compose()
+        };
+
+        // When
+        let result = DstackAttestation::validate_app_compose_config(&app_compose);
+
+        // Then
+        assert_eq!(result, cfg!(feature = "allow-pre-launch-script"));
+    }
+
+    #[test]
+    fn scripts_absent_with__should_accept_pre_launch_script_when_allowed() {
         // Given
         let app_compose = AppCompose {
             pre_launch_script: Some("echo collecting fixtures".to_string()),
@@ -658,7 +676,7 @@ mod tests {
     }
 
     #[test]
-    fn scripts_absent_with__rejects_other_scripts_even_when_pre_launch_is_allowed() {
+    fn scripts_absent_with__should_reject_other_scripts_when_pre_launch_is_allowed() {
         // The relaxation must stay scoped to `pre_launch_script`.
 
         // Given

crates/contract/tests/sandbox/tee_verifier.rs

@@ -361,10 +361,10 @@ async fn submit_participant_info__should_run_dcap_within_verifier_gas_budget() {
     let result = submit_dstack(&submitter, &contract).await;
 
     // Then: the real DCAP run succeeds within the production gas budget and its
-    // Verified verdict reaches the callback. The submission then fails at the
-    // post-DCAP report_data binding, because the submitter does not hold the
-    // fixture account key (see #3787); that terminal error is asserted to pin
-    // that the verdict was Verified, not Rejected.
+    // Verified verdict reaches the callback. This test deliberately submits from
+    // a plain dev account rather than the fixture node, so it then fails at the
+    // post-DCAP report_data binding; asserting that terminal error pins that the
+    // verdict was Verified, not Rejected.
     let outcomes = result.outcomes();
     let verify_quote_outcome = outcomes
         .iter()

crates/tee-verifier/tests/fixtures/verify_quote_args.borsh

@@ -57,7 +57,9 @@ All files will be written into the specified output directory.
    exported during collection, which is what the `PRELAUNCH_SCRIPT` in
    [the rust-launcher README](../../../localnet/tee/scripts/rust-launcher/README.md#exporting-the-nodes-signer-key)
    is for. The fixture node is a throwaway localnet node, which is the only reason its
-   secret key may live in the repo.
+   secret key may live in the repo: its account (`frodo.test.near`) exists on no
+   public network, and the quote and collateral that bind the key are public anyway.
+   Re-check that before committing a regenerated key.
 
    Because of that export hook, the fixture's app-compose carries a
    `pre_launch_script`, which production verification rejects as arbitrary root code.
@@ -87,6 +89,19 @@ All files will be written into the specified output directory.
    > will be managed entirely through on-chain voting (`vote_add_os_measurement`), and these
    > files will no longer need to be kept in sync with the deployed OS image.
 
+8. Regenerate the verifier's borsh argument fixture and refresh the report values
+   the verifier test hardcodes (`mr_config_id`, `rt_mr3`, `report_data` change with
+   every new node):
+
+   ```shell
+   UPDATE_FIXTURES=1 cargo test -p tee-verifier --test verify_quote verify_quote_args_fixture
+   cargo test -p tee-verifier --test verify_quote
+   ```
+
+   The second run fails on `verify_quote__should_return_verified_td10_report_for_valid_fixture`
+   and prints the values actually produced; copy them into
+   `crates/tee-verifier/tests/verify_quote.rs`.
+
 ## Tests that depend on these assets
 
 After updating assets, these tests should pass:
@@ -104,5 +119,5 @@ also depend on these assets (including `near_account_secret_key` for the tests t
 sign as the fixture account):
 
 ```shell
-cargo nextest run --cargo-profile=test-release -p mpc-contract tee_verifier --run-ignored all
+cargo nextest run --cargo-profile=test-release -p mpc-contract tee_verifier
 ```

