Repository navigation
Releases
v0.9.1-rc1
raiko2 v0.9.1-rc1
Full ZK/runtime + TEE provider release candidate.
Summary
- Release candidate from commit
569e48b3a4b074f4794157b01728f42d87f270bb. - Hardens proposal
GuestInputhandling by preserving positional state-pool indices, bounding the
ancestor-header window before expensive guest validation, and rejecting missing witnesses early. - Replaces the previous
500000000zkGas estimate-availability cap and local-evaluation fallback
with a configurable warning-only threshold, defaulting to1000000000. Proposal totals above the
threshold remain on the extrapolated estimated-quote path. - Pins gaiko2 at
aadf65d19ca5792fec288c701fb91c53a506487f, including Glamsterdam L1
block-access-list hash support. - Publishes freshly built, officially signed TEE provider images for
raiko2-sgx,
raiko2-sgx-edmm, andgaiko2-sgxgeth.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:dfb2157b2d64eb0ed194b54f283addd875b6871fd43943a45f927305f1128ed4 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.9.1-rc1 - commit:
569e48b3a4b074f4794157b01728f42d87f270bb - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0x1b5945ec67f17fae53bf037a7243730845c5855c4bb331f0490648aa6eb31ef9risc0aggregationimage_id:0x280e223094ced38d24ded624ee21b6c3c030e33a474f4bfc845bfef8909e2d32sp1proposalvk_bn254:0x0013b23291909ab9f77c50a73bae45c03264090c94f0e5af8994a0c4055bf63dsp1proposalvk_hash_bytes:0x09d919486426ae7d6f8a14e73ae45c031320486453c396be13294188055bf63dsp1aggregationvk_bn254:0x0058dd7e60f98e76a002099e22ba0362fcccaf07e860ec5fa3227f284c4c56f7sp1aggregationvk_hash_bytes:0x2c6ebf303e639da8004133c42ba0362f6665783f2183b17e4644fe504c4c56f7
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:98afd86e31aeed8c55ba640c465195e619b3024991c92fcdd7cd11545735a036mr_enclave:3aaa7b641704643132b9b306c3da0ef50266d1049c7f6f47bea43c3ffde29efamr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:7ec5e1877fd61219207593cfe7d828aab724476310ab543a6a2ddc0caa2d7f8amr_enclave:8799b8067d65d18469d481701882baf7a86cc360572ab650b3b7c31dc552f3ffmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:e018ba6f7e01c94feea8bbf3c9e941b2dadc8797b7c16ddad64be471982ccee8- source commit:
aadf65d19ca5792fec288c701fb91c53a506487f mr_enclave:86fbd544058a0aa6001437e1e35f9e41300fcfd6cd967c0ba805144a24c2e81amr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under
the sgx-release-signing environment.
Operator Note
This release changes all proposal and aggregation guest identities listed above, as well as the TEE
mr_enclave values. Before rolling out the runtime or provider images in an environment:
- dry-run and register the new RISC0 proposal/aggregation image IDs and SP1 proposal/aggregation
verification keys required by that environment; - register the new TEE
mr_enclavevalues for every provider lane being rolled out; and - keep the v0.9.0 ZK identities and TEE measurements trusted until the rollback window closes, so a
rollback can restore the complete v0.9.0 runtime/provider image set rather than a mixed release.
For Boundless proposal quotes, the warning threshold is observability only, not an accuracy or
availability boundary. The committed evaluation data includes a 21.9679% production-integer
overquote, and larger inputs are deliberately allowed to extrapolate. Operators requiring exact
local cycle sizing must set prover.risc0.boundless.batch_quote.strategy = "evaluated" before
upgrading; estimated intentionally skips that local proposal execution.
