Releases: Dstack-TEE/dstack
Releases · Dstack-TEE/dstack
Dstack v0.5.4
dstack v0.5.4 Release Notes
Critical Security Update
- Fixed LUKS header validation vulnerability (GHSA-jxq2-hpw3-m5wf)
Major Features & Improvements
Enhanced SDK Support
- sdk/js: browser compatible - JavaScript SDK now works in web browsers without Node.js
- sdk/rust: implement borsh serialization - Added Borsh support and Debug traits for all public types
- sdk/rust: break up dstack-sdk into two crates - Separated client and types for no_std compatibility
- sdk/python - Added async/await support and improved API compatibility
Performance & Infrastructure
- cvm: Support for more than 255 CPUs - Removed hardware CPU count limitations
- vmm: Added one-shot VM mode - VMs automatically terminate after task completion
- gateway: Add gRPC support for TLS termination proxy - Enhanced protocol support
- vmm: Support for using passt as network egress - Alternative to traditional TAP networking
Developer Experience
- Comprehensive documentation updates including:
- Security audit report and documentation
- Contributing guidelines (CONTRIBUTING.md)
- Git-cliff based changelog generation
- Media kit and branding updates
- SPDX license annotations throughout codebase
- GitHub Actions for automated gateway/KMS releases
Technical Improvements
Gateway & Networking
- gateway: Fix reserved ip allocation - Resolved IP address assignment conflicts
- gateway: Add api for evidences - New endpoint for cryptographic evidence collection
- gateway: Add 0.3.x compatibility custom domain dns prefix - Backward compatibility for legacy domains
- gateway: Remove duplicate node IP address - Fixed network configuration redundancy
VM Management
- kms: ACPI Tables Dynamic Generation - Runtime ACPI table creation for better hardware compatibility
- vmm-cli: Add --stopped and --user-config - New CLI options for VM state management
- vmm: Allow updating non-kms VMs - Support for updating VMs without KMS integration
- vmm: remove max disk size limit - Removed artificial storage constraints
Build & Dependencies
- build(deps): bump tokio from 1.44.1 to 1.46.1 - Updated async runtime with performance improvements
- Add reproducible docker image builder for KMS - Deterministic builds for security verification
- build(deps): Security patches - Updated elliptic, axios, sha.js via automated dependency management
- prpc: Move generated files to OUT_DIR - Improved build artifact organization
Project Growth
- 12 new contributors joined the project
- 70+ pull requests merged
- Enhanced testing with comprehensive feature coverage
- Improved documentation and developer guides
New Contributors
Welcome to our new community members:
Resources
- Full Changelog: v0.5.3...v0.5.4
- Security Advisory: GHSA-jxq2-hpw3-m5wf
- Documentation: Dstack Docs
Contributors
pbeza, shelvenzhou, and 6 other contributors
Assets 2
KMS Release v0.5.3
Docker Image Information
Image: docker.io/kvin/kms:0.5.3
Digest (SHA256): sha256:0c80eae6bc695fc5ce4239880e8091590e8830fb89a0e7f54116d46a419c6bf4
Verification: Verify on Sigstore
Contract ABIs
This release includes the compiled contract ABIs:
DstackKms.json- Main KMS contract ABIDstackApp.json- Application contract ABI
Gateway Release v0.5.3
Docker Image Information
Image: docker.io/kvin/gateway:0.5.3
Digest (SHA256): sha256:9730d87874c16778e39a6fcbb7317d405421cde397a8f7d394983c8a2a2e2f4e
Verification: Verify on Sigstore
v0.5.3
What's Changed
- gateway: Move rpc status/info to admin port by @kvinwang in #198
- vmm: Only set mr_config_id for supported images by @kvinwang in #205
- gw: Configurable TLS version and crypto provider by @kvinwang in #202
- gw: Add health check endpoint by @kvinwang in #203
- gw: Support for certificate hot reloading by @kvinwang in #204
- vmm: Add option to disable attaching all gpus by @kvinwang in #210
- gw: Seperate proxy runtime from Rocket by @kvinwang in #207
- Add script to config firewall for qemu by @kvinwang in #199
- vmm: Implement update user_config in UI and CLI by @kvinwang in #212
- KMS: Add ERC-165 Support to AppAuth by @Leechael in #213
- readme: Add link to reproducible build by @kvinwang in #217
- doc: Add security guide by @kvinwang in #215
- Add doc cvm-boundaries.md by @kvinwang in #216
- fix(gateway): move get_meta to admin API for v0.5.x by @Leechael in #220
- Add doc design-and-hardening-decisions.md by @kvinwang in #221
- Create LICENSE by @h4x3rotab in #225
Full Changelog: v0.5.2...v0.5.3
SHA-256 checksun:
