From 308ad3a9a167d8da1f6253bb53370c59cdffea39 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Wed, 29 Jul 2026 05:40:25 +0000 Subject: [PATCH] fix(kms): reject repeated onboarding --- dstack/kms/src/onboard_service.rs | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/dstack/kms/src/onboard_service.rs b/dstack/kms/src/onboard_service.rs index a2d1a8a4f..0c9b4dd6a 100644 --- a/dstack/kms/src/onboard_service.rs +++ b/dstack/kms/src/onboard_service.rs @@ -160,6 +160,11 @@ impl OnboardRpc for OnboardHandler { async fn onboard(self, request: OnboardRequest) -> Result { validate_onboarding_domain(&request.domain)?; + let _bootstrap_guard = self.state.bootstrap_lock.lock().await; + let cfg = &self.state.config; + if cfg.root_ca_key().exists() || cfg.k256_key().exists() { + bail!("KMS has already been onboarded"); + } let source_url = request.source_url.trim_end_matches('/').to_string(); let source_url = if source_url.ends_with("/prpc") { source_url @@ -167,7 +172,7 @@ impl OnboardRpc for OnboardHandler { format!("{source_url}/prpc") }; let keys = Keys::onboard( - &self.state.config, + cfg, &source_url, &request.domain, self.state.attestation_verifier.clone(), @@ -175,8 +180,7 @@ impl OnboardRpc for OnboardHandler { .await .context("Failed to onboard")?; let k256_pubkey = keys.k256_key.verifying_key().to_sec1_bytes().to_vec(); - keys.store(&self.state.config) - .context("Failed to store keys")?; + keys.store(cfg).context("Failed to store keys")?; Ok(OnboardResponse { k256_pubkey }) }