Release Notes for [release-2026-01-08_03-31-base](https://github.com/dfinity/ic/tree/release-2026-01-08_03-31-base) (`035a2c7a2b19bc7ce7c4d977169583eb64b0e3cb`)
This release is based on changes since [release-2025-12-04_03-28-base](https://dashboard.internetcomputer.org/release/d2a13f0ecb29c96818d24076925d5da19ae61e93) (`d2a13f0ecb29c96818d24076925d5da19ae61e93`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2025-12-04_03-28-base...release-2026-01-08_03-31-base).
## Features:
* [`39c83f8d8`](https://github.com/dfinity/ic/commit/39c83f8d8) Consensus: IDKG hashes in blocks assembler & stripper ([#7849](https://github.com/dfinity/ic/pull/7849))
* [`4d85b92ef`](https://github.com/dfinity/ic/commit/4d85b92ef) Consensus: include metrics in the http adapter response ([#7996](https://github.com/dfinity/ic/pull/7996))
* [`f4dab55a2`](https://github.com/dfinity/ic/commit/f4dab55a2) Consensus: adding a QR code encoding for a node id during registration ([#7930](https://github.com/dfinity/ic/pull/7930))
* [`1de942dcd`](https://github.com/dfinity/ic/commit/1de942dcd) Consensus,DSM: Move `requires_full_state_hash` inside `BatchContent::Data` variant ([#8019](https://github.com/dfinity/ic/pull/8019))
* [`305127ee1`](https://github.com/dfinity/ic/commit/305127ee1) Interface(governance): Added BlessAlternativeGuestOsVersion proposal type. ([#7904](https://github.com/dfinity/ic/pull/7904))
* [`46f8d1da5`](https://github.com/dfinity/ic/commit/46f8d1da5) Node: Support multiple expected_chip_ids in verify_attestation_package ([#8220](https://github.com/dfinity/ic/pull/8220))
* [`290088bcd`](https://github.com/dfinity/ic/commit/290088bcd) Node: manual recovery short hashes ([#8025](https://github.com/dfinity/ic/pull/8025))
* [`c5db30a09`](https://github.com/dfinity/ic/commit/c5db30a09) Node: Rootless podman for image builds ([#7983](https://github.com/dfinity/ic/pull/7983))
* [`727986765`](https://github.com/dfinity/ic/commit/727986765) Node: Add ACME-ALPN test ([#7947](https://github.com/dfinity/ic/pull/7947))
* [`3f1d9c0ab`](https://github.com/dfinity/ic/commit/3f1d9c0ab) DSM: Refactoring for Deterministic Memory Tracker ([#8095](https://github.com/dfinity/ic/pull/8095))
* [`ee2387d97`](https://github.com/dfinity/ic/commit/ee2387d97) DSM: Introduce a new subnet split marker ([#7999](https://github.com/dfinity/ic/pull/7999))
* [`9c8a57360`](https://github.com/dfinity/ic/commit/9c8a57360) DSM: Subnet splitting in the DSM ([#7836](https://github.com/dfinity/ic/pull/7836))
* [`c6e45eae8`](https://github.com/dfinity/ic/commit/c6e45eae8) DSM: lazy initialization for log_memory_store to avoid unnecessary log-memory charges ([#7982](https://github.com/dfinity/ic/pull/7982))
## Bugfixes:
* [`3034c5c54`](https://github.com/dfinity/ic/commit/3034c5c54) Consensus: revert "chore: rust 1.90.0 -> 1.91.1 ([#8023](https://github.com/dfinity/ic/pull/8023))" ([#8197](https://github.com/dfinity/ic/pull/8197))
* [`f8cb61d95`](https://github.com/dfinity/ic/commit/f8cb61d95) Consensus(crypto): improve error mapping for BasicSigner::sign_basic ([#8036](https://github.com/dfinity/ic/pull/8036))
* [`130fdd4f7`](https://github.com/dfinity/ic/commit/130fdd4f7) Consensus(orchestrator): fix error message formatting ([#8061](https://github.com/dfinity/ic/pull/8061))
* [`574c0da36`](https://github.com/dfinity/ic/commit/574c0da36) Consensus: orchestrator uses correct IC root key in testnet ([#5841](https://github.com/dfinity/ic/pull/5841))
