From 6febc6fef20c2aa4e24020f1e0158fe4418f8df0 Mon Sep 17 00:00:00 2001 From: Zehui Chen Date: Thu, 29 Oct 2026 17:54:31 +0800 Subject: [PATCH 1/2] trustzone-sdk: update for new release 0.10.0 --- ...nnouncing-teaclave-trustzone-sdk-0.10.0.md | 46 +++++++++++++++++++ site/src/pages/download.md | 2 +- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 site/blog/2026-10-29-announcing-teaclave-trustzone-sdk-0.10.0.md diff --git a/site/blog/2026-10-29-announcing-teaclave-trustzone-sdk-0.10.0.md b/site/blog/2026-10-29-announcing-teaclave-trustzone-sdk-0.10.0.md new file mode 100644 index 0000000000..cd32d73dba --- /dev/null +++ b/site/blog/2026-10-29-announcing-teaclave-trustzone-sdk-0.10.0.md @@ -0,0 +1,46 @@ +--- +title: Announcing Apache Teaclave™ TrustZone SDK 0.10.0 +date: 2026-10-29 +author: Zehui Chen +--- + +On behalf of the Teaclave community, I am happy to announce the release of +Teaclave TrustZone SDK 0.10.0. + +Teaclave empowers developers to build memory-safe Trusted Applications across +diverse confidential computing platforms, including Intel SGX and Arm TrustZone. +Apache Teaclave TrustZone SDK, a subproject of Apache Teaclave, is based on the +OP-TEE project, a widely used open-source TrustZone OS. + +This release tracks OP-TEE 4.11.0 and focuses on safer, more ergonomic APIs: +typed TA parameters, copy-based memory references, consolidated error handling, +and an improved `cargo-optee` build experience. + +Highlights in 0.10.0: + +- Synced with OP-TEE 4.11.0, including its security fixes for this cycle. +- Exposed PBKDF2-HMAC key derivation and the password object type. +- Introduced a typed parameter API and copy-based memref access, with migration + guides under `docs/`. +- Improved `cargo-optee`: UUIDs are parsed from the unsigned ELF, and standard + OP-TEE environment paths and cross-compilation settings are supported. +- Added a security model description and an AI development guide. + +Some of these changes are breaking; please read the upgrade notes before +migrating existing TA/CA code. + +For more details, please refer to our release notes: +https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.10.0 + +## Download + +You can download the release from the +[download](https://teaclave.apache.org/download/) page. Also, please checkout +our [repository](https://github.com/apache/teaclave-trustzone-sdk) hosted on +GitHub. + +## Contributing + +Teaclave TrustZone SDK is under the Apache License v2 and open source in The +Apache Way. We aim to create a project that is maintained and owned by the +community. All kinds of contributions are welcome. Thanks to our contributors. diff --git a/site/src/pages/download.md b/site/src/pages/download.md index ffc1475476..3dadad9091 100644 --- a/site/src/pages/download.md +++ b/site/src/pages/download.md @@ -21,7 +21,7 @@ Each SDK evolves independently to best support its respective platform and use c | Latest Version | Source Code | PGP/SHA | Release Notes | |:-------:|:-------------------------:|:----:|:-------:| -| 0.9.0 | [apache-teaclave-trustzone-sdk-0.9.0.tar.gz](https://www.apache.org/dyn/closer.lua/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz?action=download) | [asc](https://downloads.apache.org/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz.asc), [sha512](https://downloads.apache.org/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz.sha512) | [notes](https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.9.0) | +| 0.10.0 | [apache-teaclave-trustzone-sdk-0.10.0.tar.gz](https://www.apache.org/dyn/closer.lua/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz?action=download) | [asc](https://downloads.apache.org/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz.asc), [sha512](https://downloads.apache.org/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz.sha512) | [notes](https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.10.0) | ### Teaclave SGX SDK From 6cccdefc16c6f26c39900caec8a8fb94904d2fb6 Mon Sep 17 00:00:00 2001 From: Zehui Chen Date: Thu, 29 Oct 2026 18:04:58 +0800 Subject: [PATCH 2/2] ci: pin all actions to SHA per ASF allow-list The ASF organization-wide allow-list blocks actions that are not pinned to approved commit SHAs, which makes PR Validation fail at startup with an empty jobs array. Update the expired docker/* SHAs to the currently allow-listed ones and pin the remaining tag refs. --- .github/workflows/_reusable-build.yml | 14 +++++++------- .github/workflows/deploy-staging.yml | 6 +++--- .github/workflows/pr-validation.yml | 2 +- .../workflows/promote-staging-to-production.yml | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/_reusable-build.yml b/.github/workflows/_reusable-build.yml index 2bc196de32..3daf0aacda 100644 --- a/.github/workflows/_reusable-build.yml +++ b/.github/workflows/_reusable-build.yml @@ -32,19 +32,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 timeout-minutes: 5 with: driver: docker-container install: true - name: Build Docker image - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 timeout-minutes: 30 with: context: . @@ -69,7 +69,7 @@ jobs: fi - name: Upload Docker image artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ steps.set-artifact-name.outputs.name }} path: /tmp/website-image.tar @@ -86,12 +86,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 1 - name: Download Docker image artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: ${{ needs.build-docker-image.outputs.artifact-name }} path: /tmp @@ -155,7 +155,7 @@ jobs: fi - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ steps.set-artifact-name.outputs.name }} path: site/build/ diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 7dc650596d..c69af16277 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -37,20 +37,20 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 1 token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false # We'll configure auth manually - name: Download build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: ${{ needs.build.outputs.build-artifact-name }} path: site/build/ - name: Set up Python - uses: actions/setup-python@v5.3.0 + uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 timeout-minutes: 5 with: python-version: '3.12' diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index 9c5bee7961..66fc5ce5af 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Download build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: ${{ needs.build.outputs.build-artifact-name }} path: build/ diff --git a/.github/workflows/promote-staging-to-production.yml b/.github/workflows/promote-staging-to-production.yml index a81e88a71a..02aeaae96c 100644 --- a/.github/workflows/promote-staging-to-production.yml +++ b/.github/workflows/promote-staging-to-production.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }}