dvb-projekt/dvb-WarpPool
dvb-projekt/dvb-WarpPool
1
0
Fork 0
Code Issues Pull requests Projects Releases 25 Packages 1 Wiki Activity Actions
25 releases 74 tags
  • v1.15.0 ff9cda20a0

    v1.15.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m27s
    Details
    CI / Rust fmt (push) Successful in 1m0s
    Details
    CI / Rust test (push) Successful in 4m29s
    Details
    CI / UI (SvelteKit) (push) Successful in 53s
    Details
    CI / Security Audit (push) Successful in 1m4s
    Details
    Stable

    dvb-projekt released this 2026-07-09 15:50:21 +00:00 | 96 commits to main since this release

    A full internal security/correctness audit (25 confirmed findings, all fixed and
    adversarially re-reviewed) plus a user-facing feature. No breaking changes.

    Added

    • Suppressible dashboard health warnings (GitHub #76). The Bitcoin Core
      health banner now has a per-warning "Hide permanently" button (visible when
      logged in as admin), and a new Admin → Health page lists suppressed
      warnings so they can be brought back. Persistent and operator-controlled;
      also seedable via a new [server] suppress_health_warnings config option.
      Especially useful for a deliberately pruned node whose "pruned" notice
      otherwise reappeared on every reload.

    Fixed — money path (critical/high)

    • Found blocks are submitted with the exact winning header. A block found
      by a version-rolling miner (overt ASICBoost — practically every modern ASIC,
      plus NerdAxe/NerdQaxe) was reassembled with the un-rolled block version, so
      Bitcoin Core rejected it (high-hash) and the reward was lost. The
      block-found event now carries the exact rolled version and reconstructs the
      block from the job it was actually mined on. Fixed for both Stratum V1 and V2.
    • Stratum V2 initial SetNewPrevHash sent prev_hash in display (BE) order
      on channel open instead of internal LE, so the first shares after a channel
      opened were scored low-difficulty until the next broadcast. Now matches the
      broadcast path and the pool's own PoW check.
    • Transient Bitcoin Core RPC errors (proxy 502/503/504, non-JSON 5xx bodies)
      are now retried instead of being misclassified as a fatal auth error, so a
      brief gateway hiccup at submitblock time no longer drops the retry.

    Security

    • 2FA can no longer be reset without a valid code. POST /api/auth/2fa/setup
      now requires a current TOTP when 2FA is already enabled.
    • Read-only API tokens can no longer read node RPC credentials via
      GET /api/admin/bitcoin-core/conf (now requires a full-privilege identity).
    • The LAN miner active-scan (/api/miners/active-scan?cidr=) now requires
      authentication and is restricted to private RFC1918 ranges (SSRF/port-scan
      hardening).
    • The setup wizard no longer passes the bitcoind RPC password as a
      command-line argument       (was visible in the process table); it authenticates
      via -conf. The non-unix fallback RPC password now uses a CSPRNG.
    • Opt-in cosign verification for the macOS DMG updater (symmetric with the
      Linux path).
    • Push unsubscribe requires proof-of-possession (the subscription's auth
      secret) so knowing only the endpoint URL can't cancel someone's alerts.
    • Telegram/Slack notifications escape miner- and operator-controlled fields
      (MarkdownV2), so a crafted worker name or the default brand can no longer
      break the block-found notification.
    • The desktop launcher verifies process identity before killing a stale
      PID from daemon.pid, so a recycled PID can't take down an unrelated process.

    Fixed — data & UI

    • import_backup deduplicates block records by content (block hash) instead of
      a surrogate id, so restoring a backup no longer silently drops a historical
      block.
    • Lifetime-energy accounting is now atomic (single transaction, fixed cutoff)
      and reset/eviction are serialized, so a crash or a mid-eviction reset can no
      longer double-count or lose kWh; historical/lifetime cost is grid-priced
      instead of collapsing to ~0 during a solar-excess window.
    • The share dedup set is now bounded (FIFO) and only cleared on a new block, so
      replayed shares are rejected without unbounded memory growth.
    • Diff-ETA math is hardened against non-finite/zero RPC values.
    • UI: the hashrate-chart tooltip is out-of-bounds safe, a transient network/5xx
      error no longer logs the operator out, and the bitcoin.conf editor now writes
      rpcallowip/network correctly (no longer silently dropped) and edits
      section-based configs without creating duplicates.

    dvb-WarpPool v1.15.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.15.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads