trustzone-sdk: update for new release 0.10.0

.github/workflows/_reusable-build.yml

@@ -32,19 +32,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         timeout-minutes: 5
         with:
           driver: docker-container
           install: true
 
       - name: Build Docker image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         timeout-minutes: 30
         with:
           context: .
@@ -69,7 +69,7 @@ jobs:
           fi
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ steps.set-artifact-name.outputs.name }}
           path: /tmp/website-image.tar
@@ -86,12 +86,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
 
       - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: ${{ needs.build-docker-image.outputs.artifact-name }}
           path: /tmp
@@ -155,7 +155,7 @@ jobs:
           fi
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ steps.set-artifact-name.outputs.name }}
           path: site/build/

.github/workflows/deploy-staging.yml

@@ -37,20 +37,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
           token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false  # We'll configure auth manually
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: ${{ needs.build.outputs.build-artifact-name }}
           path: site/build/
 
       - name: Set up Python
-        uses: actions/[email protected]
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         timeout-minutes: 5
         with:
           python-version: '3.12'

.github/workflows/pr-validation.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: ${{ needs.build.outputs.build-artifact-name }}
           path: build/

.github/workflows/promote-staging-to-production.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}

site/blog/2026-10-29-announcing-teaclave-trustzone-sdk-0.10.0.md

@@ -0,0 +1,46 @@
+---
+title: Announcing Apache Teaclave™ TrustZone SDK 0.10.0
+date: 2026-10-29
+author: Zehui Chen
+---
+
+On behalf of the Teaclave community, I am happy to announce the release of
+Teaclave TrustZone SDK 0.10.0.
+
+Teaclave empowers developers to build memory-safe Trusted Applications across
+diverse confidential computing platforms, including Intel SGX and Arm TrustZone.
+Apache Teaclave TrustZone SDK, a subproject of Apache Teaclave, is based on the
+OP-TEE project, a widely used open-source TrustZone OS.
+
+This release tracks OP-TEE 4.11.0 and focuses on safer, more ergonomic APIs:
+typed TA parameters, copy-based memory references, consolidated error handling,
+and an improved `cargo-optee` build experience.
+
+Highlights in 0.10.0:
+
+- Synced with OP-TEE 4.11.0, including its security fixes for this cycle.
+- Exposed PBKDF2-HMAC key derivation and the password object type.
+- Introduced a typed parameter API and copy-based memref access, with migration
+  guides under `docs/`.
+- Improved `cargo-optee`: UUIDs are parsed from the unsigned ELF, and standard
+  OP-TEE environment paths and cross-compilation settings are supported.
+- Added a security model description and an AI development guide.
+
+Some of these changes are breaking; please read the upgrade notes before
+migrating existing TA/CA code.
+
+For more details, please refer to our release notes:
+https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.10.0
+
+## Download
+
+You can download the release from the
+[download](https://teaclave.apache.org/download/) page. Also, please checkout
+our [repository](https://github.com/apache/teaclave-trustzone-sdk) hosted on
+GitHub.
+
+## Contributing
+
+Teaclave TrustZone SDK is under the Apache License v2 and open source in The
+Apache Way. We aim to create a project that is maintained and owned by the
+community. All kinds of contributions are welcome. Thanks to our contributors.

site/src/pages/download.md

@@ -21,7 +21,7 @@ Each SDK evolves independently to best support its respective platform and use c
 
 | Latest Version | Source Code               | PGP/SHA | Release Notes |
 |:-------:|:-------------------------:|:----:|:-------:|
-| 0.9.0   | [apache-teaclave-trustzone-sdk-0.9.0.tar.gz](https://www.apache.org/dyn/closer.lua/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz?action=download) | [asc](https://downloads.apache.org/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz.asc), [sha512](https://downloads.apache.org/teaclave/trustzone-sdk-0.9.0/apache-teaclave-trustzone-sdk-0.9.0.tar.gz.sha512) | [notes](https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.9.0) |
+| 0.10.0  | [apache-teaclave-trustzone-sdk-0.10.0.tar.gz](https://www.apache.org/dyn/closer.lua/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz?action=download) | [asc](https://downloads.apache.org/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz.asc), [sha512](https://downloads.apache.org/teaclave/trustzone-sdk-0.10.0/apache-teaclave-trustzone-sdk-0.10.0.tar.gz.sha512) | [notes](https://github.com/apache/teaclave-trustzone-sdk/releases/tag/v0.10.0) |
 
 ### Teaclave SGX SDK