Skip to content

Releases

v0.9.1-rc1

v0.9.1-rc1 Pre-release
Pre-release

Choose a tag to compare

@smtmfft smtmfft released this 10 Oct 03:33
569e48b

raiko2 v0.9.1-rc1

Full ZK/runtime + TEE provider release candidate.

Summary

  • Release candidate from commit 569e48b3a4b074f4794157b01728f42d87f270bb.
  • Hardens proposal GuestInput handling by preserving positional state-pool indices, bounding the
    ancestor-header window before expensive guest validation, and rejecting missing witnesses early.
  • Replaces the previous 500000000 zkGas estimate-availability cap and local-evaluation fallback
    with a configurable warning-only threshold, defaulting to 1000000000. Proposal totals above the
    threshold remain on the extrapolated estimated-quote path.
  • Pins gaiko2 at aadf65d19ca5792fec288c701fb91c53a506487f, including Glamsterdam L1
    block-access-list hash support.
  • Publishes freshly built, officially signed TEE provider images for raiko2-sgx,
    raiko2-sgx-edmm, and gaiko2-sgxgeth.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:dfb2157b2d64eb0ed194b54f283addd875b6871fd43943a45f927305f1128ed4
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.9.1-rc1
  • commit: 569e48b3a4b074f4794157b01728f42d87f270bb
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0x1b5945ec67f17fae53bf037a7243730845c5855c4bb331f0490648aa6eb31ef9
  • risc0 aggregation image_id: 0x280e223094ced38d24ded624ee21b6c3c030e33a474f4bfc845bfef8909e2d32
  • sp1 proposal vk_bn254: 0x0013b23291909ab9f77c50a73bae45c03264090c94f0e5af8994a0c4055bf63d
  • sp1 proposal vk_hash_bytes: 0x09d919486426ae7d6f8a14e73ae45c031320486453c396be13294188055bf63d
  • sp1 aggregation vk_bn254: 0x0058dd7e60f98e76a002099e22ba0362fcccaf07e860ec5fa3227f284c4c56f7
  • sp1 aggregation vk_hash_bytes: 0x2c6ebf303e639da8004133c42ba0362f6665783f2183b17e4644fe504c4c56f7

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:98afd86e31aeed8c55ba640c465195e619b3024991c92fcdd7cd11545735a036
    • mr_enclave: 3aaa7b641704643132b9b306c3da0ef50266d1049c7f6f47bea43c3ffde29efa
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:7ec5e1877fd61219207593cfe7d828aab724476310ab543a6a2ddc0caa2d7f8a
    • mr_enclave: 8799b8067d65d18469d481701882baf7a86cc360572ab650b3b7c31dc552f3ff
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:e018ba6f7e01c94feea8bbf3c9e941b2dadc8797b7c16ddad64be471982ccee8
    • source commit: aadf65d19ca5792fec288c701fb91c53a506487f
    • mr_enclave: 86fbd544058a0aa6001437e1e35f9e41300fcfd6cd967c0ba805144a24c2e81a
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under
the sgx-release-signing environment.

Operator Note

This release changes all proposal and aggregation guest identities listed above, as well as the TEE
mr_enclave values. Before rolling out the runtime or provider images in an environment:

  • dry-run and register the new RISC0 proposal/aggregation image IDs and SP1 proposal/aggregation
    verification keys required by that environment;
  • register the new TEE mr_enclave values for every provider lane being rolled out; and
  • keep the v0.9.0 ZK identities and TEE measurements trusted until the rollback window closes, so a
    rollback can restore the complete v0.9.0 runtime/provider image set rather than a mixed release.

For Boundless proposal quotes, the warning threshold is observability only, not an accuracy or
availability boundary. The committed evaluation data includes a 21.9679% production-integer
overquote, and larger inputs are deliberately allowed to extrapolate. Operators requiring exact
local cycle sizing must set prover.risc0.boundless.batch_quote.strategy = "evaluated" before
upgrading; estimated intentionally skips that local proposal execution.