crates/test-utils/assets/README.md

@@ -8,5 +8,5 @@
   "qe_identity_issuer_chain": "-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n",
   "qe_identity": "{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-08-07T00:34:59Z\",\"nextUpdate\":\"2026-09-06T00:34:59Z\",\"tcbEvaluationDataNumber\":19,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":4},\"tcbDate\":\"2025-05-14T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}",
   "qe_identity_signature": "3924f3d4773c519a708264a7678da83b3a62445162aba96e26e182d653416de2572eadb8602b5c3da484c1807fa502f94a19d2fea61f6b5c3b97c017f5443935",
-  "pck_certificate_chain": "-----BEGIN CERTIFICATE-----\nMIIE8TCCBJagAwIBAgIUf2SbywkMVTJKU57/JwBp8EdhP04wCgYIKoZIzj0EAwIw\ncDEiMCAGA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwR\nSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQI\nDAJDQTELMAkGA1UEBhMCVVMwHhcNMjUxMTA2MDczNzM0WhcNMzIxMTA2MDczNzM0\nWjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENLIENlcnRpZmljYXRlMRowGAYDVQQK\nDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNV\nBAgMAkNBMQswCQYDVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGpv\n0YuYrqAuSKBzKlub6mL+rvfD5AjYO3QNgfWztg4em1EGBVkGlWvduB0XQSE/sxGD\nmSvKo9t3CrOPC4SU6X6jggMMMIIDCDAfBgNVHSMEGDAWgBSVb13NvRvh6UBJydT0\nM84BVwveVDBrBgNVHR8EZDBiMGCgXqBchlpodHRwczovL2FwaS50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL3NneC9jZXJ0aWZpY2F0aW9uL3Y0L3Bja2NybD9jYT1w\nbGF0Zm9ybSZlbmNvZGluZz1kZXIwHQYDVR0OBBYEFG3n6S+KxN6t+HI8Gp96PkuZ\niWsZMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMIICOQYJKoZIhvhNAQ0B\nBIICKjCCAiYwHgYKKoZIhvhNAQ0BAQQQ0gjfsQAjRq4btO8qPAVSkjCCAWMGCiqG\nSIb4TQENAQIwggFTMBAGCyqGSIb4TQENAQIBAgEEMBAGCyqGSIb4TQENAQICAgEE\nMBAGCyqGSIb4TQENAQIDAgECMBAGCyqGSIb4TQENAQIEAgECMBAGCyqGSIb4TQEN\nAQIFAgEEMBAGCyqGSIb4TQENAQIGAgEBMBAGCyqGSIb4TQENAQIHAgEAMBAGCyqG\nSIb4TQENAQIIAgEFMBAGCyqGSIb4TQENAQIJAgEAMBAGCyqGSIb4TQENAQIKAgEA\nMBAGCyqGSIb4TQENAQILAgEAMBAGCyqGSIb4TQENAQIMAgEAMBAGCyqGSIb4TQEN\nAQINAgEAMBAGCyqGSIb4TQENAQIOAgEAMBAGCyqGSIb4TQENAQIPAgEAMBAGCyqG\nSIb4TQENAQIQAgEAMBAGCyqGSIb4TQENAQIRAgELMB8GCyqGSIb4TQENAQISBBAE\nBAICBAEABQAAAAAAAAAAMBAGCiqGSIb4TQENAQMEAgAAMBQGCiqGSIb4TQENAQQE\nBrDAbwAAADAPBgoqhkiG+E0BDQEFCgEBMB4GCiqGSIb4TQENAQYEEDa9htA8AJ/Z\n2FmaL5Jq/KEwRAYKKoZIhvhNAQ0BBzA2MBAGCyqGSIb4TQENAQcBAQH/MBAGCyqG\nSIb4TQENAQcCAQH/MBAGCyqGSIb4TQENAQcDAQH/MAoGCCqGSM49BAMCA0kAMEYC\nIQCFG1YAb3eXFte853ClVBnhlCfDyc572ZXEqax4UccSawIhAOn0VNKTZmAxUF4n\nwRkSFh4qFJ3aUlzFoPQT3xIf7kFD\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICljCCAj2gAwIBAgIVAJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xODA1MjExMDUwMTBaFw0zMzA1MjExMDUwMTBaMHAxIjAg\nBgNVBAMMGUludGVsIFNHWCBQQ0sgUGxhdGZvcm0gQ0ExGjAYBgNVBAoMEUludGVs\nIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0Ex\nCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENSB/7t21lXSO\n2Cuzpxw74eJB72EyDGgW5rXCtx2tVTLq6hKk6z+UiRZCnqR7psOvgqFeSxlmTlJl\neTmi2WYz3qOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBS\nBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUlW9d\nzb0b4elAScnU9DPOAVcL3lQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwCgYIKoZIzj0EAwIDRwAwRAIgXsVki0w+i6VYGW3UF/22uaXe0YJDj1Ue\nnA+TjD1ai5cCICYb1SAmD5xkfTVpvo4UoyiSYxrDWLmUR4CI9NKyfPN+\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n\u0000"
