Apache Teaclave™ TrustZone SDK v0.10.0

Summary

SDK v0.10.0 targets OP-TEE 4.11.0 (released 2026-10-16), and the bundled optee-* crates are now at 0.10.0. The upgrade inherits OP-TEE's security fixes for this cycle, most notably hardening of the ECDH key-derivation path. Two additional fixes (CVE-2026-40290, CVE-2026-45702) concern the FF-A SPMC and therefore only affect configurations that use the SPMC; standard TA/CA deployments are unaffected.
It also exposes the PBKDF2-HMAC key derivation from OP-TEE 4.11 — Pbkdf2HmacSha1/224/256/384/512/Sm3 (Sha1 pre-existed; the rest are new in 4.11) — together with the password object type and its attributes.
Beyond the version bump, this release reworks several public APIs — some of them breaking, with migration guides under docs/: typed TA parameters, copy-based memref access, and consolidated error handling.

⚠️ Breaking changes / upgrade notes

Read these before upgrading; each of them can break existing TA/CA code at compile time:

• Typed parameter API: Parameters/Parameter moved, macros now go through FromRawParameters — see docs/optee-utee-parameter-migration.md (includes a migration checklist).
• Copy-based memref access: unsafe get_buffer/get_buffer_mut removed in favor of read_to_vec/read_at/set_output/write_at — see docs/ copy-based memref description.
• LoginType and ConnectionMethods gained Unknown(u32) variants — exhaustive matches need a new arm.
• AlgorithmId/TransientObjectType/AttributeId gained PBKDF2 variants — same exhaustive-match caveat.
• optee-utee-macros now enforces session-context type consistency across open/close/invoke at compile time.
• optee-utee-sys is hidden behind optee_utee::raw; the build_with_optee_utee_sys examples were removed.
• environment re-derives TARGET_* from ARCH_/STD and unsets several CROSS_COMPILE_/FEATURES variables — custom build scripts may need adjusting, see docs/migrating-to-new-building-env.md.
• Session is intentionally Send but not Sync; Context moved from Rc<RefCell<>> to Arc<Mutex<>>.
• Toolchain is now nightly-2026-08-05; examples were reorganized into examples/ta + examples/ca workspaces.

What's Changed

🚀 Features

• optee-utee: expose PBKDF2 key derivation from OP-TEE 4.11
• optee-teec: add bidirectional memory reference support
• optee-utee: add ParameterMemref trait
• utee: export define_property_key and update set_key_2
• utee: Enhancement for Object APIs
• optee-utee: introduce typed parameter API with FromRawParameter trait
• optee-utee: use num_enum for conversion between ParamType and u32
• optee-teec: make Context and Session Send without hand-written impls
• optee-utee: represent unknown login types instead of panicking
• optee-teec: use explicit TEEC_LOGIN_* codes for ConnectionMethods
• optee-utee-macros: enforce TA session context type consistency
• cargo-optee: parse TA and plugin UUIDs from the unsigned ELF
• cargo-optee: set CROSS_COMPILE for TA build commands
• cargo-optee: support standard OP-TEE environment paths
• optee-utee-build: append OP-TEE libraries after Rust dependencies

🐛 Bug Fixes

• BigInt: Several fixes for BigInt arithmetic
• optee-utee-build: escape config strings into generated TA header (security: fixes TA-header string injection in build-time codegen)
• optee-utee: safety of memref shared-memory access
• examples: secure_storage-rs: avoid persistent reads into shared memory
• optee-utee: fix TA session parameter lifetime and cleanup
• optee-utee, optee-teec: preserve raw code in ErrorKind::Unknown
• optee-utee: resolve socket errors through the owning protocol
• optee-utee: fix socket doctest with std enabled
• optee-teec: fix bugs of ParamTypes::into_flags
• optee-utee: correct return type in property for binary version

⚙️ Refactoring

• optee-utee: remove get_buffer accessors
• examples, projects: use copy-based memref access
• examples, projects: migrate to typed parameter API
• optee-utee, optee-teec: consolidate error handling and result plumbing
• secure_db, rustls_provider: simplify storage and time conversions
• optee-utee-build, optee-teec-build, optee-teec-systest: simplify build helpers
• refactor: hide low-level OP-TEE dependencies
• build(deps): centralize and update workspace dependencies
• examples: reorganize crates into TA and CA workspaces
• environment: re-derive TARGET_* from ARCH_*/STD
• examples: drop uuid.txt and wrap Make with cargo-optee

🔧 Build / CI

• release: fix crates path for publish script (#302)
• scripts: fix stat command compatibility for Linux in release script
• optee-teec-macros: remove cyclic dev-dependency and fix doc examples
• ci: update GitHub Actions versions and unify reusable workflow names
• ci: drop dedicated cargo-optee example jobs
• ci, tests: remove obsolete expect script and cleanup helper
• std: update Rust toolchain to nightly-2026-08-05
• Set up default protection ruleset for default and release branches (#300)
• ci: add optee-version input to QEMU image build
• release: bump to v0.10.0 for OP-TEE 4.11.0

📝 Documentation

• docs: add security model describing trust boundaries and TCB (#305)
• Add AGENTS.md with security-model link for agent discoverability (#307)
• docs: add TA parameter migration guide
• docs: describe copy-based memref API
• docs: describe Makefile builds through cargo-optee
• docs: fix quickstart Hello World commands, paths and links
• docs: update parameter module path in security model table
• docs: add AI development guide and link it from AGENTS.md

New Contributors

• @manoj23 made their first contribution in #283
• @asf-gitbox-commits made their first contribution in #300
• @potiuk made their first contribution in #307

Full Changelog: v0.9.0...v0.10.0-rc.1