Registration, rollout, and removal of previous release identities are separate operator actions and
are not performed by this release cut.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.9.1-rc1
git checkout v0.9.1-rc1

just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.9.1-rc1/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON
byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key,
but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.9.1-rc1
git checkout v0.9.1-rc1

KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.9.1-rc1 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting
attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.9.1-rc1.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.9.1-rc1.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

Canary rollout and verifier registration are separate operator actions and are not performed by
this release cut.

v0.9.0

Choose a tag to compare

@smtmfft smtmfft released this 29 Sep 06:24
dcbfdec

raiko2 v0.9.0

Full ZK/runtime + TEE provider release.

Summary

  • Final release from commit dcbfdec7396c7e25a53ee26b43c55d58f63e0b81, following the v0.9.0-rc1 canary validation.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Updates the Taiko client protocol dependency to v2.3.0 and pins the merged gaiko2 provider source at commit a666927ac6fe5282e196fd54b132a4e00e8178f2.
  • Includes SP1 v6.8.1, Alethia Reth v1.4.1, Shasta beacon blob fetching through /eth/v1/beacon/blobs/{slot}?versioned_hashes=..., zkGas-based Boundless quote estimation, and queue wakeup isolation.
  • Publishes freshly built, officially signed TEE provider images for raiko2-sgx, raiko2-sgx-edmm, and gaiko2-sgxgeth.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:615c8ca72b7d657adc56ec73ea7fb4f871a2492ad9f4f49c2e98c91be2e89018
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.9.0
  • commit: dcbfdec7396c7e25a53ee26b43c55d58f63e0b81
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0x88712dad7dc78126ee7bb592282d3102569c706f1b9db80580a582e5ffd1dfb0
  • risc0 aggregation image_id: 0x04480b22e244d60165f3d0898bc61ea084d9c76221464a8a3c3343c74889040a
  • sp1 proposal vk_bn254: 0x0012b97234e59f2319d44202c7b093fed9c9a51b2068e38d26625c139d668c97
  • sp1 proposal vk_hash_bytes: 0x095cb91a3967c8c63a8840587b093fed4e4d28d901a38e344cc4b8271d668c97
  • sp1 aggregation vk_bn254: 0x0017912dfd72308e2e2cd4211b05ed73a97eb7f576816adec2606a37507de51e
  • sp1 aggregation vk_hash_bytes: 0x0bc896fe5c8c238b459a8423305ed73a4bf5bfab5a05ab7b04c0d46e507de51e

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:bf441a5fd406a29d025ac973047741fd436e5f5a9ebbf1de91ac99852a8f3da1
    • mr_enclave: feabd725eb5bb621b5c6a5071d1702bcbe06a643b42a0db8f381d5bc07dd81bf
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:8b8de3572a9e798226fb1b42623d59d1bf5ba80fbe79177be5c13b5d033ae77e
    • mr_enclave: 6f3c8c55ec62fe48b83e57463e8717aa9f8594418203c9520f0f80e6f4fc4d87
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:309afe801117934ad64906014c2cb049461f5c09ca2ff2a3d7d595ec64094886
    • source commit: a666927ac6fe5282e196fd54b132a4e00e8178f2
    • mr_enclave: 8c23c79045b9b6bb827eab208e0fe58d7446a57a55f3dfc825c90e904953105b
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.9.0
git checkout v0.9.0

just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.9.0/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.9.0
git checkout v0.9.0

KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.9.0 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.9.0.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.9.0.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

Canary rollout and verifier registration are separate operator actions and are not performed by this release cut.

v0.9.0-rc1

v0.9.0-rc1 Pre-release
Pre-release

Choose a tag to compare

@smtmfft smtmfft released this 28 Sep 01:13
c4825c5

raiko2 v0.9.0-rc1

Full ZK/runtime + TEE provider release candidate.

Summary

  • Release candidate from commit c4825c5d7e2b51abff5cb1ff09bca86e9df1609e.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Upgrades SP1 to v6.8.1 and Alethia Reth to v1.4.1.
  • Migrates Shasta beacon blob fetching to /eth/v1/beacon/blobs/{slot}?versioned_hashes=..., preserving input order and validating recomputed KZG commitments.
  • Adds zkGas-based Boundless quote estimation, version-offset support, aggregation estimates, and queue wakeup isolation.
  • Publishes freshly built, officially signed TEE provider images for raiko2-sgx, raiko2-sgx-edmm, and gaiko2-sgxgeth; the external provider is pinned to gaiko2 commit 240b4ba765136251629fcf507e0f2154dd77317f.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:41df977ef21c6fe3253e001211985b0d2ac78d8cd0190be78da3e7e4169f6659
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.9.0-rc1
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0x6016d9b774fdb7af1ac3194793039abb241ac869c856d15d2a0f5a5997e970ca
  • risc0 aggregation image_id: 0xc7a55544d3a96ec3953a5bd2705c42056e27757fd6ac72ca9b972931870f8a2a
  • sp1 proposal vk_bn254: 0x00609a2e8a5834a3675060fa8965315f3e978514aa49fe69f8f407e5d16b941f
  • sp1 proposal vk_hash_bytes: 0x304d1745160d28d96a0c1f51165315f374bc28a52927f9a771e80fcb516b941f
  • sp1 aggregation vk_bn254: 0x001047d2068ac6e9b57839a587b07a254ad724d69b69c10197c0d4d2660c2fba
  • sp1 aggregation vk_hash_bytes: 0x0823e90322b1ba6d2f0734b07b07a25456b926b46da704062f81a9a4660c2fba

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:4798744ba980c3d6db0ea41712a5a81f9df25300be6d213b4df55d5a9c17d6f8
    • mr_enclave: dc994928718200e16e0eb643486ea90e49970a897fd164e39b6ae11262b69ab9
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:7e358a426918982ad85e90309c3e1277997f1b6bfa775e2b46b62909838d42f9
    • mr_enclave: 7aaf74aaa95cf967844819e5e4504f28308541c0504e6642a12a75a4669f66a3
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:870d49869f1017eb201b34abfb7fc39ec05038aa563441f01bdc679bf9566dc3
    • source commit: 240b4ba765136251629fcf507e0f2154dd77317f
    • mr_enclave: 51701ed3fbd0bfdcea24a2e47ce9e30c5448ca9e4ad9b48bd1530d4a9c022fe4
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.9.0-rc1
git checkout v0.9.0-rc1

just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.9.0-rc1/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.9.0-rc1
git checkout v0.9.0-rc1

KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.9.0-rc1 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.9.0-rc1.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.9.0-rc1.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

Canary rollout and verifier registration are separate operator actions and are not performed by this release cut.

v0.8.0

Choose a tag to compare

@smtmfft smtmfft released this 24 Aug 09:20
c056364

raiko2 v0.8.0

Full ZK/runtime + TEE provider release.

Summary

  • Stable v0.8.0 release from commit c05636417315185397bb1eaaaac55a51720a242c.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Reuses the byte-identical ZK guest ELF/VK artifacts from v0.8.0-rc1; all guest registration digests are unchanged.
  • Publishes freshly built, officially signed TEE provider images for raiko2-sgx, raiko2-sgx-edmm, and gaiko2-sgxgeth.
  • Changes since v0.8.0-rc1:
    • Make runtime artifact lifecycle tombstone-free and bound terminal task retention.
    • Recover committed GCS state conflicts and distinguish canonical preflight cache objects.
    • Reset terminal Boundless no-lock checkpoints for client-driven retry.
    • Redact RPC credentials from Boundless error output.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:997d440a937bd15e904706d5e58e04ad0898ad82cb692623478d9fbd4c133ca8
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.8.0
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0xd6ab71c22201c23ef512b706f2e2d720f6da1b559fb76834aa9d4e35276f6e10
  • risc0 aggregation image_id: 0xdd9b8abff96c409ae2418edfb51d893ea2bd10f4873a0226f17a6998c1afc1b7
  • sp1 proposal vk_bn254: 0x0025425c22e827507428a3d9c7b0f89635be5462f34bb6780563e3d6086be7c7
  • sp1 proposal vk_hash_bytes: 0x12a12e113a09d41d05147b387b0f89632df2a3174d2ed9e00ac7c7ac086be7c7
  • sp1 aggregation vk_bn254: 0x0051ac1d9e8cfd4196e37f9cfefd08e9b0f7ce653bad4634cd1ee84b71ca3be6
  • sp1 aggregation vk_hash_bytes: 0x28d60ecf233f50655c6ff39f6fd08e9b07be73296eb518d31a3dd09671ca3be6