+  "pck_certificate_chain": "-----BEGIN CERTIFICATE-----\nMIIE8TCCBJagAwIBAgIUf2SbywkMVTJKU57/JwBp8EdhP04wCgYIKoZIzj0EAwIw\ncDEiMCAGA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwR\nSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQI\nDAJDQTELMAkGA1UEBhMCVVMwHhcNMjUxMTA2MDczNzM0WhcNMzIxMTA2MDczNzM0\nWjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENLIENlcnRpZmljYXRlMRowGAYDVQQK\nDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNV\nBAgMAkNBMQswCQYDVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGpv\n0YuYrqAuSKBzKlub6mL+rvfD5AjYO3QNgfWztg4em1EGBVkGlWvduB0XQSE/sxGD\nmSvKo9t3CrOPC4SU6X6jggMMMIIDCDAfBgNVHSMEGDAWgBSVb13NvRvh6UBJydT0\nM84BVwveVDBrBgNVHR8EZDBiMGCgXqBchlpodHRwczovL2FwaS50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL3NneC9jZXJ0aWZpY2F0aW9uL3Y0L3Bja2NybD9jYT1w\nbGF0Zm9ybSZlbmNvZGluZz1kZXIwHQYDVR0OBBYEFG3n6S+KxN6t+HI8Gp96PkuZ\niWsZMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMIICOQYJKoZIhvhNAQ0B\nBIICKjCCAiYwHgYKKoZIhvhNAQ0BAQQQ0gjfsQAjRq4btO8qPAVSkjCCAWMGCiqG\nSIb4TQENAQIwggFTMBAGCyqGSIb4TQENAQIBAgEEMBAGCyqGSIb4TQENAQICAgEE\nMBAGCyqGSIb4TQENAQIDAgECMBAGCyqGSIb4TQENAQIEAgECMBAGCyqGSIb4TQEN\nAQIFAgEEMBAGCyqGSIb4TQENAQIGAgEBMBAGCyqGSIb4TQENAQIHAgEAMBAGCyqG\nSIb4TQENAQIIAgEFMBAGCyqGSIb4TQENAQIJAgEAMBAGCyqGSIb4TQENAQIKAgEA\nMBAGCyqGSIb4TQENAQILAgEAMBAGCyqGSIb4TQENAQIMAgEAMBAGCyqGSIb4TQEN\nAQINAgEAMBAGCyqGSIb4TQENAQIOAgEAMBAGCyqGSIb4TQENAQIPAgEAMBAGCyqG\nSIb4TQENAQIQAgEAMBAGCyqGSIb4TQENAQIRAgELMB8GCyqGSIb4TQENAQISBBAE\nBAICBAEABQAAAAAAAAAAMBAGCiqGSIb4TQENAQMEAgAAMBQGCiqGSIb4TQENAQQE\nBrDAbwAAADAPBgoqhkiG+E0BDQEFCgEBMB4GCiqGSIb4TQENAQYEEDa9htA8AJ/Z\n2FmaL5Jq/KEwRAYKKoZIhvhNAQ0BBzA2MBAGCyqGSIb4TQENAQcBAQH/MBAGCyqG\nSIb4TQENAQcCAQH/MBAGCyqGSIb4TQENAQcDAQH/MAoGCCqGSM49BAMCA0kAMEYC\nIQCFG1YAb3eXFte853ClVBnhlCfDyc572ZXEqax4UccSawIhAOn0VNKTZmAxUF4n\nwRkSFh4qFJ3aUlzFoPQT3xIf7kFD\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICljCCAj2gAwIBAgIVAJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xODA1MjExMDUwMTBaFw0zMzA1MjExMDUwMTBaMHAxIjAg\nBgNVBAMMGUludGVsIFNHWCBQQ0sgUGxhdGZvcm0gQ0ExGjAYBgNVBAoMEUludGVs\nIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0Ex\nCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENSB/7t21lXSO\n2Cuzpxw74eJB72EyDGgW5rXCtx2tVTLq6hKk6z+UiRZCnqR7psOvgqFeSxlmTlJl\neTmi2WYz3qOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBS\nBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUlW9d\nzb0b4elAScnU9DPOAVcL3lQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwCgYIKoZIzj0EAwIDRwAwRAIgXsVki0w+i6VYGW3UF/22uaXe0YJDj1Ue\nnA+TjD1ai5cCICYb1SAmD5xkfTVpvo4UoyiSYxrDWLmUR4CI9NKyfPN+\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n"
 }