Registration, rollout, and removal of previous release identities are separate operator actions and
are not performed by this release cut.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.9.1-rc1
git checkout v0.9.1-rc1
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.9.1-rc1/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON
byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key,
but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.9.1-rc1
git checkout v0.9.1-rc1
KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.9.1-rc1 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting
attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.9.1-rc1.jsonguest-digests-summary.jsontee-attestation-manifest-v0.9.1-rc1.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
Canary rollout and verifier registration are separate operator actions and are not performed by
this release cut.
v0.9.0
raiko2 v0.9.0
Full ZK/runtime + TEE provider release.
Summary
- Final release from commit
dcbfdec7396c7e25a53ee26b43c55d58f63e0b81, following thev0.9.0-rc1canary validation. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Updates the Taiko client protocol dependency to
v2.3.0and pins the merged gaiko2 provider source at commita666927ac6fe5282e196fd54b132a4e00e8178f2. - Includes SP1
v6.8.1, Alethia Rethv1.4.1, Shasta beacon blob fetching through/eth/v1/beacon/blobs/{slot}?versioned_hashes=..., zkGas-based Boundless quote estimation, and queue wakeup isolation. - Publishes freshly built, officially signed TEE provider images for
raiko2-sgx,raiko2-sgx-edmm, andgaiko2-sgxgeth.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:615c8ca72b7d657adc56ec73ea7fb4f871a2492ad9f4f49c2e98c91be2e89018 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.9.0 - commit:
dcbfdec7396c7e25a53ee26b43c55d58f63e0b81 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0x88712dad7dc78126ee7bb592282d3102569c706f1b9db80580a582e5ffd1dfb0risc0aggregationimage_id:0x04480b22e244d60165f3d0898bc61ea084d9c76221464a8a3c3343c74889040asp1proposalvk_bn254:0x0012b97234e59f2319d44202c7b093fed9c9a51b2068e38d26625c139d668c97sp1proposalvk_hash_bytes:0x095cb91a3967c8c63a8840587b093fed4e4d28d901a38e344cc4b8271d668c97sp1aggregationvk_bn254:0x0017912dfd72308e2e2cd4211b05ed73a97eb7f576816adec2606a37507de51esp1aggregationvk_hash_bytes:0x0bc896fe5c8c238b459a8423305ed73a4bf5bfab5a05ab7b04c0d46e507de51e
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:bf441a5fd406a29d025ac973047741fd436e5f5a9ebbf1de91ac99852a8f3da1mr_enclave:feabd725eb5bb621b5c6a5071d1702bcbe06a643b42a0db8f381d5bc07dd81bfmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:8b8de3572a9e798226fb1b42623d59d1bf5ba80fbe79177be5c13b5d033ae77emr_enclave:6f3c8c55ec62fe48b83e57463e8717aa9f8594418203c9520f0f80e6f4fc4d87mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:309afe801117934ad64906014c2cb049461f5c09ca2ff2a3d7d595ec64094886- source commit:
a666927ac6fe5282e196fd54b132a4e00e8178f2 mr_enclave:8c23c79045b9b6bb827eab208e0fe58d7446a57a55f3dfc825c90e904953105bmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.9.0
git checkout v0.9.0
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.9.0/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.9.0
git checkout v0.9.0
KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.9.0 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.9.0.jsonguest-digests-summary.jsontee-attestation-manifest-v0.9.0.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
Canary rollout and verifier registration are separate operator actions and are not performed by this release cut.
v0.9.0-rc1
raiko2 v0.9.0-rc1
Full ZK/runtime + TEE provider release candidate.
Summary
- Release candidate from commit
c4825c5d7e2b51abff5cb1ff09bca86e9df1609e. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Upgrades SP1 to
v6.8.1and Alethia Reth tov1.4.1. - Migrates Shasta beacon blob fetching to
/eth/v1/beacon/blobs/{slot}?versioned_hashes=..., preserving input order and validating recomputed KZG commitments. - Adds zkGas-based Boundless quote estimation, version-offset support, aggregation estimates, and queue wakeup isolation.