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:5f0c1beed3a70939f17b639d82f1fae3d673d1aa21cf1b3519a1e316c9435e63
    • mr_enclave: c32d67525ab44f8f1d937f2ade81de208c7c34a14779b0aee3b5d68e9b9ccfed
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:2bfdb29baa130c22fcdc8946c17750a0da835d08a04ba41c02d6ff01456a3d54
    • mr_enclave: 1db2455525747259b9c13fc8c5217d7267d1152ad3566f661bd300e9bf4fee2d
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:8bee8c69fcff939714adb1de58d9db541d0b8b54a835b9a12ab316019a51f992
    • source commit: f866bb22916559243ec2161f5e36d6b729434066
    • mr_enclave: 5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.8.0
git checkout v0.8.0

just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.8.0/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.8.0
git checkout v0.8.0

KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.8.0 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.8.0.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.8.0.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

No rollout, verifier registration, or register-image --apply action is part of this release cut.

v0.8.0-rc1

v0.8.0-rc1 Pre-release
Pre-release

Choose a tag to compare

@smtmfft smtmfft released this 14 Aug 10:12
8b2147a

raiko2 v0.8.0-rc1

Full ZK/runtime + TEE provider release candidate.

Summary

  • Release candidate for v0.8.0-rc1.
  • Release commit: 8b2147a0e74ba6387938cf35544797fb1b61cc07.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Publishes official Taiko-signed TEE provider images for raiko2-sgx, raiko2-sgx-edmm, and gaiko2-sgxgeth.
  • Major changes since v0.7.0-rc2:
    • Share the canonical preflight cache across proof lanes.
    • Harden Boundless funding and restart recovery with a local funding ledger.
    • Make runtime startup recovery client-driven.
    • Retire the self-hosted guest ELF synchronization workflow.
    • Reduce zkVM crypto setup cycles.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:41fbcaaf8bbf0e18087e59ebaec6701e0f345017c98a42e7d4878a517bc525c0
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.8.0-rc1
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0xd6ab71c22201c23ef512b706f2e2d720f6da1b559fb76834aa9d4e35276f6e10
  • risc0 aggregation image_id: 0xdd9b8abff96c409ae2418edfb51d893ea2bd10f4873a0226f17a6998c1afc1b7
  • sp1 proposal vk_bn254: 0x0025425c22e827507428a3d9c7b0f89635be5462f34bb6780563e3d6086be7c7
  • sp1 proposal vk_hash_bytes: 0x12a12e113a09d41d05147b387b0f89632df2a3174d2ed9e00ac7c7ac086be7c7
  • sp1 aggregation vk_bn254: 0x0051ac1d9e8cfd4196e37f9cfefd08e9b0f7ce653bad4634cd1ee84b71ca3be6
  • sp1 aggregation vk_hash_bytes: 0x28d60ecf233f50655c6ff39f6fd08e9b07be73296eb518d31a3dd09671ca3be6

