From adee871599d3abd8f49e57b89bde66aa08a528ac Mon Sep 17 00:00:00 2001
From: Kevin Wang <wy721@qq.com>
Date: Fri, 13 Nov 2026 02:48:37 -0800
Subject: [PATCH] feat(image): declare SealedEnv support in metadata.json

A 0.6.4 VMM stores the env a guest re-seals to the current KMS key epochs
only for an image that declares sealed_env. The guest support comes with
Dstack-TEE/dstack#1574; bump the dstack submodule to a commit including it
before releasing an image with this change.

Signed-off-by: Kevin Wang <wy721@qq.com>
---
 mkimage.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mkimage.sh b/mkimage.sh
index a66e1cb..64f541d 100755
--- a/mkimage.sh
+++ b/mkimage.sh
@@ -100,7 +100,8 @@ cat <<EOF > ${OUTPUT_DIR}/metadata.json
     "shared_ro": true,
     "is_dev": ${IS_DEV},
     "ovmf_variant": "$OVMF_VARIANT",
-    "kernel_header_normalized": true
+    "kernel_header_normalized": true,
+    "sealed_env": true
 }
 EOF