refactor(kms-auth)!: slim DstackKms bytecode

CHANGELOG.md

@@ -82,8 +82,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - DstackKms, DstackApp: material approvals are per epoch. A request is decided
   on the row of the epoch it selects, so a value is revoked only once every row
   allowing it is cleared. Material setters name their rows:
-  `*AtEpoch(epoch, value)` writes one epoch, `*AtEpochs(from, to, value)` a
-  range; `remove*AtEpochs(0, latest root epoch, value)` in `DstackKms` and
+  `*AtEpochs(from, to, value)` writes a range, and in `DstackApp`
+  `*AtEpoch(epoch, value)` one epoch (in `DstackKms`, pass the epoch twice);
+  `remove*AtEpochs(0, latest root epoch, value)` in `DstackKms` and
   `remove*AtEpochs(0, currentAppEpoch, value)` in `DstackApp` revoke a value
   everywhere. `DstackApp` reports its setters as the new ERC-165 interface
   `IAppEpochManagement` (`0x8c0524c4`). The `Manage.s.sol` scripts require
@@ -124,12 +125,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `ghcr.io/dstack-tee/dstack-kms-auth-eth-bun` remain available. Update image
   references and source paths in deployments.
 
+- **Breaking:** DstackKms: reverts with custom errors such as
+  `UnknownRootEpoch()` instead of revert strings, to stay under the EIP-170
+  size limit. This includes `registerApp`, `setAppImplementation` and
+  `deployAndRegisterApp`, whose v0.6.0 strings (`Invalid app ID`, `Invalid
+  implementation address`, `DstackApp implementation not set`, `Invalid owner
+  address`) become `InvalidAppId()`, `InvalidImplementationAddress()`,
+  `AppImplementationNotSet()` and `InvalidOwnerAddress()`; tooling that
+  matches the strings must decode the errors. Authorization rejection reasons
+  are unchanged.
+
 ### Removed
 
 - DstackKms: the epoch-less `addOsImageHash`, `removeOsImageHash`,
   `addKmsAggregatedMr`, `removeKmsAggregatedMr`, `addKmsDevice` and
-  `removeKmsDevice`. Use the `*AtEpoch` or `*AtEpochs` forms; before any
-  rotation, `addOsImageHashAtEpoch(0, hash)` is the old call.
+  `removeKmsDevice`. Use the `*AtEpochs` forms; before any rotation,
+  `addOsImageHashAtEpochs(0, 0, hash)` is the old call.
 - **Breaking:** DstackApp: the epoch-less `addComposeHash`, `removeComposeHash`,
   `addDevice` and `removeDevice`, and with them
   `IAppAuthBasicManagement`: an upgraded app no longer reports interface ID

docs/app-key-epochs.md

@@ -64,9 +64,10 @@ the old row after the handover. The old image never needs access to the new row.
 
 A request may select any epoch up to the current one and is decided on that
 epoch's row, so a value is revoked only once every row allowing it is cleared.
-Neither contract has epoch-less material setters: `*AtEpoch(epoch, material)`
-changes one row and `*AtEpochs(fromEpoch, toEpoch, material)` every row in the
-range, so one transaction revokes a value from all rows, with
+Neither contract has epoch-less material setters:
+`*AtEpochs(fromEpoch, toEpoch, material)` changes every row in the range, and in
+`DstackApp` `*AtEpoch(epoch, material)` one row (in `DstackKms`, pass the epoch
+twice). One transaction revokes a value from all rows, with
 `remove*AtEpochs(0, latest, …)` in `DstackKms` and
 `remove*AtEpochs(0, currentAppEpoch, …)` in `DstackApp`. `DstackKms` writes
 registered root epochs (before any is registered, only epoch zero); `DstackApp`

docs/formal/key-rotation/EpochPolicy.tla

@@ -7,7 +7,7 @@
 (* on the selected rows.                                                   *)
 (*                                                                         *)
 (* Root side (DstackKms): one row of allowed values (OS images; KMS MRs   *)
-(* and devices alike) per root epoch, written by *AtEpoch(s) over a range *)
+(* and devices alike) per root epoch, written by *AtEpochs over a range   *)
 (* of registered rows. A pending epoch can be popped and registered again, *)
 (* with the same or other keys. Rows are keyed by registration            *)
 (* (RootEpoch.registration); KeyByChainHash = TRUE models the earlier     *)
@@ -77,7 +77,7 @@ Pop ==
     /\ regs' = SubSeq(regs, 1, Latest)
     /\ UNCHANGED <<nextReg, cur, rows, revoked, appVars, ghostVars>>
 
-\* add*AtEpochs / remove*AtEpochs(from, to, v); *AtEpoch is from = to.
+\* add*AtEpochs / remove*AtEpochs(from, to, v); one row is from = to.
 Write(from, to, v, allowed) ==
     /\ from <= to /\ to <= Latest
     /\ LET written == {<<RowKey(keys, regs, e), v>>: e \in from..to}

docs/tutorials/gateway-build-configuration.md

@@ -278,7 +278,7 @@ echo "OS image hash: 0x$OS_IMAGE_HASH"
 ```
 
 ```bash
-cast send "$KMS_CONTRACT_ADDR" "addOsImageHashAtEpoch(uint256,bytes32)" 0 "0x$OS_IMAGE_HASH" --rpc-url "$ETH_RPC_URL" --private-key "$PRIVATE_KEY"
+cast send "$KMS_CONTRACT_ADDR" "addOsImageHashAtEpochs(uint256,uint256,bytes32)" 0 0 "0x$OS_IMAGE_HASH" --rpc-url "$ETH_RPC_URL" --private-key "$PRIVATE_KEY"
 ```
 
 Verify it was added:

docs/tutorials/troubleshooting-gateway-deployment.md

@@ -141,8 +141,8 @@ echo "OS image hash: 0x$OS_IMAGE_HASH"
 # Whitelist it on the KMS contract
 export KMS_CONTRACT_ADDR=$(cat ~/.dstack/secrets/kms-contract-address)
 cast send "$KMS_CONTRACT_ADDR" \
-  "addOsImageHashAtEpoch(uint256,bytes32)" \
-  0 "0x$OS_IMAGE_HASH" \
+  "addOsImageHashAtEpochs(uint256,uint256,bytes32)" \
+  0 0 "0x$OS_IMAGE_HASH" \
   --rpc-url "https://ethereum-sepolia-rpc.publicnode.com" \
   --private-key "$(cat ~/.dstack/secrets/sepolia-private-key)"
 ```

dstack/kms/auth-eth/README.md

@@ -332,8 +332,9 @@ See `script/README.md` for complete documentation of all available scripts.
 #### Epoch-scoped material approvals
 
 Material approvals use exact root/app epoch rows; neither older nor newer rows
-are implicitly authorized. Material setters name their rows: `*AtEpoch` one
-row, `*AtEpochs` a range; `DstackApp` reports them as `IAppEpochManagement`.
+are implicitly authorized. Material setters name their rows: `*AtEpochs` a
+range, and in `DstackApp` `*AtEpoch` one row; `DstackApp` reports them as
+`IAppEpochManagement`.
 The management scripts take `ROOT_EPOCH`/`APP_EPOCH`, or
 `FROM_ROOT_EPOCH`/`TO_ROOT_EPOCH` and `FROM_APP_EPOCH`/`TO_APP_EPOCH`, and use
 the epoch-less setters of app policies predating app epochs. Original bool mappings and events remain epoch-zero views after