fix: bump default QoS version to 0.12.0#408
Conversation
TVC no longer supports v2026.2.6 for new deployments. Update the default QoS version to v2026.6.11 in all deployment scripts and tools, and update the corresponding qos deployment rev and PCR references. Closes #407
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
| ## PCR allowlist values | ||
|
|
||
| The PCRs are determined by the qos enclave runtime version Turnkey has deployed (currently TVC `v2026.2.6`, qos commit [`d866f2c6cbc58cc08c24eab4828f0824ad16a226`](https://github.com/tkhq/qos/commit/d866f2c6cbc58cc08c24eab4828f0824ad16a226)). You can reproduce them locally from that qos rev — never trust an externally supplied PCR file without verifying it. | ||
| The PCRs are determined by the qos enclave runtime version Turnkey has deployed (currently TVC `v2026.6.11`, qos commit [`3e4d73c4d2b9bb270c457bf7eae2e76a7f420998`](https://github.com/tkhq/qos/commit/3e4d73c4d2b9bb270c457bf7eae2e76a7f420998)). You can reproduce them locally from that qos rev — never trust an externally supplied PCR file without verifying it. |
There was a problem hiding this comment.
were you able to follow the instructions on https://github.com/tkhq/qos/#reproducing-builds
to get the correct hash for PCR0 and PCR1 for this release? it should be 68acd956f0b441884248d404cc86122f8235cde197c49a3d9dcf8254167516b59fb98e1c61ea32561a6d495513cb2a01
There was a problem hiding this comment.
Yes — since your comment, the target moved from v2026.6.11 to qos 0.12.0, pinned to 4371d44e672a1322d15ef929cfd32169ebb0bd0f (the commit tagged qos_core-v0.12.0 etc. in tkhq/qos, not a timeframe guess). Followed the tkhq/qos reproducing-builds instructions via scripts/extract-nitro-pcrs.sh --rev 4371d44e672a1322d15ef929cfd32169ebb0bd0f --expected-kernel-hash <hash> — eif_build's BootMeasurement output shows PCR0 and PCR1 both matching the expected hash from a live attestation, so this rev is confirmed correct for 0.12.0. Note this is a different rev than the v2026.6.11 one your 68acd956... hash was for, since the target version itself changed.
There was a problem hiding this comment.
Manually validated as well: rebuilt at 4371d44e672a1322d15ef929cfd32169ebb0bd0f and confirmed PCR0/PCR1 against the expected hash — matches. Also worth noting: PR #411 picked up a fix for the dead skopeo digest and a fetch-by-SHA issue in extract-nitro-pcrs.sh (quay.io had GC'd the pinned skopeo manifest), which is what was blocking a clean end-to-end run of the script itself; the PCR measurement from eif_build was unaffected by that and matched independently before and after.
Validated against a live attestation: rev 4371d44e672a1322d15ef929cfd32169ebb0bd0f (the commit tagged qos_core-v0.12.0 etc. in tkhq/qos) reproduces the expected PCR0/PCR1 via scripts/extract-nitro-pcrs.sh --expected-kernel-hash.
shahan-khatchadourian-anchorage
requested review from
Copilot
and removed request for
shahan-khatchadourian-anchorage
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s default TVC/QoS deployment version references across CI workflows, the tools/tvc-deploy helper, and the PCR allowlist documentation/marker. However, the implemented version bump in code/docs is to 0.12.0, which does not match the PR title/description’s stated target of v2026.6.11 (and the referenced qos commit SHA), so the “source of truth” for the intended deployment version needs to be reconciled.