* [`a1849f692`](https://github.com/dfinity/ic/commit/a1849f692) Consensus(crypto): remove debug_asserts in BLS12_381 caches ([#8042](https://github.com/dfinity/ic/pull/8042))
* [`01de193aa`](https://github.com/dfinity/ic/commit/01de193aa) Consensus(crypto): use correct vault type when building temp crypto ([#7869](https://github.com/dfinity/ic/pull/7869))
* [`a0b0c8eb3`](https://github.com/dfinity/ic/commit/a0b0c8eb3) Node: Fix loop device race conditions and add retries in our device util ([#8001](https://github.com/dfinity/ic/pull/8001))
* [`75736bddc`](https://github.com/dfinity/ic/commit/75736bddc) Node: Ignore failure to cleanup tmpdir ([#8102](https://github.com/dfinity/ic/pull/8102))
* [`ed554cbfe`](https://github.com/dfinity/ic/commit/ed554cbfe) Node(ic-boundary): start polling the registry client ([#8045](https://github.com/dfinity/ic/pull/8045))
## Performance improvements:
* [`ec47db6f5`](https://github.com/dfinity/ic/commit/ec47db6f5) Consensus(crypto): Avoid adding into the identity element during BLS12-381 multiplication ([#7951](https://github.com/dfinity/ic/pull/7951))
* [`6189a7c75`](https://github.com/dfinity/ic/commit/6189a7c75) Consensus(crypto): Use affine rather than projective points for BLS12-381 signture protocols ([#7969](https://github.com/dfinity/ic/pull/7969))
* [`4032584e1`](https://github.com/dfinity/ic/commit/4032584e1) Consensus(crypto): Add a cache for G2Prepared ([#7967](https://github.com/dfinity/ic/pull/7967))
* [`dcf9455bd`](https://github.com/dfinity/ic/commit/dcf9455bd) Consensus(crypto): construct DerivationPath from ExtendedDerivationPath in tECDSA/tSchnorr without cloning where possible ([#7327](https://github.com/dfinity/ic/pull/7327))
* [`a6b8f633d`](https://github.com/dfinity/ic/commit/a6b8f633d) Consensus(crypto): Add variable-time scalar multiplication for BLS12-381 ([#7912](https://github.com/dfinity/ic/pull/7912))
## Chores:
* [`186448b18`](https://github.com/dfinity/ic/commit/186448b18) Consensus: Return `ProxyDecodeError` when converting NiDkg proto types ([#8239](https://github.com/dfinity/ic/pull/8239))
* [`ac97d936a`](https://github.com/dfinity/ic/commit/ac97d936a) Consensus: Use pem crate in threshold sig der utilities ([#8155](https://github.com/dfinity/ic/pull/8155))
* [`cc5627520`](https://github.com/dfinity/ic/commit/cc5627520) Consensus: rust: 1.90.0 -> 1.92.0  ([#8124](https://github.com/dfinity/ic/pull/8124))
* [`54346da4e`](https://github.com/dfinity/ic/commit/54346da4e) Consensus(crypto): Remove manual implementations of Eq/PartialEq ([#8161](https://github.com/dfinity/ic/pull/8161))
* [`3eba24c26`](https://github.com/dfinity/ic/commit/3eba24c26) Consensus(crypto): Make KeyId from MEGaPublicKey conversion infalliable ([#8180](https://github.com/dfinity/ic/pull/8180))
* [`6f73a21b5`](https://github.com/dfinity/ic/commit/6f73a21b5) Consensus: rust 1.90.0 -> 1.91.1 ([#8023](https://github.com/dfinity/ic/pull/8023))
* [`b66b2f7ca`](https://github.com/dfinity/ic/commit/b66b2f7ca) Consensus(bitcoin/dogecoin): use published crate bitcoin-dogecoin ([#8167](https://github.com/dfinity/ic/pull/8167))
* [`a89a7a5f5`](https://github.com/dfinity/ic/commit/a89a7a5f5) Consensus: Set correct scope for FS encryption keys. ([#8129](https://github.com/dfinity/ic/pull/8129))
