Release Notes for [release-2025-12-04_03-28-base](https://github.com/dfinity/ic/tree/release-2025-12-04_03-28-base) (`d2a13f0ecb29c96818d24076925d5da19ae61e93`)
This release is based on changes since [release-2025-11-28_03-22-base](https://dashboard.internetcomputer.org/release/724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12) (`724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2025-11-28_03-22-base...release-2025-12-04_03-28-base).
## Features:
* [`1e47fe611`](https://github.com/dfinity/ic/commit/1e47fe611) Consensus: Insert stripped IDKG dealings into `BlockProposalAssembler` ([#7794](https://github.com/dfinity/ic/pull/7794))
* [`de1ac3801`](https://github.com/dfinity/ic/commit/de1ac3801) Consensus: Generalize ingress downloader to also download stripped IDKG dealings ([#7732](https://github.com/dfinity/ic/pull/7732))
* [`d89af621c`](https://github.com/dfinity/ic/commit/d89af621c) DSM(execution_environment): Allow msg_reject_code in call_on_cleanup ([#6915](https://github.com/dfinity/ic/pull/6915))
* [`11ee162e3`](https://github.com/dfinity/ic/commit/11ee162e3) DSM: take canister snapshot and uninstall code ([#7898](https://github.com/dfinity/ic/pull/7898))
* [`84e1d7689`](https://github.com/dfinity/ic/commit/84e1d7689) DSM(canister_logging): add log_memory_store implementation, no-op ([#7842](https://github.com/dfinity/ic/pull/7842))
## Bugfixes:
* [`a690f571f`](https://github.com/dfinity/ic/commit/a690f571f) Consensus(btc-adapter): increase on-disk header cache DB size limit ([#7901](https://github.com/dfinity/ic/pull/7901))
* [`3be1e4225`](https://github.com/dfinity/ic/commit/3be1e4225) Consensus,Node(node): Prevent generate-ic-config from restarting when ic-replica restarts ([#7910](https://github.com/dfinity/ic/pull/7910))
* [`82e0282ba`](https://github.com/dfinity/ic/commit/82e0282ba) DSM: replay attacks after canister migration ([#7787](https://github.com/dfinity/ic/pull/7787))
* [`c9a63164c`](https://github.com/dfinity/ic/commit/c9a63164c) DSM: bundle state manager and state dir together in StateMachine tests ([#7845](https://github.com/dfinity/ic/pull/7845))
* [`86c4ed2de`](https://github.com/dfinity/ic/commit/86c4ed2de) DSM: Fix checkpointing after snapshot upload ([#7857](https://github.com/dfinity/ic/pull/7857))
## Performance improvements:
* [`785c587ed`](https://github.com/dfinity/ic/commit/785c587ed) Consensus(crypto): Add affine Pippenger's implementation for BLS12-381 ([#7911](https://github.com/dfinity/ic/pull/7911))
* [`da042ad6f`](https://github.com/dfinity/ic/commit/da042ad6f) Consensus(crypto): Use multiscalar multiplication during NIDKG transcript creation ([#7913](https://github.com/dfinity/ic/pull/7913))
* [`c677e04d2`](https://github.com/dfinity/ic/commit/c677e04d2) Consensus(crypto): adapt VetKdArgs to only hold references ([#7356](https://github.com/dfinity/ic/pull/7356))
* [`f5671dfba`](https://github.com/dfinity/ic/commit/f5671dfba) DSM(canister_logging): cache RingBuffer header to avoid repeated PageMap reads ([#7909](https://github.com/dfinity/ic/pull/7909))
## Chores:
* [`dc7e11822`](https://github.com/dfinity/ic/commit/dc7e11822) Consensus: migrate rules_rust to MODULE.bazel ([#7872](https://github.com/dfinity/ic/pull/7872))
* [`3d09396c4`](https://github.com/dfinity/ic/commit/3d09396c4) Node: Remove async from mount traits and impls ([#7802](https://github.com/dfinity/ic/pull/7802))
* [`723ab36d8`](https://github.com/dfinity/ic/commit/723ab36d8) Node: remove nns_public_key backwards compatibility ([#7915](https://github.com/dfinity/ic/pull/7915))
* [`275503a4d`](https://github.com/dfinity/ic/commit/275503a4d) Node: Remove async from partition tools ([#7840](https://github.com/dfinity/ic/pull/7840))
* [`b085793c1`](https://github.com/dfinity/ic/commit/b085793c1) Node: Misc fixes and cleanup around SetupOS ([#7739](https://github.com/dfinity/ic/pull/7739))
* [`e1307ca58`](https://github.com/dfinity/ic/commit/e1307ca58) DSM: compile dirty_pages_from_write only in tests ([#7908](https://github.com/dfinity/ic/pull/7908))
* [`ea0e8cb27`](https://github.com/dfinity/ic/commit/ea0e8cb27) DSM: Increase code section size limit ([#7900](https://github.com/dfinity/ic/pull/7900))
* [`9419c8806`](https://github.com/dfinity/ic/commit/9419c8806) DSM: Cleanups related to subnet splitting ([#7877](https://github.com/dfinity/ic/pull/7877))
## Refactoring:
* [`f66f0b61e`](https://github.com/dfinity/ic/commit/f66f0b61e) DSM: drop AddCanisterChangeToHistory enum ([#7860](https://github.com/dfinity/ic/pull/7860))
## Tests:
* [`ba26afe8a`](https://github.com/dfinity/ic/commit/ba26afe8a) Consensus(orchestrator): compare latest computed root hash pre-upgrade with CUP state hash post-upgrade ([#7525](https://github.com/dfinity/ic/pull/7525))
* [`74df6eff3`](https://github.com/dfinity/ic/commit/74df6eff3) Consensus(crypto): Add a test for generating and verifying Webauthn signatures to validator tests ([#7806](https://github.com/dfinity/ic/pull/7806))
## Documentation:
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/a66d93d2e8dcd28a1f449ec52e33f7781348e1a2/replica-releases/d2a13f0ecb29c96818d24076925d5da19ae61e93.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/d2a13f0ecb29c96818d24076925d5da19ae61e93/ci/scripts/repro-check | python3 - -c d2a13f0ecb29c96818d24076925d5da19ae61e93 --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