Changes:
- Bump default
qos_version/QOS_VERSIONused by TVC deploy workflows and the deploy helper fromv2026.2.6to0.12.0. - Update the
# qos-deployment-rev = ...marker insrc/Cargo.tomland the matching docs snippet to a new qos commit. - Update hosted wallet integration docs to reference the new TVC/QoS version and commit for PCR allowlist derivation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/tvc-deploy.yml |
Updates workflow_dispatch default and QOS_VERSION fallback to the new default QoS/TVC version string. |
.github/workflows/stagex.yml |
Updates the hardcoded qos_version included in generated deployment details. |
tools/tvc-deploy/src/main.rs |
Updates CLI usage text and deploy()’s default --qos-version fallback. |
src/Cargo.toml |
Updates the qos-deployment-rev marker comment/commit reference used for PCR reproduction. |
docs/wallet-integration/hosted/getting-started.mdx |
Updates the documented TVC/QoS version + commit and the marker snippet for PCR allowlist guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| qos_version: | ||
| description: "QOS version" | ||
| required: false | ||
| default: "v2026.2.6" | ||
| default: "0.12.0" |
There was a problem hiding this comment.
Updated the PR title/description to match — this now targets qos 0.12.0 (pinned to 4371d44e672a1322d15ef929cfd32169ebb0bd0f, the commit tagged qos_core-v0.12.0 etc. in tkhq/qos) rather than v2026.6.11. Reproduced the build at that rev via scripts/extract-nitro-pcrs.sh --rev 4371d44e672a1322d15ef929cfd32169ebb0bd0f --expected-kernel-hash <hash> and confirmed PCR0/PCR1 match a live attestation, so this is a validated rev rather than the original timeframe guess.
| # match. The deployment rev currently tracks TVC 0.12.0: | ||
| # https://github.com/tkhq/qos/commit/4371d44e672a1322d15ef929cfd32169ebb0bd0f | ||
| # scripts/extract-nitro-pcrs.sh reads the marker line below to reproduce them. | ||
| # qos-deployment-rev = d866f2c6cbc58cc08c24eab4828f0824ad16a226 | ||
| # qos-deployment-rev = 4371d44e672a1322d15ef929cfd32169ebb0bd0f |
There was a problem hiding this comment.
Same reconciliation as the tvc-deploy.yml thread: the target is now qos 0.12.0 at 4371d44e672a1322d15ef929cfd32169ebb0bd0f (tagged qos_core-v0.12.0 etc.), not v2026.6.11/3e4d73c4d2b9bb270c457bf7eae2e76a7f420998. PR title/description updated to match. This rev's PCR0/PCR1 are validated against a live attestation — see the reply on the tvc-deploy.yml thread for the exact command.
shahan-khatchadourian-anchorage
changed the title
|
Ready for re-review @prasanna-anchorage. Thanks |
|
TVC version 0.12.0 has been verified with a successful deployment. |
TVC rejected new deployments using the
v2026.2.6QoS version — it is no longer supported. This PR moves the default to qos0.12.0(Turnkey's current versioning scheme), pinned to the exact commit taggedqos_core-v0.12.0/qos_client-v0.12.0/etc. intkhq/qos.Originally this bumped to a guessed main-branch commit from the
v2026.6.11timeframe (see review discussion below) without a validated PCR match. That's now replaced with a tag-verified rev, confirmed against a live attestation.Changes
.github/workflows/tvc-deploy.yml— updateworkflow_dispatchinput default and theQOS_VERSIONenv fallback to0.12.0.github/workflows/stagex.yml— update hardcodedqos_versionin the deployment-details generation step to0.12.0tools/tvc-deploy/src/main.rs— update usage string andunwrap_ordefault indeploy()to0.12.0src/Cargo.toml— update# qos-deployment-revmarker and surrounding comment to4371d44e672a1322d15ef929cfd32169ebb0bd0f(the commit taggedqos_core-v0.12.0etc. in tkhq/qos)docs/wallet-integration/hosted/getting-started.mdx— update TVC version and qos commit link used for PCR allowlist derivationValidation
Reproduced the enclave build at
4371d44e672a1322d15ef929cfd32169ebb0bd0fviascripts/extract-nitro-pcrs.sh --rev 4371d44e672a1322d15ef929cfd32169ebb0bd0f --expected-kernel-hash <hash>.eif_build'sBootMeasurementoutput shows PCR0 and PCR1 both matching the expected hash from a live attestation, confirming this is the correct deployment rev for qos 0.12.0.