* [`48cbb5b8e`](https://github.com/dfinity/ic/commit/48cbb5b8e) Consensus(crypto): Type hash2curve domain separators as &'static str ([#8074](https://github.com/dfinity/ic/pull/8074))
* [`f093cfcfd`](https://github.com/dfinity/ic/commit/f093cfcfd) Consensus: Rename Placeholder variant of Algorithm ID to Unspecified ([#8034](https://github.com/dfinity/ic/pull/8034))
* [`73ae86d40`](https://github.com/dfinity/ic/commit/73ae86d40) Consensus: Remove placeholder to delete ([#8026](https://github.com/dfinity/ic/pull/8026))
* [`5889bb4e2`](https://github.com/dfinity/ic/commit/5889bb4e2) Consensus(crypto): Fix some incorrect Rustdoc comments ([#8005](https://github.com/dfinity/ic/pull/8005))
* [`59ab429d9`](https://github.com/dfinity/ic/commit/59ab429d9) Consensus: Use `CryptoComponentForVerificationOnly` in CUP verification tool ([#7959](https://github.com/dfinity/ic/pull/7959))
* [`fa973f837`](https://github.com/dfinity/ic/commit/fa973f837) Node: Consume config directly without untarring (Guest) ([#8234](https://github.com/dfinity/ic/pull/8234))
* [`091e8030c`](https://github.com/dfinity/ic/commit/091e8030c) Node: Update Base Image Refs [2026-01-01-0805] ([#8203](https://github.com/dfinity/ic/pull/8203))
* [`de6cc72ea`](https://github.com/dfinity/ic/commit/de6cc72ea) Node: Update Base Image Refs [2025-12-25-0804] ([#8193](https://github.com/dfinity/ic/pull/8193))
* [`af1e9951d`](https://github.com/dfinity/ic/commit/af1e9951d) Node: Add debug logging of inactive (stuck) domains ([#8101](https://github.com/dfinity/ic/pull/8101))
* [`716fcb8b4`](https://github.com/dfinity/ic/commit/716fcb8b4) Node: remove deployment_json logging references ([#8160](https://github.com/dfinity/ic/pull/8160))
* [`7b28ae39f`](https://github.com/dfinity/ic/commit/7b28ae39f) Node: Update Base Image Refs [2025-12-18-0804] ([#8119](https://github.com/dfinity/ic/pull/8119))
* [`5fd99f3b5`](https://github.com/dfinity/ic/commit/5fd99f3b5) Node: Refactor & cleanup `ic-boundary` ([#8038](https://github.com/dfinity/ic/pull/8038))
* [`43c193cc0`](https://github.com/dfinity/ic/commit/43c193cc0) Node: Remove deprecated VM fields ([#7037](https://github.com/dfinity/ic/pull/7037))
* [`bdd082227`](https://github.com/dfinity/ic/commit/bdd082227) Node: Add upgrade_hostos vsock logging ([#7971](https://github.com/dfinity/ic/pull/7971))
* [`68ba011da`](https://github.com/dfinity/ic/commit/68ba011da) Node: Update Base Image Refs [2025-12-04-0804] ([#7935](https://github.com/dfinity/ic/pull/7935))
* [`a6b741e32`](https://github.com/dfinity/ic/commit/a6b741e32) DSM: Remove `wee_alloc` ([#8126](https://github.com/dfinity/ic/pull/8126))
* [`6f0f05b5b`](https://github.com/dfinity/ic/commit/6f0f05b5b) DSM: Make snapshot mgmt signatures more homogeneous ([#8213](https://github.com/dfinity/ic/pull/8213))
* [`044e5448a`](https://github.com/dfinity/ic/commit/044e5448a) DSM: Remove `wasmtime_environ` crate ([#8121](https://github.com/dfinity/ic/pull/8121))
* [`a86a265ff`](https://github.com/dfinity/ic/commit/a86a265ff) DSM: add log_memory_limit to canister system_state and checkpoint proto ([#8120](https://github.com/dfinity/ic/pull/8120))
* [`fcce6f1e0`](https://github.com/dfinity/ic/commit/fcce6f1e0) DSM: rename feature flag to log_memory_store_feature ([#8131](https://github.com/dfinity/ic/pull/8131))
* [`bc399aa74`](https://github.com/dfinity/ic/commit/bc399aa74) DSM: Move memory_tracker tests ([#8098](https://github.com/dfinity/ic/pull/8098))
