dstack v0.6.1

dstack 0.6.1 is a security release. Upgrade the guest OS, KMS, and verifier; the Gateway is rebuilt for version parity.

Components

Component	Release	Image
Guest OS	mkosi-os-v0.6.1	os_image_hash: ec43cb8c5e04b6bb6c53b33b16076a01d83d01f7f4b703f2f78a0d947d6247e6
KMS	kms-v0.6.1	ghcr.io/dstack-tee/dstack-kms:0.6.1@sha256:a666dbe61b7312ca95c9777ff4614e1dbc85d75cb72acd22c2b972b6488de5e5
Gateway	gateway-v0.6.1	ghcr.io/dstack-tee/dstack-gateway:0.6.1@sha256:d99e156cb002591fe65716b0eed232ca4eea199d25f1fce55dd5274ba608ff32
Verifier	verifier-v0.6.1	ghcr.io/dstack-tee/dstack-verifier:0.6.1@sha256:9f2c07a94efd3d8a1a89268e5faa35e91e3cb345b9c4ab859c86d35142f4f788

Security fixes

• guest-agent: /logs/<container_name> now rejects names that are not
  valid Docker container names, so a crafted name can no longer reach a
  different Docker API endpoint (#1442)
• KMS and verifier: a request vm_config must match the copy embedded in
  the attestation, and a config has a single layout. On AMD SEV-SNP the
  competing copies let a certificate request pass authorization with one
  os_image_hash while the issued certificate claimed another (#1430)

Other changes

• verifier: measure multi-node NUMA layouts of hugepage VMs, with the VMM
  recording the memory QEMU actually allocates so such VMs now verify (#1418),
  and root-bus devices added by a qemu_path wrapper via
  vm_config.extra_root_devices (#1424)
• vmm: passt networking is back, with each passt running as a sidecar of
  the VM launcher (#1422, #1423)
• vmm: per-VM annotations for host-side tooling (#1419, #1421)
• dependency, CI, and documentation updates

Upgrade notes

• Register the 0.6.1 os_image_hash on chain before deploying 0.6.1
  guest images

Full changelog: CHANGELOG.md