25 releases 74 tags

RSS feed

• v1.19.1 7b140b7bb1

  Compare

  v1.19.1 Stable

  dvb-projekt released this 2026-07-16 11:00:18 +00:00 | 66 commits to main since this release

  Hardening patch after the first public-mainnet run (pool.warppool.org). The
  headline is a privacy fix: three read endpoints ignored the [privacy]
  toggles, so the switches hid the nav tabs while the data stayed one request
  away — most importantly /api/workers, which served every miner's full payout
  address to anyone. All three are now gated; the operator (authenticated) still
  sees everything.

  Security / Privacy

  • /api/workers, /api/hardware, /api/miners now honour the privacy
    toggles. Previously hardware_tab_public / miners_tab_public /
    wallet_directory_public only hid the nav link. /api/hardware leaked the
    exact OS, kernel patch level and hardware to anyone; /api/miners the
    operator's LAN devices; /api/workers every full payout address + rig. Now
    anonymous callers get a 403 (hardware), an empty list (miners), or masked
    addresses (workers). Tests assert the gap is closed.
  • Web-push broadcasts only block-found events. The subscribe endpoint is
    unauthenticated by design (friends can subscribe without an account), so node
    health and update-available events — operator ops state — no longer go out
    over it. They still reach the operator via the configured server-side sinks.

  Fixed

  • Leaderboard / workers masking keeps the rig label (bc1qsx…dvng.bitaxe).
    Dropping it bought no privacy (a rig name carries no address) while making the
    board useless — you couldn't tell which of your machines earned a share.
  • Stratum V2 miners now show their hardware. The pool synthesised a
    user-agent from the SetupConnection fields and used it to classify the miner,
    but the Sv2 authorization callback had no field to carry it, so it was
    dropped — Sv2 miners appeared with no hardware while V1 miners had it.
  • Clearer first-run bootstrap error. A read-only /config mount made admin
    setup fail with a generic "could not persist secrets"; it now names the cause
    (not writable) and the path, and points at the packaging docs.
  • Docs: device-class count corrected (7 real classes, not 8 — the 8th is the
    Unknown fallback); Windows .msi marked paused (not built since the forge
    move); Cosign verification uses --bundle (the old --signature example
    couldn't work); UI strings say "release"/"issue" instead of "GitHub".

  Added

  • IPC/GBT badge in the header. Shows which template source is live — the
    RPC-ready badge can't, since RPC is required in both modes.
  • Wallet address search on the Workers page — jump straight to your own
    /users/<address> page to prove ownership and switch on privacy, even when
    the browsable directory is hidden. The tab is now always reachable.
  • Translator --v2-connect accepts a hostname, not just IP:port — it's
    resolved via DNS at startup.

  ---

  dvb-WarpPool v1.19.1 — Downloads

  Docker

  git.warppool.org/dvb-projekt/dvb-warppool:v1.19.1 (multi-arch amd64+arm64, ohne v-Präfix)

  Native packages

  • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
  • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
  • Linux AppImage: x86_64 + aarch64 portable
  • Linux tarballs: x86_64 + aarch64 for manual installs
  • macOS .dmg: added shortly after publish (built separately) — or build from source
  • Windows .msi: paused since the forge migration (no Windows runner yet)

  Signatures

  • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
  • SBOM (SPDX) for all dependencies

  Verify (project public key cosign.pub in the repo root):

  cosign verify-blob \
    --key cosign.pub \
    --bundle SHA256SUMS.bundle \
    SHA256SUMS
  sha256sum --check SHA256SUMS
  

  First-time setup: run dvb-warppool-setup for the first-run wizard.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • SHA256SUMS
    3 downloads · 2026-07-16 11:14:14 +00:00 · 1.2 KiB
  • SHA256SUMS.bundle
    3 downloads · 2026-07-16 11:14:15 +00:00 · 3.8 KiB
  • dvb-WarpPool-v1.19.1-aarch64.AppImage
    8 downloads · 2026-07-16 11:00:19 +00:00 · 20 MiB
  • dvb-WarpPool-v1.19.1-aarch64.dmg
    5 downloads · 2026-07-16 11:13:59 +00:00 · 22 MiB
  • dvb-WarpPool-v1.19.1-x86_64.AppImage
    5 downloads · 2026-07-16 11:00:19 +00:00 · 21 MiB
  • dvb-WarpPool-v1.19.1-x86_64.dmg
    7 downloads · 2026-07-16 11:14:04 +00:00 · 23 MiB
  • dvb-warppool-1.19.1-1.aarch64.rpm
    6 downloads · 2026-07-16 11:00:19 +00:00 · 16 MiB
  • dvb-warppool-1.19.1-1.x86_64.rpm
    7 downloads · 2026-07-16 11:00:20 +00:00 · 17 MiB
  • dvb-warppool-v1.19.1-aarch64-apple-darwin.tar.gz
    4 downloads · 2026-07-16 11:14:09 +00:00 · 20 MiB
  • dvb-warppool-v1.19.1-aarch64-unknown-linux-gnu.tar.gz
    5 downloads · 2026-07-16 11:00:20 +00:00 · 21 MiB
  • dvb-warppool-v1.19.1-x86_64-apple-darwin.tar.gz
    4 downloads · 2026-07-16 11:14:14 +00:00 · 21 MiB
  • dvb-warppool-v1.19.1-x86_64-unknown-linux-gnu.tar.gz
    4 downloads · 2026-07-16 11:00:20 +00:00 · 22 MiB
  • dvb-warppool_1.19.1-1_amd64.deb
    6 downloads · 2026-07-16 11:00:21 +00:00 · 16 MiB
  • dvb-warppool_1.19.1-1_arm64.deb
    4 downloads · 2026-07-16 11:00:21 +00:00 · 15 MiB
  • sbom.spdx.json
    2 downloads · 2026-07-16 11:00:21 +00:00 · 1.3 MiB