Release Notes for [release-2026-03-02_11-09-base](https://github.com/dfinity/ic/tree/release-2026-03-02_11-09-base) (`781ef50bd6bfbcfac6769b55361d0624247009c1`)
This release is based on changes since [release-2026-02-20_12-29-base](https://dashboard.internetcomputer.org/release/007c473c9c7fc820c49eea5c823cdd4b9404119d) (`007c473c9c7fc820c49eea5c823cdd4b9404119d`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-02-20_12-29-base...release-2026-03-02_11-09-base).
## Features:
* [`26f735180`](https://github.com/dfinity/ic/commit/26f735180) Consensus(recovery): support provisioning write-access SSH keys in ic-recovery ([#8718](https://github.com/dfinity/ic/pull/8718))
* [`76ab42530`](https://github.com/dfinity/ic/commit/76ab42530) Consensus(flexible-outcalls): extend canister HTTP pool manager for flexible calls ([#9024](https://github.com/dfinity/ic/pull/9024))
* [`161cf2e3c`](https://github.com/dfinity/ic/commit/161cf2e3c) Consensus: add `max_ingress_bytes_per_block` field to `SubnetRecord` entry in the registry ([#8746](https://github.com/dfinity/ic/pull/8746))
* [`6e76c3214`](https://github.com/dfinity/ic/commit/6e76c3214) Consensus: use witness instead of locally computed hash to validate certification (shares) ([#8651](https://github.com/dfinity/ic/pull/8651))
* [`8df30096d`](https://github.com/dfinity/ic/commit/8df30096d) Consensus,DSM(flexible-outcalls): generate CanisterHttpRequestContext from flexible args ([#9019](https://github.com/dfinity/ic/pull/9019))
* [`1978b8404`](https://github.com/dfinity/ic/commit/1978b8404) Consensus,DSM(flexible-outcalls): extend CanisterHttpRequestContext for flexible calls ([#9001](https://github.com/dfinity/ic/pull/9001))
* [`ffb06668a`](https://github.com/dfinity/ic/commit/ffb06668a) Node: Bypass `veritysetup verify` for non-SEV guests ([#9058](https://github.com/dfinity/ic/pull/9058))
* [`b56ffb3dd`](https://github.com/dfinity/ic/commit/b56ffb3dd) Node: Add cloud provisioning to GuestOS ([#9025](https://github.com/dfinity/ic/pull/9025))
* [`6276352e9`](https://github.com/dfinity/ic/commit/6276352e9) DSM: Make ECDSA/Schnorr request queue size dynamic with available pre-signatures ([#9059](https://github.com/dfinity/ic/pull/9059))
* [`7a6e6343b`](https://github.com/dfinity/ic/commit/7a6e6343b) DSM: Check subnet admins in deterministic state machine ([#8912](https://github.com/dfinity/ic/pull/8912))
* [`1af160785`](https://github.com/dfinity/ic/commit/1af160785) DSM: no state hashing during catch-up (state manager) ([#8424](https://github.com/dfinity/ic/pull/8424))
## Bugfixes:
* [`fc6c2b583`](https://github.com/dfinity/ic/commit/fc6c2b583) Consensus: deflake //rs/tests/consensus:cup_explorer_test ([#8992](https://github.com/dfinity/ic/pull/8992))
* [`ac7059aaf`](https://github.com/dfinity/ic/commit/ac7059aaf) DSM: More consistent `remaining_canisters` ([#9095](https://github.com/dfinity/ic/pull/9095))
* [`a85239af7`](https://github.com/dfinity/ic/commit/a85239af7) DSM: ensure that mgmt canister updates round limits consistently with charged instructions ([#8887](https://github.com/dfinity/ic/pull/8887))
## Performance improvements:
* [`253d3fc2d`](https://github.com/dfinity/ic/commit/253d3fc2d) Consensus(crypto): Optimize NIDKG decryption step ([#9036](https://github.com/dfinity/ic/pull/9036))
* [`c2dc730a6`](https://github.com/dfinity/ic/commit/c2dc730a6) Consensus: Use multi-threading to aggregate ECDSA/Schnorr signature shares ([#9049](https://github.com/dfinity/ic/pull/9049))
## Chores:
* [`ab5e7a48c`](https://github.com/dfinity/ic/commit/ab5e7a48c) Consensus,Node: fix mentions of API endpoints ([#9003](https://github.com/dfinity/ic/pull/9003))
