GeezerVison

Update dstack/ and corresponding refactor

- Consolidate four separate image recipes (dstack-cloud-rootfs,
  dstack-dev-rootfs, dstack-cloud-nvidia-rootfs, dstack-nvidia-dev-rootfs)
  into a single dstack-rootfs.bb with conditional includes
- Add multiconfig support with separate TMPDIR per flavor to avoid
  build conflicts
- Build flavors serially in Makefile to avoid BitBake runqueue deadlock
- Update mkimage.sh to support --flavor parameter for multiconfig builds
- Copy multiconfig to new build directories in dev-setup

- Move local.conf and multiconfig/ to meta-dstack/conf/
- Update dev-setup to always sync config to build directory
- bb-build is now fully excluded from git (build artifact only)

- dstack-0.6.0/ -> dstack-cloud-0.6.0/
- dstack-nvidia-0.6.0.tar.gz -> dstack-cloud-nvidia-0.6.0.tar.gz
- Update download URL to meta-dstack-cloud repo

Move write_authenticode_hash_if_missing call to main flow instead of
only in create_gcp_artifacts. This ensures the hash file is always
generated when UKI exists, regardless of GCP image creation.

Add an nvattest recipe building NVIDIA's attestation-sdk CLI (pinned
SRCREV, Apache-2.0). GPU TEE attestation runs inside `dstack-util setup`
(dstack-prepare.service), driven by the app-compose requirement
`requirements.verify_gpu` (default true): the conf-compute ready state
is set only after nvattest succeeds (previously nvidia-persistenced set
it unconditionally), and attestation failure -- including a non-CC GPU
or CC mode left off by the host -- aborts boot before key provisioning.
Deployments can opt out with `requirements.verify_gpu: false`, which
sets the ready state without verification.

The recipe ships only the CLI plus a dstack-prepare.service ordering
drop-in (After=nvidia-persistenced/nvidia-fabricmanager); there is no
dedicated attestation service or unit gating. GPU-less instances are
unaffected (dstack-util skips when no NVIDIA GPU is on the PCI bus).

Build notes:
- regorus (Rego engine, Rust) is embedded via Corrosion; use the
  prebuilt meta-rust-bin toolchain (cargo-bin-native), with host/target
  linker split for cargo build scripts (host triple == target triple)
- USE_SYSTEM_DEPS=ON: link sysroot openssl/curl/libxml2/xmlsec1 instead
  of ExternalProject-downloaded copies
- RUSTFLAGS remap-path-prefix keeps build paths out of libnvat
  ([buildpaths] QA / reproducible builds)
- only nvattest + libnvat are shipped; cargo proc-macro dylibs are
  excluded from the image

meta-nvidia: gate GPU ready state on local TEE attestation (nvattest)

Repair guest OS and SDK entrypoints, make release image selection safe, and relocate imported helpers to clear ownership boundaries. Document the multi-source docker-compose fetch behavior and validate release artifacts before publishing.

Keep the repository-wide Rust pin at the monorepo root so both the core workspace and SDK simulator inherit Rust 1.92. Update the CI action refs to the same toolchain and clean simulator sockets after core tests.

Copilot AI left a comment