From cef7bca0d2682fab351cf0ef3bf0de78de527ee5 Mon Sep 17 00:00:00 2001
From: Kevin Wang <wy721@qq.com>
Date: Thu, 26 Mar 2026 13:55:54 +0000
Subject: [PATCH] fix: enforce 20-byte app_id length in system_setup

---
 dstack-util/src/system_setup.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dstack-util/src/system_setup.rs b/dstack-util/src/system_setup.rs
index 2bc0a097..b7f59cfd 100644
--- a/dstack-util/src/system_setup.rs
+++ b/dstack-util/src/system_setup.rs
@@ -1288,6 +1288,12 @@ impl<'a> Stage0<'a> {
         if instance_info.app_id.is_empty() {
             instance_info.app_id = truncated_compose_hash.to_vec();
         }
+        if instance_info.app_id.len() != 20 {
+            bail!(
+                "Invalid app id length: expected 20 bytes, got {}",
+                instance_info.app_id.len()
+            );
+        }
 
         let disk_reusable = !key_provider.is_none();
         if (!disk_reusable) || instance_info.instance_id_seed.is_empty() {