electi-dev · YeahNotSewerSide · May 5, 2026 · May 5, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -185,7 +185,7 @@ tfhe-csprng = "=0.8.1"  # Cryptographically secure PRNG for TFHE - LOW RISK: Zam
 tfhe-versionable = "=0.7.0"  # TFHE versioning support - LOW RISK: Zama
 tfhe-zk-pok = "=0.8.0"  # Zero-knowledge proofs for TFHE - LOW RISK: Zama
 thiserror = "=2.0.12"  # Error derive macro - MEDIUM RISK: Reputable individual maintainer (dtolnay), 545M downloads
-tokio = { version = "=1.49.0", features = ["full"] }  # Async runtime - LOW RISK: tokio team, industry standard
+tokio = { version = "=1.50.0", features = ["full"] }  # Async runtime - LOW RISK: tokio team, industry standard
 tokio-rustls = { version = "=0.26.2", default-features = false, features = ["aws_lc_rs"] }  # Async TLS - LOW RISK: rustls team, memory-safe TLS implementation
 tokio-util = { version = "=0.7.18", features = ["rt"] }  # Tokio utilities - LOW RISK: tokio team
 tonic = "=0.13.1"  # gRPC framework - LOW RISK: hyperium team

diff --git a/core/threshold/docker/local.dockerfile b/core/threshold/docker/local.dockerfile
@@ -2,7 +2,7 @@
 
 ################################################################
 ## Second stage builds the kms-core binaries
-FROM --platform=$BUILDPLATFORM ghcr.io/zama-ai/kms/rust-golden-image:latest AS kms-threshold
+FROM --platform=$BUILDPLATFORM rust:latest AS kms-threshold
 
 WORKDIR /app/ddec
 # Copy project files
@@ -18,7 +18,7 @@ RUN cargo install --locked --path core/threshold --root . --bins --no-default-fe
 
 
 # Go tooling stage - only for grpc-health-probe
-FROM cgr.dev/zama.ai/golang:1.25 AS go-builder
+FROM cgr.dev/chainguard/go:latest AS go-builder
 
 ARG GRPC_HEALTH_PROBE_VERSION=v0.4.46
 
@@ -30,7 +30,7 @@ RUN git clone https://github.com/grpc-ecosystem/grpc-health-probe && \
 
 
 
-FROM --platform=$BUILDPLATFORM cgr.dev/zama.ai/glibc-dynamic:15.2.0-dev AS prod
+FROM --platform=$BUILDPLATFORM cgr.dev/chainguard/glibc-dynamic:latest-dev AS prod
 
 USER root
 # Install required runtime dependencies

diff --git a/docker-compose-kms-core.env b/docker-compose-kms-core.env
@@ -1,2 +1,2 @@
 # change the first info to debug if more logs are needed
-RUST_LOG=info,tonic=info,h2=info,tower=info
+RUST_LOG=debug,tonic=info,h2=info,tower=info
diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
@@ -1,4 +1,4 @@
-FROM cgr.dev/zama.ai/glibc-dynamic:15.2.0-dev AS prod
+FROM cgr.dev/chainguard/glibc-dynamic:latest-dev AS prod
 
 ARG RUST_IMAGE_VERSION=stable
 # Install essential tools and dependencies

diff --git a/docker/core-client/Dockerfile b/docker/core-client/Dockerfile
@@ -3,7 +3,7 @@
 ################################################################
 ### Multistage build to reduce image size
 ## First stage sets up basic Rust build environment
-FROM --platform=$BUILDPLATFORM ghcr.io/zama-ai/kms/rust-golden-image:latest AS builder
+FROM --platform=$BUILDPLATFORM rust:latest AS builder
 
 ARG APP_CACHE_DIR=kms-core-client
 
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cargo/registry,sharing=locked \
 
 ################################################################
 # Runtime Stage
-FROM --platform=$BUILDPLATFORM cgr.dev/zama.ai/glibc-dynamic:15.2.0-dev AS prod
+FROM --platform=$BUILDPLATFORM cgr.dev/chainguard/glibc-dynamic:latest-dev AS prod
 
 # Install only required runtime dependencies
 USER root

diff --git a/docker/core/service/Dockerfile b/docker/core/service/Dockerfile
@@ -2,7 +2,15 @@
 
 ################################################################
 ## Second stage builds the kms-core binaries
-FROM --platform=$BUILDPLATFORM ghcr.io/zama-ai/kms/rust-golden-image:latest AS kms-core
+FROM --platform=$BUILDPLATFORM rust:latest AS kms-core
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    pkg-config \
+    libssl-dev \
+    ca-certificates \
+    libssl-dev \
+    protobuf-compiler \
+    clang 
 
 # By default, cargo build --release.
 # But you can provide --build-arg LTO_RELEASE="--profile release-lto-off" locally to build locally
@@ -47,7 +55,7 @@ RUN wget -qO/usr/bin/yq https://github.com/mikefarah/yq/releases/download/${YQ_V
 ################################################################
 ## Third stage: Copy the binaries from preceding stages
 # This stage will be the final image
-FROM --platform=$BUILDPLATFORM cgr.dev/zama.ai/glibc-dynamic:15.2.0-dev AS prod
+FROM --platform=$BUILDPLATFORM cgr.dev/chainguard/glibc-dynamic:latest-dev AS prod
 
 USER root
 # Install required runtime dependencies
@@ -90,7 +98,7 @@ CMD ["/bin/bash", "/app/kms/core/service/bin/init_enclave.sh"]
 
 ################################################################
 # Build the grpc-health-probe binary for development
-FROM cgr.dev/zama.ai/golang:1.25 AS go-builder
+FROM cgr.dev/chainguard/go:latest AS go-builder
 
 ARG GRPC_HEALTH_PROBE_VERSION=v0.4.46
 

diff --git a/docker/core/service/local.dockerfile b/docker/core/service/local.dockerfile
@@ -2,7 +2,7 @@
 
 ################################################################
 # First stage based on the golden image
-FROM --platform=$BUILDPLATFORM ghcr.io/zama-ai/kms/rust-golden-image:latest AS kms-server
+FROM --platform=$BUILDPLATFORM rust:latest AS kms-server
 
 WORKDIR /app/kms
 COPY . .
@@ -14,7 +14,7 @@ RUN cargo install --locked --path core/service --root . --bin kms-server -F inse
 
 ################################################################
 # Second stage: Copy the binaries from the base stage and the go-runtime stage
-FROM --platform=$BUILDPLATFORM cgr.dev/zama.ai/glibc-dynamic:15.2.0-dev AS prod
+FROM --platform=$BUILDPLATFORM cgr.dev/chainguard/glibc-dynamic:latest-dev AS prod
 
 USER root
 # Install required runtime dependencies
@@ -41,7 +41,7 @@ CMD ["kms-server", "centralized"]
 
 ################################################################
 # Third stage: Build the grpc-health-probe binary for development
-FROM cgr.dev/zama.ai/golang:1.25 AS go-builder
+FROM cgr.dev/chainguard/go:latest AS go-builder
 
 ARG GRPC_HEALTH_PROBE_VERSION=v0.4.46