Repository navigation
fix(kms): drop the legacy KMS compose that misses the emSign fixes - #1492
Merged
Merged
Conversation
dstack-app/docker-compose.yaml built dstack-kms from commit 78057c9 (2025-01), which locks rustls-webpki 0.102.8 and webpki-roots 0.26.6, and ran both kms and helios in the rust:1.92.0 image whose ca-certificates 20250419 still trusts emSign ECC Root CA - G3. helios (pinned at 5c61864a) also uses native-tls and webpki-roots 0.24/0.26.6 to reach public Ethereum RPCs over HTTPS. No script or workflow uses this file; deploy-to-vmm.sh deploys compose-dev.yaml, which runs the released KMS image. Remove the file and point the README at compose-dev.yaml instead. Signed-off-by: Kevin Wang <wy721@qq.com>
Collaborator
Author
kvinwang
enabled auto-merge
October 28, 2026 09:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dstack/kms/dstack-app/docker-compose.yamlis the KMS example linked fromdstack/kms/README.md. It still trusts certificates from the compromised eMudhra/emSign intermediate CAs:78057c97(2025-01), which locks rustls-webpki 0.102.8 and webpki-roots 0.26.6. It runs inrust:1.92.0, whoseca-certificates 20250419still has emSign ECC Root CA - G3.5c61864a(native-tls, webpki-roots 0.24/0.26.6) in the same image. It reaches the consensus and execution RPCs over public HTTPS.#1466 only bumped auth-api in this file.
Changes
dstack-app/docker-compose.yaml. No script, workflow or doc other than the README references it.compose-dev.yaml(deployed bydeploy-to-vmm.sh), which runs the released KMS image built from the pinned builder.Follow-up
The default KMS/gateway image digests (
DEFAULT_KMS_IMAGEin dstack-cli-core,deploy-*.sh) still point at pre-fix releases. Bump them once images with #1463/#1464 are published.