Elect new IC/GuestOS revision (commit 5e8370e)

Release Notes for release-2026-10-22_03-29-base (5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe) This release is based on changes since release-2026-10-16_03-29-base (661a9806c9eef7106475c396e6348fba63e74066).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image. Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on GitHub.

Features:

• 22aa2e692 Core Protocol: do not charge base fee for invalid calls (#11908)
• e623ec3c5 Core Protocol(crypto): add the mainnet and PocketIC master keys to ic-secp256r1 (#11895)
• 886c2fdfc Core Protocol(p2p): strip canister HTTP responses from block proposals (#11719)

Bugfixes:

• cd562ecd3 Core Protocol(p2p): use underlying bouncer's refresh period for stripped consensus messages (#11878)
• 3f40896fd Core Protocol(orchestrator): wait for processes to properly exit when restarting (#11744)
• 6df0cdbeb Core Protocol(consensus): stop gossiping unsigned CUPs (#11873)
• 439fbfdab Core Protocol(consensus): load a block proposal's payload before handing it to p2p (#11872)
• ddc89f544 Core Protocol(ic-replay): look up invalid artifacts by their actual backup file name (#11855)
• 57b358069 Node: disable DNSSEC validation in ic-gateway on all-in-one nodes (#11896)
• e87382096 Node(guestos): reboot on a kernel Oops, panic or soft lockup (#11851)

Performance improvements:

• 5e8370e0a Core Protocol: Do not include the height witness in CertifiedStreamSlice (#11901)

Chores:

Full list of changes (including the ones that are not relevant to GuestOS) can be found on GitHub.

IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (sudo apt install curl), run:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe/ci/scripts/repro-check | python3 - -c 5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe --guestos

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing --hostos to the script above instead of --guestos, or the SetupOS by passing --setupos.