- Publishes freshly built, officially signed TEE provider images for
raiko2-sgx,raiko2-sgx-edmm, andgaiko2-sgxgeth; the external provider is pinned to gaiko2 commit240b4ba765136251629fcf507e0f2154dd77317f.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:41df977ef21c6fe3253e001211985b0d2ac78d8cd0190be78da3e7e4169f6659 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.9.0-rc1 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0x6016d9b774fdb7af1ac3194793039abb241ac869c856d15d2a0f5a5997e970carisc0aggregationimage_id:0xc7a55544d3a96ec3953a5bd2705c42056e27757fd6ac72ca9b972931870f8a2asp1proposalvk_bn254:0x00609a2e8a5834a3675060fa8965315f3e978514aa49fe69f8f407e5d16b941fsp1proposalvk_hash_bytes:0x304d1745160d28d96a0c1f51165315f374bc28a52927f9a771e80fcb516b941fsp1aggregationvk_bn254:0x001047d2068ac6e9b57839a587b07a254ad724d69b69c10197c0d4d2660c2fbasp1aggregationvk_hash_bytes:0x0823e90322b1ba6d2f0734b07b07a25456b926b46da704062f81a9a4660c2fba
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:4798744ba980c3d6db0ea41712a5a81f9df25300be6d213b4df55d5a9c17d6f8mr_enclave:dc994928718200e16e0eb643486ea90e49970a897fd164e39b6ae11262b69ab9mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:7e358a426918982ad85e90309c3e1277997f1b6bfa775e2b46b62909838d42f9mr_enclave:7aaf74aaa95cf967844819e5e4504f28308541c0504e6642a12a75a4669f66a3mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:870d49869f1017eb201b34abfb7fc39ec05038aa563441f01bdc679bf9566dc3- source commit:
240b4ba765136251629fcf507e0f2154dd77317f mr_enclave:51701ed3fbd0bfdcea24a2e47ce9e30c5448ca9e4ad9b48bd1530d4a9c022fe4mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.9.0-rc1
git checkout v0.9.0-rc1
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.9.0-rc1/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.9.0-rc1
git checkout v0.9.0-rc1
KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.9.0-rc1 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.9.0-rc1.jsonguest-digests-summary.jsontee-attestation-manifest-v0.9.0-rc1.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
Canary rollout and verifier registration are separate operator actions and are not performed by this release cut.
v0.8.0
raiko2 v0.8.0
Full ZK/runtime + TEE provider release.
Summary
- Stable
v0.8.0release from commitc05636417315185397bb1eaaaac55a51720a242c. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Reuses the byte-identical ZK guest ELF/VK artifacts from
v0.8.0-rc1; all guest registration digests are unchanged. - Publishes freshly built, officially signed TEE provider images for
raiko2-sgx,raiko2-sgx-edmm, andgaiko2-sgxgeth. - Changes since
v0.8.0-rc1:- Make runtime artifact lifecycle tombstone-free and bound terminal task retention.
- Recover committed GCS state conflicts and distinguish canonical preflight cache objects.
- Reset terminal Boundless no-lock checkpoints for client-driven retry.