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:d6d533a41ce91b72411e67668f2fd52ca28c783871a58580a3bccc95ef6579db
    • mr_enclave: 3564b6a30089fcb3e2f69c19b22d23f84ce148387cd7a15f5c1df165b2ae5847
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:ed863323daa73f942c3662e46e513cc64dcb3a10d1243d03f19b2d33f29ad48b
    • mr_enclave: ae2c7b92b2a71238226cb624ecd1171b66bf943cc372314affca0e6748ccecdf
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:5365edef438602446dbac09cc388a22ed43c8a7c0d53bae79ec33a9e36ed4863
    • source commit: f866bb22916559243ec2161f5e36d6b729434066
    • mr_enclave: 5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.8.0-rc1
git checkout v0.8.0-rc1

just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.8.0-rc1/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.8.0-rc1
git checkout v0.8.0-rc1

openssl genrsa -3 -out /tmp/raiko2-local-gramine-signing-key.pem 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST=/tmp/raiko2-local-gramine-signing-key.pem \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.8.0-rc1 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.8.0-rc1.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.8.0-rc1.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

No rollout, verifier registration, or register-image --apply action is part of this release cut.

v0.7.0-rc2

v0.7.0-rc2 Pre-release
Pre-release

Choose a tag to compare

@smtmfft smtmfft released this 29 Jul 09:02
63f7cdb

raiko2 v0.7.0-rc2

Full ZK/runtime + TEE provider release candidate.

Summary

  • Release candidate for v0.7.0-rc2.
  • Release commit: 63f7cdb4c393b0df750aa6ed3274177f1955fa5d.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Publishes official Taiko-signed TEE provider images for raiko2-sgx, raiko2-sgx-edmm, and gaiko2-sgxgeth.
  • Major changes since v0.7.0-rc1:
    • Enforce canonical anchor signatures in the guest.
    • Avoid reenqueueing active duplicate tasks in the server.
    • Reset runtime namespace on startup.
    • Add and harden the official signed TEE provider release workflow.
    • Update the gaiko2-sgxgeth provider pin.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:9a7ffd7cb3594f9d1e7053501231e2ae62333e780fa8fe702333187421462a4a
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.7.0-rc2
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0x74f1763d9a278bfbc5a9919289c11dc0430a0b7ea418236f460ee5ff358dcb49
  • risc0 aggregation image_id: 0x9f3bae11ab41e43f502fdb971c9cce81f2ab7547fd2af4aff6dfeeb711276279
  • sp1 proposal vk_bn254: 0x00235a72efc8aa102e04c7055f963f5a6718b0278198305014e9d9ba25583bc2
  • sp1 proposal vk_hash_bytes: 0x11ad3977722a840b4098e0ab7963f5a638c5813c0660c14029d3b37425583bc2
  • sp1 aggregation vk_bn254: 0x00e66bee98c60465db150727fb99f2be236d2b5c8c7baa4a48f548c10b7c4598
  • sp1 aggregation vk_hash_bytes: 0x7335f74c3181197662a0e4ff399f2be21b695ae431eea92911ea91820b7c4598

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:5c666c5cd77f684c0e852d3fc563baefdb87a6d30b85d2857785185ce63235c4
    • mr_enclave: 67b30b53573d6f39bfb6b7a648f30e778ba4ba0cb39e38898762c358b4387e02
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:cd9899ac29a92f7fd86bde1489f2ea1bcafc3644727702fe378a14711525b4b4
    • mr_enclave: 6519eab47ba585d4375192e2a9488267274f3b5cb57420899712dad26b5fee76
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:a455a118224b73eda704b224b824ceaf636d189faffd4694930beb5f5bb320e4
    • source commit: f866bb22916559243ec2161f5e36d6b729434066
    • mr_enclave: 5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005
    • mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013

Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.7.0-rc2
git checkout v0.7.0-rc2

just build-guest all --force

cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.7.0-rc2/guest-digests-summary.json

Compare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.

See docs/operations.md#reproduce-zk-guest-digests.

Reproduce TEE Provider Metadata

Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.

git fetch --tags origin v0.7.0-rc2
git checkout v0.7.0-rc2

openssl genrsa -3 -out /tmp/raiko2-local-gramine-signing-key.pem 3072

RAIKO2_SGX_ENCLAVE_KEY_HOST=/tmp/raiko2-local-gramine-signing-key.pem \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
  release-tee-providers --tag v0.7.0-rc2 --no-push

Compare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.

See docs/operations.md#reproduce-tee-provider-metadata.

