refactor: adopt monorepo layout#770
Merged
Merged
Conversation
Update dstack/ and corresponding refactor
- Consolidate four separate image recipes (dstack-cloud-rootfs, dstack-dev-rootfs, dstack-cloud-nvidia-rootfs, dstack-nvidia-dev-rootfs) into a single dstack-rootfs.bb with conditional includes - Add multiconfig support with separate TMPDIR per flavor to avoid build conflicts - Build flavors serially in Makefile to avoid BitBake runqueue deadlock - Update mkimage.sh to support --flavor parameter for multiconfig builds - Copy multiconfig to new build directories in dev-setup
- Move local.conf and multiconfig/ to meta-dstack/conf/ - Update dev-setup to always sync config to build directory - bb-build is now fully excluded from git (build artifact only)
- dstack-0.6.0/ -> dstack-cloud-0.6.0/ - dstack-nvidia-0.6.0.tar.gz -> dstack-cloud-nvidia-0.6.0.tar.gz - Update download URL to meta-dstack-cloud repo
Move write_authenticode_hash_if_missing call to main flow instead of only in create_gcp_artifacts. This ensures the hash file is always generated when UKI exists, regardless of GCP image creation.
Add an nvattest recipe building NVIDIA's attestation-sdk CLI (pinned SRCREV, Apache-2.0). GPU TEE attestation runs inside `dstack-util setup` (dstack-prepare.service), driven by the app-compose requirement `requirements.verify_gpu` (default true): the conf-compute ready state is set only after nvattest succeeds (previously nvidia-persistenced set it unconditionally), and attestation failure -- including a non-CC GPU or CC mode left off by the host -- aborts boot before key provisioning. Deployments can opt out with `requirements.verify_gpu: false`, which sets the ready state without verification. The recipe ships only the CLI plus a dstack-prepare.service ordering drop-in (After=nvidia-persistenced/nvidia-fabricmanager); there is no dedicated attestation service or unit gating. GPU-less instances are unaffected (dstack-util skips when no NVIDIA GPU is on the PCI bus). Build notes: - regorus (Rego engine, Rust) is embedded via Corrosion; use the prebuilt meta-rust-bin toolchain (cargo-bin-native), with host/target linker split for cargo build scripts (host triple == target triple) - USE_SYSTEM_DEPS=ON: link sysroot openssl/curl/libxml2/xmlsec1 instead of ExternalProject-downloaded copies - RUSTFLAGS remap-path-prefix keeps build paths out of libnvat ([buildpaths] QA / reproducible builds) - only nvattest + libnvat are shipped; cargo proc-macro dylibs are excluded from the image
meta-nvidia: gate GPU ready state on local TEE attestation (nvattest)
Repair guest OS and SDK entrypoints, make release image selection safe, and relocate imported helpers to clear ownership boundaries. Document the multi-source docker-compose fetch behavior and validate release artifacts before publishing.
Keep the repository-wide Rust pin at the monorepo root so both the core workspace and SDK simulator inherit Rust 1.92. Update the CI action refs to the same toolchain and clean simulator sockets after core tests.
Copilot stopped reviewing on behalf of
kvinwang due to an error
July 13, 2026 01:37
This was referenced Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dstack/and merge themeta-dstackhistory underos/yocto/os/image/, Yocto-only helpers underos/yocto/, isolated legacy host/QEMU tools underos/yocto/tools/, and repository utilities undertools/dstackupBuild and migration notes
make osis the native default guest-OS build, whilemake os-imageremains the reproducible container entrypointdo_fetchtask, and completed downloads resume from the cacheValidation
make os— full native Yocto build, bare and UKI archives generatedmake core-checkmake core-testmake sdk-test/ direct root invocation of./sdk/run-tests.shcargo test --manifest-path dstack/Cargo.toml -p dstackup(17 passed)prek runon all changed filesreuse lintNon-blocking note
The existing JavaScript dependency tree reports 1 low and 3 moderate
npm auditfindings; all 99 JavaScript tests pass and this PR does not change those dependencies.