crates/test-utils/assets/collateral.json

@@ -40,16 +40,23 @@ printf '%s' "$(jq -r --indent 4 '.tee_participant_info.Dstack.tcb_info.app_compo
 # arrays, while the fixture parser (`attestation::collateral::collateral_from_json`)
 # reads them as hex strings, so hex-encode those four fields here. Fields that
 # are already hex pass through unchanged.
+# The PEM chain arrives NUL-terminated from the quote's C string; strip it so the
+# fixture stays valid PEM for consumers stricter than dcap-qvl.
 jq -r 'def tohex:
          if type == "array" then
            reduce .[] as $b (""; . + ("0123456789abcdef" | .[(($b / 16) | floor):(($b / 16) | floor) + 1])
                                   + ("0123456789abcdef" | .[($b % 16):($b % 16) + 1]))
          else . end;
+       def strip_nul: if type == "string" then until(endswith("\u0000") | not; rtrimstr("\u0000")) else . end;
        .tee_participant_info.Dstack.collateral
        | .root_ca_crl |= tohex
        | .pck_crl |= tohex
        | .tcb_info_signature |= tohex
-       | .qe_identity_signature |= tohex' "$INPUT_FILE" > "$OUTPUT_DIR/collateral.json"
+       | .qe_identity_signature |= tohex
+       | .pck_crl_issuer_chain |= strip_nul
+       | .tcb_info_issuer_chain |= strip_nul
+       | .qe_identity_issuer_chain |= strip_nul
+       | .pck_certificate_chain |= strip_nul' "$INPUT_FILE" > "$OUTPUT_DIR/collateral.json"
 
 # Extract quote
 jq -c '.tee_participant_info.Dstack.quote' "$INPUT_FILE" > "$OUTPUT_DIR/quote.json"
@@ -68,12 +75,12 @@ echo "Extraction complete. Files written to '$OUTPUT_DIR':"
 ls -la "$OUTPUT_DIR"
 
 # The secret counterpart of near_account_public_key.pub is not part of
-# public_data: it must be exported from the node (secrets.json in the node
-# home dir) by whoever regenerates the assets. Without it, the sandbox tests
-# that sign as the fixture account cannot run (issue #3787).
-if [ ! -f "$OUTPUT_DIR/near_account_secret_key" ]; then
-    echo ""
-    echo "WARNING: '$OUTPUT_DIR/near_account_secret_key' is missing."
-    echo "Copy the node's NEAR signer secret key (ed25519:<base58>, one line) there,"
-    echo "or the fixture keypair will drift apart. See README.md."
-fi
+# public_data: it must be exported from the node (secrets.json in the node home
+# dir) by whoever regenerates the assets. It is committed, so it is normally
+# present but stale — hence an unconditional reminder rather than an
+# existence check. A mismatched pair fails the sandbox tests that sign as the
+# fixture account.
+echo ""
+echo "REMINDER: replace '$OUTPUT_DIR/near_account_secret_key' with the secret key of"
+echo "the node you just extracted from (ed25519:<base58>, one line). It must pair with"
+echo "the freshly written near_account_public_key.pub. See README.md."

crates/test-utils/assets/create-assets.sh

@@ -1 +1 @@
-ed25519:rS6SmFPPaViyKph7Uapy4Gb8ZfBHwmRMCEUfgmpAYyi8hdgkeKpVMPJDwaQjp6GrkdCgViKRy7hrjUmJwarZcLR
+ed25519:rS6SmFPPaViyKph7Uapy4Gb8ZfBHwmRMCEUfgmpAYyi8hdgkeKpVMPJDwaQjp6GrkdCgViKRy7hrjUmJwarZcLR

crates/test-utils/assets/near_account_secret_key

@@ -69,5 +69,11 @@ OS_IMAGE=dstack-dev-0.5.8
 # Path of the user_config file
 USER_CONFIG_FILE_PATH=user-config.toml
 
+# Leave unset. A pre-launch script runs as root inside the CVM, and attestation
+# verification rejects any app-compose carrying one, so the CVM cannot join the
+# network. Only fixture collection sets this; see
+# localnet/tee/scripts/rust-launcher/README.md
+#PRELAUNCH_SCRIPT=
+
 # for testing use a smaller disk size 128G
 DISK=1000G

deployment/cvm-deployment/default.env

@@ -162,6 +162,14 @@ USER_CONFIG_FILE_PATH=user-config.toml
 DISK=1000G
 ```
 
+> **Never set `PRELAUNCH_SCRIPT` for a real deployment.** It bakes a script into
+> the app-compose that runs as root inside the CVM before the node starts.
+> Attestation verification rejects any app-compose carrying one, so such a CVM
+> can never join the network; it exists only to collect test fixtures (see
+> `localnet/tee/scripts/rust-launcher/README.md`). The `.env` file is sourced
+> under `set -a`, so a leftover line takes effect silently — `deploy-launcher.sh`
+> prints a warning when it finds one.
+
 ---
 
 Based on: [Original Dstack deploy script](https://github.com/Dstack-TEE/dstack/blob/be9d0476a63e937eda4c13659547a25088393394/kms/dstack-app/deploy-to-vmm.sh)