From b146b04f3f9e6a691da1cb40615a598ac22d941c Mon Sep 17 00:00:00 2001 From: Robert Betts Date: Tue, 1 Sep 2026 10:23:51 +0100 Subject: [PATCH] Release 1.1.0: bump packages and pin Linux SP1 6.5.0 digests. Co-authored-by: Cursor --- CHANGELOG.md | 33 ++++++++++++++++++++++---------- artifacts/sp1_guest_digests.json | 12 ++++++------ clients/rust/Cargo.lock | 4 ++-- clients/rust/Cargo.toml | 2 +- docs/RELEASE_REVIEW.md | 4 ++-- host/Cargo.lock | 16 ++++++++-------- host/Cargo.toml | 2 +- lakefile.lean | 2 +- 8 files changed, 44 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3a5db42..92d4ebe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,17 +1,30 @@ # Changelog -## Unreleased +## 1.1.0 — 2026-09-01 + +Minor release: first-class macOS, SP1 **6.5.0**, gRPC stack 0.14, and Dependabot aimed at `development`. + +### Platforms -- Coordinated SP1 **6.5.0** (`sp1-sdk` / `sp1-build` / `sp1-zkvm`); blake3 1.8.7; cc 1.4.4; fix `ProveRequest`/`ProvingKey` imports for SP1 6.3+ builds -- Dependabot: target `development`, group `sp1-*` (avoid one-crate skew) -- ELF/vk digest pin still last Linux 6.3.1-era values — refresh on Linux after guest rebuild (`scripts/sp1_guest_digest.sh`) - First-class Linux + macOS: `sealed_worker` cfg-splits Linux `prctl` / macOS `PT_DENY_ATTACH`; SP1 scripts use portable mem/`PROTOC` helpers (`scripts/lib/platform.sh`) -- SP1 `sp1-execute` CI: disable PR/push/schedule; keep `workflow_dispatch` only (GH runners lack SP1 compute) — run `scripts/sp1_execute_ci.sh` locally -- Coordinated Dependabot upgrades: tonic/tonic-prost/prost 0.14, sha2 0.11, Actions checkout/upload-artifact v7; ignore bincode majors (3.0.0 is an unmaintained stub) -- Pin lean-grpc dependency to **v1.1.0** (was v1.0.0) -- Mid-tier Lean SP1 guest + `sp1_lean_mid_smoke --prove` (Init-free mix/rounds; laptop-oriented) -- Spike smoke: optional `--prove` for CPU prove+verify +### SP1 / integrity + +- Coordinated SP1 **6.5.0** (`sp1-sdk` / `sp1-build` / `sp1-zkvm`); fix `ProveRequest`/`ProvingKey` imports for SP1 6.3+ builds +- Refresh ELF/vk pin in `artifacts/sp1_guest_digests.json` for the 6.5.0 guest rebuild (Linux) +- Mid-tier Lean SP1 guest + `sp1_lean_mid_smoke --prove`; spike smoke optional `--prove` +- SP1 `sp1-execute` CI: PR/push/schedule off (GH runners lack compute); `workflow_dispatch` + local `scripts/sp1_execute_ci.sh` + +### Dependencies / CI + +- tonic / tonic-prost / prost **0.14**; sha2 **0.11**; blake3 1.8.7; cc 1.4.4; Actions checkout/upload-artifact **v7** +- Ignore bincode majors (3.0.0 is an unmaintained compile-error stub) +- Dependabot: `target-branch: development`, group `sp1-*` and tonic/prost +- Pin lean-grpc dependency to **v1.1.0** + +### Packages + +- Lake **1.1.0**, host workspace **1.1.0**, Rust client **1.1.0** ## 1.0.1 — 2026-08-05 @@ -78,4 +91,4 @@ First stable release: Lean-measured SP1 guest, integrity-hardened Accept path, a - Initial product spine: Lean Tee/Prove/Verify/AnchorSink, mock proofs, teeServer/teeClient - Host compliance lib + SP1-ready prove_server - Product docs, `lean_tee_receipt`, standalone demo, CI, clients, policy/registry, SP1 host verify path -- Profiles: `lean-tee-v1` (mock), `lean-tee-v2` (SP1) +- Lake package metadata for Reservoir diff --git a/artifacts/sp1_guest_digests.json b/artifacts/sp1_guest_digests.json index 28bd86e..04197c4 100644 --- a/artifacts/sp1_guest_digests.json +++ b/artifacts/sp1_guest_digests.json @@ -3,10 +3,10 @@ "profile": "lean-tee-v2", "code_id_example": "lean-tee/compliance_operator/lean-sp1/v1", "code_hash": "bec5a1b6fd790b3332da9ebdd744dbe4d58612fa9de64321298ddea05a40784f", - "elf_sha256": "63b7e1b1fc8de5cca31a3df40f2e97db7b5dec497d8213aafd34abe3dd506c21", - "elf_bytes": 2128208, - "vk_hash_bytes": "128ed54d1e904e3d0633d0b0509a37d34b0f4ade561aca9c7ed300b01fb8cf34", - "vk_bytes32": "0x00251daa9a7a4138f4319e858509a37d3961e95bd586b2a73f6980581fb8cf34", - "sp1_version": "6.3.1", - "note": "Wire Measurement remains codeHash+configHash (logical code_id). elf_sha256 / vk_* pin the SP1 executable for counterparties and host verify." + "elf_sha256": "a56164482d7bf6056d5ac0cc1fe7bf9904701cc45c8e552ec284176f2caeedc3", + "elf_bytes": 2128104, + "vk_hash_bytes": "35b959ae48d96d621cfb9a833931f68e216ccc35776148274f12e1b8257787ed", + "vk_bytes32": "0x006b72b35d2365b588e7dcd41b931f68e42d9986bdd85209e78970dc257787ed", + "sp1_version": "6.5.0", + "note": "Wire