* [`9b7c5fad5`](https://github.com/dfinity/ic/commit/9b7c5fad5) Node: Misc podman cleanup ([#8955](https://github.com/dfinity/ic/pull/8955))
* [`545be5af3`](https://github.com/dfinity/ic/commit/545be5af3) Node: Update Base Image Refs [2026-02-26-0812] ([#9050](https://github.com/dfinity/ic/pull/9050))
* [`ada678b2c`](https://github.com/dfinity/ic/commit/ada678b2c) Node: Update Base Image Refs [2026-02-26-0146] ([#9048](https://github.com/dfinity/ic/pull/9048))
* [`ed4631b2f`](https://github.com/dfinity/ic/commit/ed4631b2f) Node: Purge unused icos packages ([#9032](https://github.com/dfinity/ic/pull/9032))
* [`af5d32cd8`](https://github.com/dfinity/ic/commit/af5d32cd8) Node: Remove unused ic-os packages ([#8757](https://github.com/dfinity/ic/pull/8757))
* [`b7f927314`](https://github.com/dfinity/ic/commit/b7f927314) Node: Update Base Image Refs [2026-02-20-1632] ([#8973](https://github.com/dfinity/ic/pull/8973))
* [`8939921b2`](https://github.com/dfinity/ic/commit/8939921b2) DSM: enable subnet admins for cloud engines in DSM ([#9071](https://github.com/dfinity/ic/pull/9071))
* [`de277fd70`](https://github.com/dfinity/ic/commit/de277fd70) DSM: add new cloud engine subnet type ([#8892](https://github.com/dfinity/ic/pull/8892))
## Refactoring:
* [`d1a81e6ac`](https://github.com/dfinity/ic/commit/d1a81e6ac) Consensus,DSM(flexible-outcalls): remove obsolete subnet_size param from context's generate_from_args ([#9037](https://github.com/dfinity/ic/pull/9037))
* [`5e48a7da8`](https://github.com/dfinity/ic/commit/5e48a7da8) DSM: Move `CanisterIngressQueueLatencies` into `scheduler_metrics.rs` ([#9057](https://github.com/dfinity/ic/pull/9057))
* [`e361a68e6`](https://github.com/dfinity/ic/commit/e361a68e6) DSM: Move `ReplicatedStateMetrics` into `ic-replicated-state` ([#9029](https://github.com/dfinity/ic/pull/9029))
* [`68651de46`](https://github.com/dfinity/ic/commit/68651de46) DSM: ExecutionEnvironment::execute_subnet_message returns ExecuteSubnetMessageResultType ([#8858](https://github.com/dfinity/ic/pull/8858))
* [`00501eb9f`](https://github.com/dfinity/ic/commit/00501eb9f) DSM: Unify checks around freezing threshold with common function ([#8921](https://github.com/dfinity/ic/pull/8921))
* [`1f8fde21d`](https://github.com/dfinity/ic/commit/1f8fde21d) DSM: Drop `AbortedExecution::Response` variant ([#9017](https://github.com/dfinity/ic/pull/9017))
* [`cb6c4c6b8`](https://github.com/dfinity/ic/commit/cb6c4c6b8) DSM: Incremental scheduler refactoring ([#9002](https://github.com/dfinity/ic/pull/9002))
## Tests:
* [`93d8c493d`](https://github.com/dfinity/ic/commit/93d8c493d) Consensus(crypto): Add various missing NI-DKG verification tests ([#8406](https://github.com/dfinity/ic/pull/8406))
* [`17ac1b73a`](https://github.com/dfinity/ic/commit/17ac1b73a) Consensus: stop validating all blocks when `maliciously_notarize_all` flag is set ([#9000](https://github.com/dfinity/ic/pull/9000))
* [`2fa2c6e05`](https://github.com/dfinity/ic/commit/2fa2c6e05) DSM: StateManagerTesting::commit_and_certify_at_height ([#9022](https://github.com/dfinity/ic/pull/9022))
## Documentation:
## Other changes:
* [`4bb874fc5`](https://github.com/dfinity/ic/commit/4bb874fc5) Node: "chore(node): Remove unused ic-os packages" ([#9026](https://github.com/dfinity/ic/pull/9026))
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/011bad852e52abc1a9e4fe6d0d8083fc6293eba8/replica-releases/781ef50bd6bfbcfac6769b55361d0624247009c1.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/781ef50bd6bfbcfac6769b55361d0624247009c1/ci/scripts/repro-check | python3 - -c 781ef50bd6bfbcfac6769b55361d0624247009c1 --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