Release Assets

  • release-manifest-v0.7.0-rc2.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.7.0-rc2.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

No rollout, verifier registration, or register-image --apply action is part of this release cut.

v0.7.0-rc1

v0.7.0-rc1 Pre-release
Pre-release

Choose a tag to compare

@johntaiko johntaiko released this 24 Jul 06:07
a9bba5c

raiko2 v0.7.0-rc1

ZK/runtime-only release candidate (no TEE / SGX provider images in this cut).

Summary

  • ZK/runtime source release candidate for v0.7.0-rc1.
  • Release commit: a9bba5cc50aa445a2a2e9f555cb5f8b5d2dcea43.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Scope: zk-only — TEE provider images (raiko2-sgx, raiko2-sgx-edmm, gaiko2-sgxgeth) and tee-attestation-manifest are not included.
  • Major themes since v0.6.0:
    • Guest/protocol hardening: uint48 abort, proposal timestamp bound by L1 origin, unbound inline manifest rejection, zero prover address in ZK aggregation, checkpoint hash recompute, BLOCKHASH window contract docs.
    • Config/prover routes: self-contained prover configuration, environment reference resolution, ephemeral runtime stores, route regression repairs.
    • Runtime/publication: compressed SP1 proposal artifacts, proof artifact publication lifecycle hardening.
    • Boundless: avoid unused AWS metadata probes / GCS-only storage path fixes.
    • CI: gitleaks secret scan gate; boundless prover tests in PR CI.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:449f188c0fbf07cf3d10fc7a5f90d28c106d013741d1d49c636bae522168d71a
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.7.0-rc1
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0xe28349c1e163e0692a0592db47aac0f50a23613bbef354a968d7cad709a27365
  • risc0 aggregation image_id: 0x2583c7475e6b844802e6e18050ee1b7fcc805be8d01ddd362e222fc8146b9675
  • sp1 proposal vk_bn254: 0x00ba1c98f95aa6f115530ec01f5fab18e3ab1494c90954748abd298d8e57a4b0
  • sp1 proposal vk_hash_bytes: 0x5d0e4c7c56a9bc452a61d80375fab18e1d58a4a6242551d2157a531b0e57a4b0
  • sp1 aggregation vk_bn254: 0x00880b1bff4be91fd5dfa8f018820d51bc244d7ecd3d84c110892dd28a4b9349
  • sp1 aggregation vk_hash_bytes: 0x44058dff52fa47f53bf51e030820d51b61226bf634f6130421125ba50a4b9349

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.7.0-rc1
git checkout v0.7.0-rc1

just build-guest all --force

cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.7.0-rc1/guest-digests-summary.json

Compare a sorted .digests projection with the release asset (do not compare the full JSON byte-for-byte; it contains created_at_unix).

See docs/operations.md#reproduce-zk-guest-digests.

Release Assets

  • release-manifest-v0.7.0-rc1.json
  • guest-digests-summary.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

No TEE provider images, attestation manifest, rollout, verifier registration, or register-image --apply action is part of this release cut.

v0.6.0

Choose a tag to compare

@smtmfft smtmfft released this 11 Jul 03:27
a9e88a4

Summary

  • ZK/runtime source release for v0.6.0.
  • Release commit: a9e88a4bd9e38383d601685d74e9d977531c909f.
  • Publishes the runtime image with both risc0 and sp1 guest artifacts.
  • Includes TEE provider image metadata for sgx and sgxgeth lanes.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:65f65549e054b9a385ecace181ddf11dc0606e5464e07a9e25efd71aaf85d407
  • image tag: us-docker.pkg.dev/evmchain/images/raiko2:v0.6.0
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts.