- Redact RPC credentials from Boundless error output.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:997d440a937bd15e904706d5e58e04ad0898ad82cb692623478d9fbd4c133ca8 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.8.0 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0xd6ab71c22201c23ef512b706f2e2d720f6da1b559fb76834aa9d4e35276f6e10risc0aggregationimage_id:0xdd9b8abff96c409ae2418edfb51d893ea2bd10f4873a0226f17a6998c1afc1b7sp1proposalvk_bn254:0x0025425c22e827507428a3d9c7b0f89635be5462f34bb6780563e3d6086be7c7sp1proposalvk_hash_bytes:0x12a12e113a09d41d05147b387b0f89632df2a3174d2ed9e00ac7c7ac086be7c7sp1aggregationvk_bn254:0x0051ac1d9e8cfd4196e37f9cfefd08e9b0f7ce653bad4634cd1ee84b71ca3be6sp1aggregationvk_hash_bytes:0x28d60ecf233f50655c6ff39f6fd08e9b07be73296eb518d31a3dd09671ca3be6
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:5f0c1beed3a70939f17b639d82f1fae3d673d1aa21cf1b3519a1e316c9435e63mr_enclave:c32d67525ab44f8f1d937f2ade81de208c7c34a14779b0aee3b5d68e9b9ccfedmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:2bfdb29baa130c22fcdc8946c17750a0da835d08a04ba41c02d6ff01456a3d54mr_enclave:1db2455525747259b9c13fc8c5217d7267d1152ad3566f661bd300e9bf4fee2dmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:8bee8c69fcff939714adb1de58d9db541d0b8b54a835b9a12ab316019a51f992- source commit:
f866bb22916559243ec2161f5e36d6b729434066 mr_enclave:5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.8.0
git checkout v0.8.0
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.8.0/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.8.0
git checkout v0.8.0
KEY_FILE="$(mktemp)"
trap 'rm -f "$KEY_FILE"' EXIT
openssl genrsa -3 -out "$KEY_FILE" 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST="$KEY_FILE" \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.8.0 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.8.0.jsonguest-digests-summary.jsontee-attestation-manifest-v0.8.0.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
No rollout, verifier registration, or register-image --apply action is part of this release cut.
v0.8.0-rc1
raiko2 v0.8.0-rc1
Full ZK/runtime + TEE provider release candidate.
Summary
- Release candidate for
v0.8.0-rc1. - Release commit:
8b2147a0e74ba6387938cf35544797fb1b61cc07. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Publishes official Taiko-signed TEE provider images for
raiko2-sgx,raiko2-sgx-edmm, andgaiko2-sgxgeth. - Major changes since
v0.7.0-rc2:- Share the canonical preflight cache across proof lanes.
- Harden Boundless funding and restart recovery with a local funding ledger.
- Make runtime startup recovery client-driven.
- Retire the self-hosted guest ELF synchronization workflow.
- Reduce zkVM crypto setup cycles.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:41fbcaaf8bbf0e18087e59ebaec6701e0f345017c98a42e7d4878a517bc525c0 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.8.0-rc1 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0xd6ab71c22201c23ef512b706f2e2d720f6da1b559fb76834aa9d4e35276f6e10risc0aggregationimage_id:0xdd9b8abff96c409ae2418edfb51d893ea2bd10f4873a0226f17a6998c1afc1b7sp1proposalvk_bn254:0x0025425c22e827507428a3d9c7b0f89635be5462f34bb6780563e3d6086be7c7sp1proposalvk_hash_bytes:0x12a12e113a09d41d05147b387b0f89632df2a3174d2ed9e00ac7c7ac086be7c7sp1aggregationvk_bn254:0x0051ac1d9e8cfd4196e37f9cfefd08e9b0f7ce653bad4634cd1ee84b71ca3be6sp1aggregationvk_hash_bytes:0x28d60ecf233f50655c6ff39f6fd08e9b07be73296eb518d31a3dd09671ca3be6
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:d6d533a41ce91b72411e67668f2fd52ca28c783871a58580a3bccc95ef6579dbmr_enclave:3564b6a30089fcb3e2f69c19b22d23f84ce148387cd7a15f5c1df165b2ae5847mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:ed863323daa73f942c3662e46e513cc64dcb3a10d1243d03f19b2d33f29ad48bmr_enclave:ae2c7b92b2a71238226cb624ecd1171b66bf943cc372314affca0e6748ccecdfmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:5365edef438602446dbac09cc388a22ed43c8a7c0d53bae79ec33a9e36ed4863- source commit:
f866bb22916559243ec2161f5e36d6b729434066 mr_enclave:5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.8.0-rc1
git checkout v0.8.0-rc1
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.8.0-rc1/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.8.0-rc1
git checkout v0.8.0-rc1
openssl genrsa -3 -out /tmp/raiko2-local-gramine-signing-key.pem 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST=/tmp/raiko2-local-gramine-signing-key.pem \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.8.0-rc1 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.8.0-rc1.jsonguest-digests-summary.jsontee-attestation-manifest-v0.8.0-rc1.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
No rollout, verifier registration, or register-image --apply action is part of this release cut.
v0.7.0-rc2
raiko2 v0.7.0-rc2
Full ZK/runtime + TEE provider release candidate.
