From 34cdab34d48d5dd87b0c221cb237929984ad61b4 Mon Sep 17 00:00:00 2001 From: Marketen Date: Thu, 3 Sep 2026 12:57:08 +0200 Subject: [PATCH] chore: pin the Gateway trust policy to v0.1.61 The two pinned releases were built from commits that no longer exist in the public repository, so a verifier following deploy/nitro/verify-build.sh could not check out either revision. Both also predate the fix for unreproducible enclave builds, so their measurements could not be reproduced even with the source in hand. Pin v0.1.61 instead. It is the first release whose published measurements have been independently reproduced from public source: verify-build.sh reports PASS for 893f4c9f, and the signed manifest verifies against the release workflow's Sigstore identity. Only one release is listed. The usual rollout window, where the outgoing and incoming releases are both accepted, is not available here because the outgoing release is not verifiable. Clients therefore fail closed against any Gateway other than v0.1.61, which is the correct outcome while the older measurements cannot be checked against source. Verified against production: TestLiveAttestation and TestLiveGatewayCompletion both pass against nexus-api-tee.dappnode.com running v0.1.61. Co-Authored-By: Claude Opus 5 --- nexus-gateway-policy.json | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/nexus-gateway-policy.json b/nexus-gateway-policy.json index f2a83cb..249dae3 100644 --- a/nexus-gateway-policy.json +++ b/nexus-gateway-policy.json @@ -5,16 +5,10 @@ "profile": "nexus-gateway-v2", "releases": [ { - "source_revision": "7207defa97d8e5256ed7ff1ce925a4903752946d", - "pcr0": "a61dc828dffcba5cc6a6dc68b1a3af646b9d8db047d84c3348e52fa0e45cb01675cd01ad1931ed447620b5995e8d7f71", + "source_revision": "893f4c9f306707b83f3b41782f25eb05adbc4f30", + "pcr0": "61e070dd4c7e2956affe2684413ccaa5dac8a6fb0f55ca144d9671ce578e72464e30eaf09226a3073f0a3d03a2f809c1", "pcr1": "4b4d5b3661b3efc12920900c80e126e4ce783c522de6c02a2a5bf7af3a2b9327b86776f188e4be1c1c404a129dbda493", - "pcr2": "b676515e4460e61be1f860cdb05a5852571b2c73320eff1228b70184422d3d44612c6ee405ea3511623be4a2c600b9fa" - }, - { - "source_revision": "bda15a3549b7a9fbb37004281852079e9013f73b", - "pcr0": "f9dc7325b6bfc916a1c29cbd9ba8d802d9c8270dd33db60671834a47c40451658633b573aac718ed8896694611b3ac21", - "pcr1": "4b4d5b3661b3efc12920900c80e126e4ce783c522de6c02a2a5bf7af3a2b9327b86776f188e4be1c1c404a129dbda493", - "pcr2": "9f60b8d4aa783dd8ecb7329a1fd30f597090e76615f4b11c7097fbf85a025920a65623efad80d56c410334dbabdc343a" + "pcr2": "93dabb78d8939fe34f913421bfe2423f2cff29f30504a01c9ce9b1ee5eb3334188f43b87e569daf61370d4b0a317ba69" } ], "e2ee": {