Skip to content

KMS Release v0.6.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Nov 02:28
kms-v0.6.3
dad8326
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes since 0.6.1

  • Always verify the OS image hash and its policy/identity-event bindings; remove the [core.image] verify bypass (#1497).
  • Recover onboarding after repeated clicks, lost provisioning responses, or a page reload using Onboard.GetSetupStatus (#1453).
  • Fix measurement-cache clearing to remove the actual .json entries (#1471).
  • Verify guest NUMA layouts without PXB expanders (#1458).
  • Coalesce concurrent AMD endorsement-certificate fetches and preserve typed collateral errors (#1484).
  • Harden TPM response parsing against undersized headers, excessive allocations and non-progressing enumeration (#1477, #1481).
  • Refresh CA trust and TLS dependencies for emSign distrust; remove the legacy compose file that pinned outdated images (#1463, #1464, #1492).
  • Add the Bun auth-eth image build, bound its request bodies and set security headers; increase the Bun auth webhook idle timeout and update auth-backend dependencies (#1452, #1460, #1470, #1494).

Upgrade notes

OS image verification is mandatory. A leftover [core.image] verify key is ignored, and GetMeta.os_image_verification always reports true. Upgrade KMS before admitting CVMs whose NUMA nodes omit pxb_bus; older KMS versions reject that configuration.

Reproducibility

An independent public clone of this tag reproduced the published image digest.
Set umask 0022 before cloning, then follow this component's builder README
with IMAGE_VERSION=0.6.3 and the matching release tag/commit. A checkout created
under umask 0002 can give copied files group-write permissions and produce a
different digest despite identical contents. Setting the umask only after cloning
does not repair those permissions; use a fresh clone under umask 0022.

umask 0022
git clone --branch kms-v0.6.3 https://github.com/Dstack-TEE/dstack.git

Source

Tag: kms-v0.6.3 · Commit: dad8326f89a76e60e5d4b61c424a3329c92f60e9.

Docker Image Information

Image: ghcr.io/dstack-tee/dstack-kms:0.6.3

Digest (SHA256): sha256:e68766063cb3e792a85919ad500d16805b57f8d8b7424b71ff46a3c8cf5709fd

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

  • DstackKms.json - Main KMS contract ABI
  • DstackApp.json - Application contract ABI
Assets 4
Loading