Summary
- Release candidate for
v0.7.0-rc2. - Release commit:
63f7cdb4c393b0df750aa6ed3274177f1955fa5d. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Publishes official Taiko-signed TEE provider images for
raiko2-sgx,raiko2-sgx-edmm, andgaiko2-sgxgeth. - Major changes since
v0.7.0-rc1:- Enforce canonical anchor signatures in the guest.
- Avoid reenqueueing active duplicate tasks in the server.
- Reset runtime namespace on startup.
- Add and harden the official signed TEE provider release workflow.
- Update the
gaiko2-sgxgethprovider pin.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:9a7ffd7cb3594f9d1e7053501231e2ae62333e780fa8fe702333187421462a4a - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.7.0-rc2 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0x74f1763d9a278bfbc5a9919289c11dc0430a0b7ea418236f460ee5ff358dcb49risc0aggregationimage_id:0x9f3bae11ab41e43f502fdb971c9cce81f2ab7547fd2af4aff6dfeeb711276279sp1proposalvk_bn254:0x00235a72efc8aa102e04c7055f963f5a6718b0278198305014e9d9ba25583bc2sp1proposalvk_hash_bytes:0x11ad3977722a840b4098e0ab7963f5a638c5813c0660c14029d3b37425583bc2sp1aggregationvk_bn254:0x00e66bee98c60465db150727fb99f2be236d2b5c8c7baa4a48f548c10b7c4598sp1aggregationvk_hash_bytes:0x7335f74c3181197662a0e4ff399f2be21b695ae431eea92911ea91820b7c4598
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:5c666c5cd77f684c0e852d3fc563baefdb87a6d30b85d2857785185ce63235c4mr_enclave:67b30b53573d6f39bfb6b7a648f30e778ba4ba0cb39e38898762c358b4387e02mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
raiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:cd9899ac29a92f7fd86bde1489f2ea1bcafc3644727702fe378a14711525b4b4mr_enclave:6519eab47ba585d4375192e2a9488267274f3b5cb57420899712dad26b5fee76mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
gaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:a455a118224b73eda704b224b824ceaf636d189faffd4694930beb5f5bb320e4- source commit:
f866bb22916559243ec2161f5e36d6b729434066 mr_enclave:5f7da556f3b75dcc71465030e1b7274e82df9e9120c0b3eaf5bb76246a514005mr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013
- source commit:
Official Taiko mr_signer values are produced only by the protected GitHub Actions workflow under the sgx-release-signing environment.
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.7.0-rc2
git checkout v0.7.0-rc2
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.7.0-rc2/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset. Do not compare the full JSON byte-for-byte because it contains created_at_unix.
See docs/operations.md#reproduce-zk-guest-digests.
Reproduce TEE Provider Metadata
Local rebuilds can reproduce source and mr_enclave metadata with a disposable local signing key, but cannot reproduce the official Taiko mr_signer.
git fetch --tags origin v0.7.0-rc2
git checkout v0.7.0-rc2
openssl genrsa -3 -out /tmp/raiko2-local-gramine-signing-key.pem 3072
RAIKO2_SGX_ENCLAVE_KEY_HOST=/tmp/raiko2-local-gramine-signing-key.pem \
cargo run -r -p xtask --no-default-features --features tee-provider-release -- \
release-tee-providers --tag v0.7.0-rc2 --no-pushCompare a sorted {lane, provider, source, attestation} projection after deleting attestation.mr_signer from both manifests.
See docs/operations.md#reproduce-tee-provider-metadata.