* [`53bf5468f`](https://github.com/dfinity/ic/commit/53bf5468f) DSM: Make backtrace tests robust to compiler changes ([#8033](https://github.com/dfinity/ic/pull/8033))
* [`733cac2dc`](https://github.com/dfinity/ic/commit/733cac2dc) DSM: More detailed state sync download metrics ([#8037](https://github.com/dfinity/ic/pull/8037))
* [`05b216859`](https://github.com/dfinity/ic/commit/05b216859) DSM: Metric for routing table fragmentation ([#8067](https://github.com/dfinity/ic/pull/8067))
* [`ba498cf69`](https://github.com/dfinity/ic/commit/ba498cf69) DSM: Populate state size metric on startup ([#8072](https://github.com/dfinity/ic/pull/8072))
* [`8942bd4a2`](https://github.com/dfinity/ic/commit/8942bd4a2) DSM(canister_logging): remove unneeded explicit log_memory_limit from canister state ([#7922](https://github.com/dfinity/ic/pull/7922))
## Refactoring:
* [`71e0570f4`](https://github.com/dfinity/ic/commit/71e0570f4) Consensus: Remove panics on error conversion ([#8123](https://github.com/dfinity/ic/pull/8123))
* [`2f9d65a77`](https://github.com/dfinity/ic/commit/2f9d65a77) Consensus: Consolidate and refactor threshold conversion utilities ([#8051](https://github.com/dfinity/ic/pull/8051))
* [`810c794b3`](https://github.com/dfinity/ic/commit/810c794b3) Consensus: Remove panics in error conversion function ([#8130](https://github.com/dfinity/ic/pull/8130))
* [`3c10cd42f`](https://github.com/dfinity/ic/commit/3c10cd42f) Consensus(crypto): remove obsolete params in BasicSigner::sign_basic ([#7992](https://github.com/dfinity/ic/pull/7992))
* [`375b55628`](https://github.com/dfinity/ic/commit/375b55628) Consensus(crypto): remove CSP layer for basic-sig signing ([#7966](https://github.com/dfinity/ic/pull/7966))
* [`1e4b31032`](https://github.com/dfinity/ic/commit/1e4b31032) Consensus(ic-recovery): rsync include-list instead of exclude-list ([#7587](https://github.com/dfinity/ic/pull/7587))
* [`d13be5a27`](https://github.com/dfinity/ic/commit/d13be5a27) Consensus(crypto): simplify BasicSignatureCspVault API by using vault's node signing pubkey to calculate key ID ([#7918](https://github.com/dfinity/ic/pull/7918))
* [`bafc2fda6`](https://github.com/dfinity/ic/commit/bafc2fda6) DSM: Simplify snapshot checkpointing ([#7998](https://github.com/dfinity/ic/pull/7998))
## Tests:
* [`2e062e38d`](https://github.com/dfinity/ic/commit/2e062e38d) Consensus(mainnet-nns): reintroduction of the mainnet NNS testnet ([#8170](https://github.com/dfinity/ic/pull/8170))
* [`3ecd95fe4`](https://github.com/dfinity/ic/commit/3ecd95fe4) Consensus: Add stability test for Crypto Hash ([#8003](https://github.com/dfinity/ic/pull/8003))
* [`035a2c7a2`](https://github.com/dfinity/ic/commit/035a2c7a2) Node: add OSConfig Default traits ([#8204](https://github.com/dfinity/ic/pull/8204))
## Documentation:
## Other changes:

---
**Note**: As of [`af40c80b4`](https://github.com/dfinity/ic/commit/af40c80b4), `repro-check` now includes validation of GuestOS measurements automatically.
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/fb9ce64a0d4ee3400318c0d098e280dff958c699/replica-releases/035a2c7a2b19bc7ce7c4d977169583eb64b0e3cb.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/035a2c7a2b19bc7ce7c4d977169583eb64b0e3cb/ci/scripts/repro-check | python3 - -c 035a2c7a2b19bc7ce7c4d977169583eb64b0e3cb --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
