25 releases 74 tags

RSS feed

• v1.20.0 a4009d007f

  Compare

  v1.20.0 Stable

  dvb-projekt released this 2026-07-16 15:02:37 +00:00 | 60 commits to main since this release

  Recovery codes for two-factor auth, plus fixes surfaced by the first public
  mainnet run.

  Added

  • 2FA recovery codes. Enabling two-factor auth now issues 10 one-time
    recovery codes (shown once) so a lost authenticator no longer locks you out
    of the admin area. Enter a code in place of the TOTP at login; each works
    once. The admin 2FA page shows how many remain, warns when few are left, and
    can regenerate a fresh set (requires the current app code). Only Argon2
    hashes are stored — the plaintext is shown once and never persisted, and the
    codes are excluded from backups. Login accepts a recovery code only after the
    correct password, so it adds no brute-force surface.

  Fixed

  • Address ownership verification could get stuck. A failed signature check
    (wrong wallet or a malformed paste) used to consume the challenge, so every
    retry against the message still shown in the UI failed forever. A failed
    attempt now keeps the challenge; only a successful verify (or expiry)
    consumes it, and the one-shot guarantee holds under concurrency.
  • Admin visibility toggle mislabelled. The switch labelled "Miners tab"
    actually controls the Devices tab (the /miners route is the Devices
    nav entry); the label and its hint now match the navigation.
  • Owner area up front names the wallets that can sign a proof-of-ownership
    message (Electrum/Sparrow, incl. hardware wallets via those), so operators
    pick a working wallet before trying.

  Security

  • Recovery codes are drawn with rejection sampling (no modulo bias) and each
    login attempt that reaches the recovery path consumes at most one code
    atomically. 2FA enable is rejected on an already-active account so codes are
    never rotated silently — rotation goes through the confirmed regenerate flow.

  ---

  dvb-WarpPool v1.20.0 — Downloads

  Docker

  git.warppool.org/dvb-projekt/dvb-warppool:v1.20.0 (multi-arch amd64+arm64, ohne v-Präfix)

  Native packages

  • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
  • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
  • Linux AppImage: x86_64 + aarch64 portable
  • Linux tarballs: x86_64 + aarch64 for manual installs
  • macOS .dmg: added shortly after publish (built separately) — or build from source
  • Windows .msi: paused since the forge migration (no Windows runner yet)

  Signatures

  • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
  • SBOM (SPDX) for all dependencies

  Verify (project public key cosign.pub in the repo root):

  cosign verify-blob \
    --key cosign.pub \
    --bundle SHA256SUMS.bundle \
    SHA256SUMS
  sha256sum --check SHA256SUMS
  

  First-time setup: run dvb-warppool-setup for the first-run wizard.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • SHA256SUMS
    3 downloads · 2026-07-16 15:32:45 +00:00 · 1.2 KiB
  • SHA256SUMS.bundle
    4 downloads · 2026-07-16 15:32:46 +00:00 · 3.7 KiB
  • dvb-WarpPool-v1.20.0-aarch64.AppImage
    6 downloads · 2026-07-16 15:02:38 +00:00 · 20 MiB
  • dvb-WarpPool-v1.20.0-aarch64.dmg
    6 downloads · 2026-07-16 15:32:31 +00:00 · 22 MiB
  • dvb-WarpPool-v1.20.0-x86_64.AppImage
    6 downloads · 2026-07-16 15:02:38 +00:00 · 21 MiB
  • dvb-WarpPool-v1.20.0-x86_64.dmg
    6 downloads · 2026-07-16 15:32:36 +00:00 · 23 MiB
  • dvb-warppool-1.20.0-1.aarch64.rpm
    5 downloads · 2026-07-16 15:02:38 +00:00 · 16 MiB
  • dvb-warppool-1.20.0-1.x86_64.rpm
    4 downloads · 2026-07-16 15:02:39 +00:00 · 17 MiB
  • dvb-warppool-v1.20.0-aarch64-apple-darwin.tar.gz
    2 downloads · 2026-07-16 15:32:41 +00:00 · 20 MiB
  • dvb-warppool-v1.20.0-aarch64-unknown-linux-gnu.tar.gz
    6 downloads · 2026-07-16 15:02:39 +00:00 · 21 MiB
  • dvb-warppool-v1.20.0-x86_64-apple-darwin.tar.gz
    2 downloads · 2026-07-16 15:32:45 +00:00 · 21 MiB
  • dvb-warppool-v1.20.0-x86_64-unknown-linux-gnu.tar.gz
    2 downloads · 2026-07-16 15:02:39 +00:00 · 22 MiB
  • dvb-warppool_1.20.0-1_amd64.deb
    3 downloads · 2026-07-16 15:02:40 +00:00 · 16 MiB
  • dvb-warppool_1.20.0-1_arm64.deb
    2 downloads · 2026-07-16 15:02:40 +00:00 · 15 MiB
  • sbom.spdx.json
    2 downloads · 2026-07-16 15:02:40 +00:00 · 1.3 MiB