Release Assets
release-manifest-v0.7.0-rc2.jsonguest-digests-summary.jsontee-attestation-manifest-v0.7.0-rc2.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
No rollout, verifier registration, or register-image --apply action is part of this release cut.
v0.7.0-rc1
raiko2 v0.7.0-rc1
ZK/runtime-only release candidate (no TEE / SGX provider images in this cut).
Summary
- ZK/runtime source release candidate for
v0.7.0-rc1. - Release commit:
a9bba5cc50aa445a2a2e9f555cb5f8b5d2dcea43. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Scope: zk-only — TEE provider images (
raiko2-sgx,raiko2-sgx-edmm,gaiko2-sgxgeth) andtee-attestation-manifestare not included. - Major themes since
v0.6.0:- Guest/protocol hardening: uint48 abort, proposal timestamp bound by L1 origin, unbound inline manifest rejection, zero prover address in ZK aggregation, checkpoint hash recompute, BLOCKHASH window contract docs.
- Config/prover routes: self-contained prover configuration, environment reference resolution, ephemeral runtime stores, route regression repairs.
- Runtime/publication: compressed SP1 proposal artifacts, proof artifact publication lifecycle hardening.
- Boundless: avoid unused AWS metadata probes / GCS-only storage path fixes.
- CI: gitleaks secret scan gate; boundless prover tests in PR CI.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:449f188c0fbf07cf3d10fc7a5f90d28c106d013741d1d49c636bae522168d71a - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.7.0-rc1 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0xe28349c1e163e0692a0592db47aac0f50a23613bbef354a968d7cad709a27365risc0aggregationimage_id:0x2583c7475e6b844802e6e18050ee1b7fcc805be8d01ddd362e222fc8146b9675sp1proposalvk_bn254:0x00ba1c98f95aa6f115530ec01f5fab18e3ab1494c90954748abd298d8e57a4b0sp1proposalvk_hash_bytes:0x5d0e4c7c56a9bc452a61d80375fab18e1d58a4a6242551d2157a531b0e57a4b0sp1aggregationvk_bn254:0x00880b1bff4be91fd5dfa8f018820d51bc244d7ecd3d84c110892dd28a4b9349sp1aggregationvk_hash_bytes:0x44058dff52fa47f53bf51e030820d51b61226bf634f6130421125ba50a4b9349
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.7.0-rc1
git checkout v0.7.0-rc1
just build-guest all --force
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.7.0-rc1/guest-digests-summary.jsonCompare a sorted .digests projection with the release asset (do not compare the full JSON byte-for-byte; it contains created_at_unix).
See docs/operations.md#reproduce-zk-guest-digests.
Release Assets
release-manifest-v0.7.0-rc1.jsonguest-digests-summary.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
No TEE provider images, attestation manifest, rollout, verifier registration, or register-image --apply action is part of this release cut.
v0.6.0
Summary
- ZK/runtime source release for
v0.6.0. - Release commit:
a9e88a4bd9e38383d601685d74e9d977531c909f. - Publishes the runtime image with both
risc0andsp1guest artifacts. - Includes TEE provider image metadata for
sgxandsgxgethlanes.
Runtime Image
- runtime image:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:65f65549e054b9a385ecace181ddf11dc0606e5464e07a9e25efd71aaf85d407 - image tag:
us-docker.pkg.dev/evmchain/images/raiko2:v0.6.0 - includes
risc0guest ELFs andsp1guest ELF/VK artifacts.
ZK Guest Digests
risc0proposalimage_id:0x5a818b4c7dc80e9ba85d55492c20c263c67238724e3982f76d15a158e501210brisc0aggregationimage_id:0x9cfcc1b34a98853c3c5873a4d456726e528246f7f03a4ea35f27c2543aa6e7f0sp1proposalvk_bn254:0x00ad090221a8fa0f09e1be7a53feb67be010f01310d4b2314a69d10152ee1ce0sp1proposalvk_hash_bytes:0x568481106a3e83c23c37cf4a3feb67be008780984352c8c514d3a20252ee1ce0sp1aggregationvk_bn254:0x000b11691352e55fcf64f62620cefaa700161600093f2751032fe71ea912264dsp1aggregationvk_hash_bytes:0x0588b48954b957f36c9ec4c40cefaa7000b0b00024fc9d44065fce3d2912264d
TEE Provider Images
raiko2-sgx:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:fe6ea483acc320ec19fa1892fbdcee01436e40a859e0e1d2ce54bd59c5368e8eraiko2-sgx-edmm:us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:8a99c38d4bacc842e6b360efa86f14174a76c775b556404f85752bd4aa8e101dgaiko2-sgxgeth:us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:a0b064bc0b33da8e6a7aea3404f4a8a83f8cd5cb18c0e0a87cd0da457fecb01a
TEE Attestation Metadata
raiko2-sgxmr_enclave:90c79e65d6d0f83d658ff96cd0ef1204438f20b406c93cf1d4fafa0cff29842eraiko2-sgxmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013raiko2-sgx-edmmmr_enclave:041cadb0541bf8249c368482172d218608f3693975b65f74beb2ed6f0044f951raiko2-sgx-edmmmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013gaiko2-sgxgethmr_enclave:2d2216efbe9d8e80ba24b86606ccd5ce9faf11033d31ad9e5d3c5c89965c8a57gaiko2-sgxgethmr_signer:48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013gaiko2-sgxgethsource commit:9024e6140d4397119c69d34b832808a9ffcbd7fd
Reproduce Runtime And ZK Guest Digests
git fetch --tags origin v0.6.0
git checkout v0.6.0
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
--output target/releases/v0.6.0/guest-digests-summary.jsonCompare the generated guest-digests-summary.json with the release asset of the same name.
Reproduce TEE Provider Metadata
Official TEE metadata reproduction requires the release enclave signing key through the configured
secret manager. A disposable local key can reproduce mr_enclave, but it will produce a different
mr_signer.
git fetch --tags origin v0.6.0
git checkout v0.6.0
GCP_ENCLAVE_KEY_SECRET=<secret-name> \
GCP_ENCLAVE_KEY_VERSION=<secret-version> \
GCP_ENCLAVE_KEY_PROJECT=<gcp-project> \
cargo run -r -p xtask -- release-tee-providers --tag v0.6.0 --no-pushCompare target/releases/v0.6.0/tee-attestation-manifest-v0.6.0.json with the release asset of
the same name.
Release Assets
release-manifest-v0.6.0.jsonguest-digests-summary.jsontee-attestation-manifest-v0.6.0.jsonrisc0_shasta_*.elfsp1_shasta_*.elfsp1_shasta_*.vk.bin
v0.6.0-rc1
raiko2 v0.6.0-rc1
Release candidate for raiko2 runtime, ZK guest artifacts, and TEE provider images.
Source
- raiko2 commit:
4449efdc7aed4e0c94edb2e5abc1cd6d2e9d1c74 - gaiko2 provider commit:
776a75c4ae5acbcf6e632bbd3285ca142fb8cee4 - Includes the gaiko2 Shasta fork header validation fix from gaiko2 PR #33.