ZK Guest Digests

  • risc0 proposal image_id: 0x5a818b4c7dc80e9ba85d55492c20c263c67238724e3982f76d15a158e501210b
  • risc0 aggregation image_id: 0x9cfcc1b34a98853c3c5873a4d456726e528246f7f03a4ea35f27c2543aa6e7f0
  • sp1 proposal vk_bn254: 0x00ad090221a8fa0f09e1be7a53feb67be010f01310d4b2314a69d10152ee1ce0
  • sp1 proposal vk_hash_bytes: 0x568481106a3e83c23c37cf4a3feb67be008780984352c8c514d3a20252ee1ce0
  • sp1 aggregation vk_bn254: 0x000b11691352e55fcf64f62620cefaa700161600093f2751032fe71ea912264d
  • sp1 aggregation vk_hash_bytes: 0x0588b48954b957f36c9ec4c40cefaa7000b0b00024fc9d44065fce3d2912264d

TEE Provider Images

  • raiko2-sgx: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:fe6ea483acc320ec19fa1892fbdcee01436e40a859e0e1d2ce54bd59c5368e8e
  • raiko2-sgx-edmm: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:8a99c38d4bacc842e6b360efa86f14174a76c775b556404f85752bd4aa8e101d
  • gaiko2-sgxgeth: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:a0b064bc0b33da8e6a7aea3404f4a8a83f8cd5cb18c0e0a87cd0da457fecb01a

TEE Attestation Metadata

  • raiko2-sgx mr_enclave: 90c79e65d6d0f83d658ff96cd0ef1204438f20b406c93cf1d4fafa0cff29842e
  • raiko2-sgx mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • raiko2-sgx-edmm mr_enclave: 041cadb0541bf8249c368482172d218608f3693975b65f74beb2ed6f0044f951
  • raiko2-sgx-edmm mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth mr_enclave: 2d2216efbe9d8e80ba24b86606ccd5ce9faf11033d31ad9e5d3c5c89965c8a57
  • gaiko2-sgxgeth mr_signer: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
  • gaiko2-sgxgeth source commit: 9024e6140d4397119c69d34b832808a9ffcbd7fd

Reproduce Runtime And ZK Guest Digests

git fetch --tags origin v0.6.0
git checkout v0.6.0

cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output target/releases/v0.6.0/guest-digests-summary.json

Compare the generated guest-digests-summary.json with the release asset of the same name.

Reproduce TEE Provider Metadata

Official TEE metadata reproduction requires the release enclave signing key through the configured
secret manager. A disposable local key can reproduce mr_enclave, but it will produce a different
mr_signer.

git fetch --tags origin v0.6.0
git checkout v0.6.0

GCP_ENCLAVE_KEY_SECRET=<secret-name> \
GCP_ENCLAVE_KEY_VERSION=<secret-version> \
GCP_ENCLAVE_KEY_PROJECT=<gcp-project> \
cargo run -r -p xtask -- release-tee-providers --tag v0.6.0 --no-push

Compare target/releases/v0.6.0/tee-attestation-manifest-v0.6.0.json with the release asset of
the same name.

Release Assets

  • release-manifest-v0.6.0.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.6.0.json
  • risc0_shasta_*.elf
  • sp1_shasta_*.elf
  • sp1_shasta_*.vk.bin

v0.6.0-rc1

Choose a tag to compare

@smtmfft smtmfft released this 08 Jul 08:33
4449efd

raiko2 v0.6.0-rc1

Release candidate for raiko2 runtime, ZK guest artifacts, and TEE provider images.

Source

  • raiko2 commit: 4449efdc7aed4e0c94edb2e5abc1cd6d2e9d1c74
  • gaiko2 provider commit: 776a75c4ae5acbcf6e632bbd3285ca142fb8cee4
  • Includes the gaiko2 Shasta fork header validation fix from gaiko2 PR #33.

