[kvinwang]

STACKED PR — merge #883 first.

Problem

Certificate and private key were replaced as separate writes. A crash or reader between the writes could observe a new certificate paired with the old key, causing TLS loading and handshakes to fail.

Root cause and fix

Stage the matching certificate/key outputs together and publish the pair through an atomic commit sequence.

Implementation

The branch records the following focused implementation work:

• fix(util): stage certificate and key together

Changed paths:

• dstack/crates/dstack-cli-core/src/fsutil.rs
• dstack/dstack-util/src/main.rs

Scope

This PR addresses one logical util finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

• Parent PR: fix(guest): write generated credentials atomically #883
• GitHub base branch: codex/fix-guest-atomic-credentials
• Merge the parent first; this PR contains only the additional delta above that parent.

Verification

• git diff --check origin/codex/fix-guest-atomic-credentials..origin/codex/fix-util-atomic-cert-key: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kvinwang]

Closing because staging two files and renaming them sequentially does not make the certificate/key pair atomic: a crash, reader, or second rename failure can still observe a new certificate with the old key. The related #841 case was updated to validate certificate/key binding, permissions, individual output failures, and retry without asserting unsupported two-file transaction semantics.