25 releases 74 tags

RSS feed

• v1.17.0 26f318357d

  Compare

  v1.17.0 Stable

  dvb-projekt released this 2026-07-12 23:52:40 +00:00 | 73 commits to main since this release

  Per-worker payout mode — WarpPool can now run as a public, non-custodial,
  0%-fee solo pool where every miner mines to their own address. Fully
  backward-compatible: single mode is the default and byte-for-byte unchanged.
  Rust suite grows to 1140 + 4 ignored (new real-Core regtest consensus E2E).

  Added

  • Per-worker coinbase ([mining] payout_mode = "per_worker"). Each miner
    supplies its own BTC address as the Stratum username; the coinbase is built
    per connection (V1) / per channel (Sv2) to pay that address the full block
    reward — one output, no pool fee. An invalid or wrong-network login address
    is rejected (no fallback to an operator address). The pool holds no funds.
    Config is fail-closed: per_worker with any fee/donation refuses to start.
  • Public per-wallet dashboard at /users/<address> — a ckpool-compatible
    JSON endpoint (firmware / ckstats parse it) plus a SvelteKit page: network
    panel, five hashrate windows, best-ever share, honest estimated-time-to-block,
    hashrate chart, and a per-rig table with detected mining software. Wallet rows
    on /wallets link straight to it.
  • Wallet ownership verification (BIP-137) — a miner proves control of an
    address by signing a pool-issued one-shot challenge (no funds moved). Once
    verified, an owner-only panel unlocks a privacy toggle (hide the wallet
    from the public list/pages) and per-wallet notifications (ntfy topic or
    webhook) for block-found and rig-offline events. All 22 owner-panel strings
    are translated in all 8 languages.
  • Public-pool deployment guide (docs/book/src/public-pool-setup.md) with a
    ready-to-paste hardening profile (per-IP caps, auto-ban, reject-ratio ban,
    IP-gate, TLS, reverse-proxy) and a deployment checklist.

  Security

  • Shared SSRF guard for all outbound, user-supplied targets (web-push and
    per-wallet notify). Private/loopback/link-local/CGNAT/0.0.0.0-8 hosts are
    refused, hostnames are re-checked against DNS-rebinding, and HTTP redirect
    following is disabled so a 3xx cannot smuggle a request onto an internal
    host. Single source of truth, reused by both paths.
  • The per-wallet hashrate time-series (/api/users/<addr>/hashrate and
    /api/hashrate?worker=) now honour the privacy flag — a private wallet's
    series is hidden from anyone who is not its verified owner (or an
    authenticated operator).

  Changed

  • Coinbase construction refactored around a shared, address-independent
    JobTemplate; single mode delegates to it and is proven byte-identical to
    the previous builder. Merkle branches and the witness commitment stay shared;
    only the payout output varies per address.

  Tests

  • Real-Core regtest consensus E2E (--ignored, opt-in): builds per-worker
    blocks for multiple distinct addresses, submits them to a live bitcoind
    regtest, and asserts each block is accepted, pays the correct address with a
    single value output, carries a correct witness commitment (incl. a non-empty
    tx set), and that single mode still produces a valid block.

  ---

  dvb-WarpPool v1.17.0 — Downloads

  Docker

  git.warppool.org/dvb-projekt/dvb-warppool:v1.17.0 (multi-arch amd64+arm64, ohne v-Präfix)

  Native packages

  • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
  • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
  • Linux AppImage: x86_64 + aarch64 portable
  • Linux tarballs: x86_64 + aarch64 for manual installs
  • macOS .dmg: added shortly after publish (built separately) — or build from source
  • Windows .msi: paused since the forge migration (no Windows runner yet)

  Signatures

  • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
  • SBOM (SPDX) for all dependencies

  Verify (project public key cosign.pub in the repo root):

  cosign verify-blob \
    --key cosign.pub \
    --bundle SHA256SUMS.bundle \
    SHA256SUMS
  sha256sum --check SHA256SUMS
  

  First-time setup: run dvb-warppool-setup for the first-run wizard.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • SHA256SUMS
    3 downloads · 2026-07-12 23:52:41 +00:00 · 841 B
  • SHA256SUMS.bundle
    3 downloads · 2026-07-12 23:52:41 +00:00 · 3.8 KiB
  • dvb-WarpPool-v1.17.0-aarch64.AppImage
    4 downloads · 2026-07-12 23:52:41 +00:00 · 20 MiB
  • dvb-WarpPool-v1.17.0-x86_64.AppImage
    4 downloads · 2026-07-12 23:52:41 +00:00 · 21 MiB
  • dvb-warppool-1.17.0-1.aarch64.rpm
    0 downloads · 2026-07-12 23:52:42 +00:00 · 16 MiB
  • dvb-warppool-1.17.0-1.x86_64.rpm
    0 downloads · 2026-07-12 23:52:42 +00:00 · 17 MiB
  • dvb-warppool-v1.17.0-aarch64-unknown-linux-gnu.tar.gz
    0 downloads · 2026-07-12 23:52:42 +00:00 · 21 MiB
  • dvb-warppool-v1.17.0-x86_64-unknown-linux-gnu.tar.gz
    0 downloads · 2026-07-12 23:52:43 +00:00 · 22 MiB
  • dvb-warppool_1.17.0-1_amd64.deb
    0 downloads · 2026-07-12 23:52:43 +00:00 · 16 MiB
  • dvb-warppool_1.17.0-1_arm64.deb
    0 downloads · 2026-07-12 23:52:43 +00:00 · 15 MiB
  • sbom.spdx.json
    4 downloads · 2026-07-12 23:52:43 +00:00 · 1.3 MiB