Runtime Image
us-docker.pkg.dev/evmchain/images/raiko2:v0.6.0-rc1- Digest:
us-docker.pkg.dev/evmchain/images/raiko2@sha256:91f342aadf21a335b685be70757f6476e05dab3d94459d91555d6df22bc4ea16
TEE Provider Images
-
raiko2-sgx:v0.6.0-rc1- Digest:
us-docker.pkg.dev/evmchain/images/raiko2-sgx@sha256:72f8a74122ce663e3c1eb322cce33ef65886001d8a86fcca6da712c53da93f91 - MRENCLAVE:
9d6be136b14e13a95a1c76c12ad8b4cbefe477ad3e25152c025a98ae127dbe35 - MRSIGNER:
48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013 - ISV product ID:
0 - ISV SVN:
0 - Debug enclave:
false
- Digest:
-
gaiko2-sgxgeth:v0.6.0-rc1- Digest:
us-docker.pkg.dev/evmchain/images/gaiko2-sgxgeth@sha256:10312c72d9a797f971a41cd702dc764bc38f8260f1f6dc7eb7a9e0f1d38c13ab - MRENCLAVE:
7f56c5065244b000e79bb124158853ccad0d6f917477f12ed8b955a746fd8026 - MRSIGNER:
48fa5bbad91d274735d238715913c8712a7505bb6d0dd832764bedb46d587013 - ISV product ID:
1 - ISV SVN:
1
- Digest:
ZK Guest Digests
- RISC0 aggregation image ID:
0xe0b11a7a7f615f463b3cb676cfe45557c21a20d040a0fd58859866590e76e57a - RISC0 proposal image ID:
0x803c6fc8a305b6ee57941fb612bea43f563b60e066ce6980331f74c77a3f1766 - SP1 aggregation vk_bn254:
0x00610fe9cb8cb53cd8fb85fde3bf098197e8ed770ada473de933434cf92fb34f - SP1 aggregation vk_hash_bytes:
0x3087f4e5632d4f361f70bfbc3bf098193f476bb82b691cf752668699792fb34f - SP1 proposal vk_bn254:
0x00ed8e0eb36ec85611e1eca8b0632f773617939deb2f8d8e187ed4a38dc022ca - SP1 proposal vk_hash_bytes:
0x76c707595bb215843c3d95160632f77330bc9cef2cbe363830fda9470dc022ca
Assets
release-manifest-v0.6.0-rc1.jsonguest-digests-summary.jsontee-attestation-manifest-v0.6.0-rc1.jsonrisc0_shasta_proposal.elfrisc0_shasta_aggregation.elfsp1_shasta_proposal.elfsp1_shasta_proposal.vk.binsp1_shasta_aggregation.elfsp1_shasta_aggregation.vk.bin
No rollout, verifier registration, or register-image --apply action is part of this release cut.
v0.5.1
Summary
- ZK/runtime source release for raiko2 guest proof soundness hardening.
- Rejects fake RISC0 aggregation receipts and hardens Shasta proposal validation.
- Verifies stalled anchor checkpoints in the guest path.
- Includes Shasta
risc0andsp1guest artifacts only.
Runtime Image
- runtime image: us-docker.pkg.dev/evmchain/images/raiko2@sha256:bae4cb8ebbd14afde1e806c927ad65f7518f2e43d94c2274c4cf013c368c724f
- commit: b08f4c5
- includes
risc0guest ELFs andsp1guest ELF/VK artifacts
ZK Guest Digests
- risc0 proposal image_id: 0xa38d1fac63aa6a553fdb6fea01fdc96534564c31de916aaafe5f5a1dd3bb908b
- risc0 aggregation image_id: 0x868b5154ae01a9a045051da2d7ba2e21d4132c7ec096da343fa24149407fefef
- sp1 proposal vk_bn254: 0x007594632ec31fae9d44799b97316fcbcaa3ff6b5db268c7a5d8025b3bbb487e
- sp1 proposal vk_hash_bytes: 0x3aca319730c7eba7288f33727316fcbc551ffb5a76c9a31e4bb004b63bbb487e
- sp1 aggregation vk_bn254: 0x00e91cb391c22d6fd015e4c6041dbbe6efb2d8be6d4046eec28f12acba5a17bc
- sp1 aggregation vk_hash_bytes: 0x748e59c8708b5bf402bc98c041dbbe6e7d96c5f335011bbb051e25593a5a17bc
Reproduce
See docs/operations.md#reproduce-zk-guest-digests.
Release Assets
release-manifest-v0.5.1.jsonguest-digests-summary.jsonrisc0_shasta_*.elfsp1_shasta_*.elfsp1_shasta_*.vk.bin