4.0.18

Dependencies

• Updated Open Enclave to 0.19.6.

5.0.0-dev18

Added

• Added TypeScript TypedKvSet and ccfapp.typedKv<K> to facilitate set handling from application code.
• Added support for UVM endorsements signed with EC keys (#6231).
• Updated Open Enclave to 0.19.6.

Removed

• Removed unused openenclave.verifyOpenEnclaveEvidence API from JS/TS

Changed

• Added token.iss claim validation to JWT authentication (#5809). Must-knows:
• Supports both the OpenID requirements and the Entra specification of it.
• All keys fetched after the upgrade will not work against tokens missing the 'iss' claim if the issuer has been specified in the .well-known/openid-configuration/.
• Due to an internal schema change, networks that are in the process of upgrading to this version may see inconsistent authorization behaviour while the network contains nodes of different versions (depending which node executes the auto-refresh, any nodes on the other version will not use any newly provided keys). We recommend a full upgrade to this version, removing any nodes on prior versions, followed by a key and issuer refresh.
• A future release will remove the old tables entirely. Until then, some redundant state will be retained in the ledger. This is tracked in #6222.

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime

5.0.0-dev17

Added

• Moved JS registry to public header ccf/js/registry.h. Apps should subclass ccf::js::DynamicJSEndpointRegistry to get similar behaviour to the existing JS Generic app.

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime

4.0.17

Dependencies

• Updated base image

5.0.0-dev16

Added

• Reusable functionality for creating an in-enclave JS interpreter has been added to the public C++ API. Applications should subclass CustomJSEndpointRegistry to get similar behaviour to the existing JS Generic app.

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime

5.0.0-dev15

Added

• CCF now supports a mode where HTTP redirect responses are returned, rather than relying on internal forwarding. See docs for description of redirection behaviour and migration instructions.
• Authentication policies can now be conjoined (AND) together, in addition to the previous disjoint (OR) behaviour. The new ccf::AllOfAuthnPolicy takes a collection of other policies, all of which must be true for this auth policy to pass. In JS, this can be configured in the app.json as "authn_policies": [{ "all_of": ["policy_a", "policy_b"] }].

Changed

• proposalId is now passed to resolve(proposal, proposerId, votes, proposalId), allowing proposals to consider other pending proposals in their resolution process. (#5995)
• The current state of an accepted proposal is written to the KV so that it can be accessed in the constitution's apply(proposal, proposalId) function (#6114).

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime

4.0.16

Dependencies

• Updated base image

5.0.0-dev14

Added

• Added a ccfapp.checkedJson converter to the CCF TypeScript package, which will raise errors when given objects which cannot be roundtrip-converted through JSON (currently Map and Date). There is a slight cost to checking this on each instance during encode, so the behaviour is opt-in (not directly replacing ccfapp.json), but it is recommended that most tables update to use this converter.

Removed

• The scurl.sh script has been removed. With #5137 removing support for HTTP signed requests, it is no longer needed.

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime

4.0.15

Fixed

• Improvements to the Raft implementation, to retain commit safety and liveness despite message loss (#6016).

Added

• Added 2 new log lines which may be helpful diagnostics in production deployments, both including a new [rollback] tag.
• [rollback] ... Dropping conflicting branch may be emitted after network partitions, and indicates that some Pending (non-committed) transactions have been lost. This is expected, but worth investigating if it occurs regularly - it is a sign of elections impacting service availability.
• [rollback] ... Ignoring conflicting AppendEntries could also be emitted after a network partition, but should be reported to the CCF development team. It is a sign of an unexpected execution path, which could lead to loss of liveness (inability to advance commit).

Dependencies

• The CCF Python package now requires cryptography 42.*

5.0.0-dev13

Fixed

• Improvements to the Raft implementation, to retain commit safety and liveness despite message loss (#6016).

Added

• Added 2 new log lines which may be helpful diagnostics in production deployments, both including a new [rollback] tag.
• [rollback] ... Dropping conflicting branch may be emitted after network partitions, and indicates that some Pending (non-committed) transactions have been lost. This is expected, but worth investigating if it occurs regularly - it is a sign of elections impacting service availability.
• [rollback] ... Ignoring conflicting AppendEntries could also be emitted after a network partition, but should be reported to the CCF development team. It is a sign of an unexpected execution path, which could lead to loss of liveness (inability to advance commit).

MCR Docker Images: App Development, C++ Runtime, TypeScript/JavaScript Runtime