Flashbox: Use attested TLS proxy 2.0.2 and update documentation and release pipeline for new measurement flow - #189
Draft
ameba23 wants to merge 6 commits into
Conversation
ameba23
commented
Aug 3, 2026
| > Note: at the time of the writing, those measurements were acquired by building from commit ef5dd2727ba4569d530c67822dc96778f54a295a, if you're viewing this from main branch please ensure to build from the same commit to get the same measurements. | ||
| Check that the contents of this file is identical to the same file in the [release assets of the flashbots-image release](https://github.com/flashbots/flashbots-images/releases) you are building. | ||
|
|
||
| > Note: at the time of the writing, compiling flashbox-l1 image is not reproducible if building under ARM mac with Rosetta. Please use x86_64 Linux for now. |
Contributor
Author
There was a problem hiding this comment.
Is this still the case?
ameba23
commented
Aug 3, 2026
| echo " curl -si http://127.0.0.1:8080 | grep -q X-Flashbots-Measurement && echo '✅ VM matches YOUR build' || echo '❌ mismatch'" | ||
| echo " git clone https://github.com/flashbots/attested-tls-proxy" | ||
| echo " cd attested-tls-proxy" | ||
| printf '%s\n' " cargo run -- attested-get --allow-self-signed --measurements-file ../build/portable_measurements.json <your-instance-ip>:8745/pubkey && printf '\\n✅ VM matches YOUR build\\n'" |
Contributor
Author
There was a problem hiding this comment.
I had issues with escaping the newlines, so using printf rather than echo.
Member
There was a problem hiding this comment.
@pablin-10 could you check and assist @ameba23 with this issue please?
Contributor
There was a problem hiding this comment.
This did the trick:
Tested here:
https://github.com/flashbots/flashbots-images/releases/tag/untagged-5f9a1c1936f63a5f30dc
I've cherry-picked over here
ameba23
force-pushed
the
peg/flashbox-use-attested-tls-proxy-2.0.0
branch
from
August 3, 2026 11:36
5db5b08 to
9cf6af9
Compare
ameba23
changed the title
Contributor
Author
|
@pablin-10 found an blocking issue: Easy-TEE/attest#20 I am converting this back to draft until this is fixed |
ameba23
marked this pull request as draft
August 14, 2026 07:55
pablin-10
marked this pull request as ready for review
August 14, 2026 13:13
pablin-10
marked this pull request as draft
August 14, 2026 13:13
pablin-10
approved these changes
Aug 14, 2026
pablin-10
left a comment
pablin-10
left a comment
Contributor
There was a problem hiding this comment.
Tested and working, missing a fix on attest only, and I think we can merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This makes Flashbox use the latest release of attested-tls-proxy which accepts 'portable' measurement policies where OS image hashes rather than TDX measurement values are specified.
It updates the documentation explaining how to build these hashes and check them against an attestation from a flashbox deployment.
It also updates the release pipeline to include these 'portable' measurements rather than TDX measurement values.
Note this targets #185 - so i am trying out stacked PRs for the first time here.
I have tested it with a basic Flashbox-L1 deployment and was able to successfully validate against portable hashes. But i have not made a test release of flashbots-images to check the changes to the release pipeline.
Edit: Updated to attested-tls-proxy 2.0.2 which updates dcap-qvl to mitigate INTEL-SA-01421. Tested on a flashbox-l1 GCP deployment.