Runtime Image

  • us-docker.pkg.dev/evmchain/images/raiko2:v0.6.0-rc1
  • Digest: us-docker.pkg.dev/evmchain/images/raiko2@sha256:91f342aadf21a335b685be70757f6476e05dab3d94459d91555d6df22bc4ea16

TEE Provider Images

  • raiko2-sgx:v0.6.0-rc1

    • Digest: us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:72f8a74122ce663e3c1eb322cce33ef65886001d8a86fcca6da712c53da93f91
    • MRENCLAVE: 9d6be136b14e13a95a1c76c12ad8b4cbefe477ad3e25152c025a98ae127dbe35
    • MRSIGNER: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
    • ISV product ID: 0
    • ISV SVN: 0
    • Debug enclave: false
  • gaiko2-sgxgeth:v0.6.0-rc1

    • Digest: us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:10312c72d9a797f971a41cd702dc764bc38f8260f1f6dc7eb7a9e0f1d38c13ab
    • MRENCLAVE: 7f56c5065244b000e79bb124158853ccad0d6f917477f12ed8b955a746fd8026
    • MRSIGNER: 48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
    • ISV product ID: 1
    • ISV SVN: 1

ZK Guest Digests

  • RISC0 aggregation image ID: 0xe0b11a7a7f615f463b3cb676cfe45557c21a20d040a0fd58859866590e76e57a
  • RISC0 proposal image ID: 0x803c6fc8a305b6ee57941fb612bea43f563b60e066ce6980331f74c77a3f1766
  • SP1 aggregation vk_bn254: 0x00610fe9cb8cb53cd8fb85fde3bf098197e8ed770ada473de933434cf92fb34f
  • SP1 aggregation vk_hash_bytes: 0x3087f4e5632d4f361f70bfbc3bf098193f476bb82b691cf752668699792fb34f
  • SP1 proposal vk_bn254: 0x00ed8e0eb36ec85611e1eca8b0632f773617939deb2f8d8e187ed4a38dc022ca
  • SP1 proposal vk_hash_bytes: 0x76c707595bb215843c3d95160632f77330bc9cef2cbe363830fda9470dc022ca

Assets

  • release-manifest-v0.6.0-rc1.json
  • guest-digests-summary.json
  • tee-attestation-manifest-v0.6.0-rc1.json
  • risc0_shasta_proposal.elf
  • risc0_shasta_aggregation.elf
  • sp1_shasta_proposal.elf
  • sp1_shasta_proposal.vk.bin
  • sp1_shasta_aggregation.elf
  • sp1_shasta_aggregation.vk.bin

No rollout, verifier registration, or register-image --apply action is part of this release cut.

v0.5.1

Choose a tag to compare

@johntaiko johntaiko released this 26 Jun 07:21
b08f4c5

Summary

  • ZK/runtime source release for raiko2 guest proof soundness hardening.
  • Rejects fake RISC0 aggregation receipts and hardens Shasta proposal validation.
  • Verifies stalled anchor checkpoints in the guest path.
  • Includes Shasta risc0 and sp1 guest artifacts only.

Runtime Image

  • runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:bae4cb8ebbd14afde1e806c927ad65f7518f2e43d94c2274c4cf013c368c724f
  • commit: b08f4c5
  • includes risc0 guest ELFs and sp1 guest ELF/VK artifacts

ZK Guest Digests

  • risc0 proposal image_id: 0xa38d1fac63aa6a553fdb6fea01fdc96534564c31de916aaafe5f5a1dd3bb908b
  • risc0 aggregation image_id: 0x868b5154ae01a9a045051da2d7ba2e21d4132c7ec096da343fa24149407fefef
  • sp1 proposal vk_bn254: 0x007594632ec31fae9d44799b97316fcbcaa3ff6b5db268c7a5d8025b3bbb487e
  • sp1 proposal vk_hash_bytes: 0x3aca319730c7eba7288f33727316fcbc551ffb5a76c9a31e4bb004b63bbb487e
  • sp1 aggregation vk_bn254: 0x00e91cb391c22d6fd015e4c6041dbbe6efb2d8be6d4046eec28f12acba5a17bc
  • sp1 aggregation vk_hash_bytes: 0x748e59c8708b5bf402bc98c041dbbe6e7d96c5f335011bbb051e25593a5a17bc

Reproduce

See docs/operations.md#reproduce-zk-guest-digests.

Release Assets

  • release-manifest-v0.5.1.json
  • guest-digests-summary.json
  • risc0_shasta_*.elf
  • sp1_shasta_*.elf
  • sp1_shasta_*.vk.bin