Skip to content

v0.2.1

Latest
Latest

Choose a tag to compare

View all tags
@matzapata matzapata released this 26 Sep 16:39
· 0 commits to develop since this release
v0.2.1
6aa33bd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nitrum 0.2.1

Reliability and diagnosability patch: crash-loop detection in the control-plane, fatal-error telemetry that actually flushes, clearer KMS AccessDenied diagnostics, and a KMS permissions guide.

Highlights

  • Crash-loop detection — control-plane watches describe-enclaves after run-enclave for a settle window instead of a fixed warmup sleep; an early disappearance is reported as exited_before_stable and does not reset backoff
  • Fatal telemetry flush — data-plane and control-plane install a stdout tracing subscriber before networking/IMDS/SSM and return ExitCode (no process::exit), so exporters flush on exit and full error chains are logged
  • KMS diagnostics — attested KMS Decrypt AccessDenied is logged once per boot with the key id, ImageSha384 / PCR0 and optional NSM PCR0
  • Docs — new KMS permissions and troubleshooting guide (docs/kms.md)

Security

  • h2 0.4 updated to a patched release (RUSTSEC-2026-0258) and rustls 0.23 refreshed
  • cargo-deny ignores RUSTSEC-2026-0258 for h2 0.3, which the AWS SDK still pulls in and which has no upstream patch

Upgrading

nitrum init pins the runtime images to @sha256: digests in nitrum.toml, so existing projects keep running the 0.2.0 control-plane and data-plane until you re-pin [runtime] control_plane and data_plane to the v0.2.1 images (by tag or new digest).

Changing data_plane changes the EIF: run nitrum build and nitrum cloud deploy again. This updates PCR0 in the KMS key policy as usual (see docs/kms.md).

No breaking changes.

Install

curl -fsSL https://raw.githubusercontent.com/matzapata/nitrum/v0.2.1/scripts/install-nitrum.sh | NITRUM_VERSION=v0.2.1 sh

Full changelog: v0.2.0...v0.2.1

Assets 5
Loading