feat: on-chain TCB policy with dcap-qvl two-phase verification

.github/workflows/rust.yml

@@ -30,6 +30,3 @@ jobs:
 
     - name: Cargo fmt check
       run: cargo fmt --check --all
-
-    - name: Run tests
-      run: ./run-tests.sh

.github/workflows/tests.yml

@@ -0,0 +1,76 @@
+# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Tests
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ master, next, dev-* ]
+  pull_request:
+    branches: [ master, next, dev-* ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust-tests:
+    name: Rust tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+
+      - name: Run tests
+        run: ./run-tests.sh
+
+  auth-eth-tests:
+    name: auth-eth tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+          cache-dependency-path: kms/auth-eth/package-lock.json
+
+      - name: Install dependencies
+        run: |
+          cd kms/auth-eth
+          npm ci
+
+      - name: Run tests
+        run: |
+          cd kms/auth-eth
+          npm test
+
+  kms-e2e-tests:
+    name: KMS E2E tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: 'npm'
+          cache-dependency-path: kms/auth-eth/package-lock.json
+
+      - name: Run KMS E2E tests
+        run: bash kms/e2e/run-e2e.sh

Cargo.toml

@@ -53,6 +53,7 @@ members = [
     "no_std_check",
     "size-parser",
     "port-forward",
+    "kms/e2e",
 ]
 resolver = "2"
 
@@ -177,7 +178,7 @@ url = "2.5"
 # Cryptography/Security
 aes-gcm = "0.10.3"
 curve25519-dalek = "4.1.3"
-dcap-qvl = "0.3.10"
+dcap-qvl = { git = "https://github.com/Phala-Network/dcap-qvl", branch = "policy" }
 elliptic-curve = { version = "0.13.8", features = ["pkcs8"] }
 getrandom = "0.3.1"
 hkdf = "0.12.4"