42e8a43aff515b3ad08bebdbeb44edd5a94d1e729e0bd035b1104403e998c7c5 dstack-simulator-0.5.3-aarch64-apple-darwin.tgz
6c5b07b89dd12ccf31353919f51a353ee3ac63765425f8648bc04b7305e50075 dstack-simulator-0.5.3-x86_64-linux-gnu.tgz
8fd595ca812494ef0464ce9307153bda78930736799366084e1ae16e9dd531db dstack-simulator-0.5.3-x86_64-linux-musl.tgz
Contributors
Leechael, h4x3rotab, and kvinwang
Assets 5
v0.5.2
What's Changed
- fix(vmm-cli): compatible with custom kms-url and gateway-url by @Leechael in #179
- KMS: add factory deployment for AppAuth contracts with single-transaction optimization by @Leechael in #182
- supervisor: Fix bug in log span by @kvinwang in #192
- chore(sdk,rust): adds docstrings by @tuddman in #194
- feat(rust-sdk): Make all fields in Rust SDK structs public by @near-bookrock in #193
- vmm: Support for set kms/gw urls for individual CVM by @kvinwang in #177
- feat: enhance API metadata exposure by @Leechael in #181
- Implement mr_config_id v2 by @kvinwang in #195
New Contributors
Full Changelog: v0.5.1...v0.5.2
Contributors
tuddman, Leechael, and kvinwang
Assets 2
v0.5.1
What's Changed
- rust-sdk: Remove dep on openssl by @kvinwang in #174
- fix(kms): Missed subvar in deploy-to-vmm.sh script by @Leechael in #176
- kms: Implements os_image_hash verification by @kvinwang in #175
- guest-agent: Add prometheus metrics API by @kvinwang in #178
- Add repobeats analytics by @h4x3rotab in #185
- Add option to hide tcbinfo from 8090 port by @kvinwang in #184
- Update Custom Domain in README by @kvinwang in #183
- gw: Add authority to run by @kvinwang in #180
- rpc: Add request id by @kvinwang in #186
- Add deepwiki badge by @h4x3rotab in #188
- Update build steps in README by @kvinwang in #189
- kms: Add RPC to clear image cache by @kvinwang in #187
- Remove the unused mr_key_provider by @kvinwang in #191
- Set app compose hash to mr_config_id by @kvinwang in #190
Full Changelog: v0.5.0...v0.5.1
Contributors
Leechael, h4x3rotab, and kvinwang
Assets 2
v0.5.0
What's Changed
- [doc] Add app deployment section in deployment.md by @kvinwang in #154
- Update docs by @h4x3rotab in #155
- fix deploy scripts by @Leechael in #156
- Add guest agent API: EmitEvent by @kvinwang in #160
- Switch to dm-verity enabled readonly rootfs by @kvinwang in #159
- guest-agent: Remove
commandfrom the api by @kvinwang in #166 - cvm: Ensure agent starts before docker by @kvinwang in #164
- vmm: Fix disappeared [Upgrade] button by @kvinwang in #165
- Update Rust in CI to 1.86 by @kvinwang in #168
- Feat: Add rust crate for dstack client by @nlok5923 in #161
- rust-sdk: Fix incorrect args in get_tls_key by @kvinwang in #169
- kms: Use rust 1.86 by @kvinwang in #170
- Implement sodiumbox by @kvinwang in #173
New Contributors
Full Changelog: v0.4.2...v0.5.0
Contributors
Leechael, h4x3rotab, and 2 other contributors
Assets 2
Pre-built image for dev
The purpose of this release is to demostrate the quote verification. So the rootfs image is not packed in to reduce size.
v0.3.3
What's Changed
- tappd: Add API SysInfo by @kvinwang in #45
- teepod: Use path-absolutize instead of canonicalize by @kvinwang in #48
- Add Go SDK implementation by @Hyodar in #47
- Fix length hint for report data in JS SDK & Python SDK by @Leechael in #49
- tproxy: Auto setup wg interface if not already by @kvinwang in #50
- certgen: Add subcommand to sign a single cert by @kvinwang in #51
- teepod: Open a pty for vm console by @kvinwang in #52
- Disable scale ext for protos by @kvinwang in #54
- tproxy: Auto set ulimit -n by @kvinwang in #56
- tproxy: Config for overall timeout for a connection by @kvinwang in #57
- tappd: Better logs filter by @kvinwang in #58
- teepod: Fix wrong app-id during reset secret by @kvinwang in #59
- tproxy: Connect to multiple hosts by @kvinwang in #60
- tproxy: The ending
sin the url must be on the port part by @kvinwang in #61 - teepod: Listening host api on VSOCK by @kvinwang in #62
- tappd: Implement vsock-based guest API by @kvinwang in #63
- Add default docker daemon config by @kvinwang in #65
- tappd: Add systemd watchdog support by @kvinwang in #64
- Support for disk resizing by @kvinwang in #66
- Enable base image upgrades for existing instances by @kvinwang in #67
- tappd: Support for optional logs/sysinfo API by @kvinwang in #55
- Add workarounds for wg endpoint changes by @kvinwang in #68
- kms: Allow upgrade base image by @kvinwang in #69
- dstack v0.3.3 by @kvinwang in #70
New Contributors
Full Changelog: v0.3.2...v0.3.3
Contributors
Leechael, kvinwang, and Hyodar