Measurement remains codeHash+configHash (logical code_id). elf_sha256 / vk_* pin the SP1 executable for counterparties and host verify. Hashes from Linux sp1-execute on 2026-09-01 (SP1 6.5.0)." } diff --git a/clients/rust/Cargo.lock b/clients/rust/Cargo.lock index 715d34e..bfabc3c 100644 --- a/clients/rust/Cargo.lock +++ b/clients/rust/Cargo.lock @@ -471,7 +471,7 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" [[package]] name = "lean_tee_client" -version = "1.0.1" +version = "1.1.0" dependencies = [ "hex", "lean_tee_receipt", @@ -485,7 +485,7 @@ dependencies = [ [[package]] name = "lean_tee_receipt" -version = "1.0.1" +version = "1.1.0" dependencies = [ "blake3", "hex", diff --git a/clients/rust/Cargo.toml b/clients/rust/Cargo.toml index f3a6b54..0fd1773 100644 --- a/clients/rust/Cargo.toml +++ b/clients/rust/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "lean_tee_client" -version = "1.0.1" +version = "1.1.0" edition = "2021" license = "Apache-2.0" description = "Thin tonic client for lean_tee.v1 Tee + Prove" diff --git a/docs/RELEASE_REVIEW.md b/docs/RELEASE_REVIEW.md index 6e49c3c..e957165 100644 --- a/docs/RELEASE_REVIEW.md +++ b/docs/RELEASE_REVIEW.md @@ -32,7 +32,7 @@ Gate checklist before flipping [RileyBetts/lean-tee](https://github.com/RileyBet | Issue / PR templates | **Fix applied** | `.github/ISSUE_TEMPLATE/`, PR template | | CODEOWNERS / Dependabot | **Fix applied** | Optional polish landed | | Secret scrub | **Pass** | No private keys/tokens found; `.env` gitignored | -| `main` / `v1.0.1` | **Pass** | Default branch `main`; CI green; package versions and tag `v1.0.1` aligned. | +| `main` / `v1.1.0` | **Pass** | Default branch `main`; package versions and tag `v1.1.0` aligned; Dependabot targets `development`. | ## Gate 4 — Supply chain / licenses @@ -51,7 +51,7 @@ Gate checklist before flipping [RileyBetts/lean-tee](https://github.com/RileyBet | Enable vulnerability alerts / secret scanning | **Done** | | Set visibility public | **Done** — https://github.com/RileyBetts/lean-tee | | Fresh-clone verify | **Done** — `git clone` + `lake update` (lean-grpc v1.1.0) | -| Release note / Reservoir watch | **Done** — `v1.0.1` is latest; watch Reservoir over coming days | +| Release note / Reservoir watch | **Done** — `v1.1.0` is latest | ## Deferred (honest roadmap) diff --git a/host/Cargo.lock b/host/Cargo.lock index 1368ece..509f7cb 100644 --- a/host/Cargo.lock +++ b/host/Cargo.lock @@ -1907,7 +1907,7 @@ dependencies = [ [[package]] name = "lean_tee_compliance" -version = "1.0.1" +version = "1.1.0" dependencies = [ "hex", "lean_tee_receipt", @@ -1916,7 +1916,7 @@ dependencies = [ [[package]] name = "lean_tee_confidential" -version = "1.0.1" +version = "1.1.0" dependencies = [ "lean_tee_compliance", "lean_tee_receipt", @@ -1926,7 +1926,7 @@ dependencies = [ [[package]] name = "lean_tee_guest" -version = "1.0.1" +version = "1.1.0" dependencies = [ "lean_tee_compliance", "sp1-zkvm", @@ -1934,14 +1934,14 @@ dependencies = [ [[package]] name = "lean_tee_guest_lean" -version = "1.0.1" +version = "1.1.0" dependencies = [ "sp1-zkvm", ] [[package]] name = "lean_tee_guest_lean_mid" -version = "1.0.1" +version = "1.1.0" dependencies = [ "cc", "sp1-zkvm", @@ -1949,7 +1949,7 @@ dependencies = [ [[package]] name = "lean_tee_guest_lean_spike" -version = "1.0.1" +version = "1.1.0" dependencies = [ "cc", "sp1-zkvm", @@ -1957,7 +1957,7 @@ dependencies = [ [[package]] name = "lean_tee_prove_server" -version = "1.0.1" +version = "1.1.0" dependencies = [ "bincode", "bytes", @@ -1980,7 +1980,7 @@ dependencies = [ [[package]] name = "lean_tee_receipt" -version = "1.0.1" +version = "1.1.0" dependencies = [ "blake3", "hex", diff --git a/host/Cargo.toml b/host/Cargo.toml index 7a7129f..14702d3 100644 --- a/host/Cargo.toml +++ b/host/Cargo.toml @@ -13,6 +13,6 @@ members = [ default-members = ["prove_server"] [workspace.package] -version = "1.0.1" +version = "1.1.0" edition = "2021" license = "Apache-2.0" diff --git a/lakefile.lean b/lakefile.lean index 7416dfc..5a1b8e3 100644 --- a/lakefile.lean +++ b/lakefile.lean @@ -7,7 +7,7 @@ open Lake DSL open System package «lean-tee» where - version := v!"1.0.1" + version := v!"1.1.0" keywords := #["tee", "zkvm", "grpc", "compliance", "attestation"] description := "Lean-specified zkTEE: measured guest execution, hashed receipts, lean-grpc APIs" license := "Apache-2.0"