• v1.30.1 fbc8e7ab69

    v1.30.1
    Some checks failed
    CI / Rust clippy (push) Successful in 1m54s
    CI / Rust fmt (push) Successful in 1m14s
    CI / Rust test (push) Successful in 6m12s
    CI / UI (SvelteKit) (push) Successful in 1m21s
    CI / Security Audit (push) Failing after 1m22s
    docs / build (push) Successful in 41s
    Release / Docker Multi-Arch (push) Successful in 24m5s
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 12m41s
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 11m39s
    Release / Linux .deb + .rpm (amd64) (push) Successful in 2m8s
    Release / Linux .deb + .rpm (arm64) (push) Successful in 2m3s
    Release / Linux AppImage (aarch64) (push) Successful in 29s
    Release / Linux AppImage (x86_64) (push) Successful in 28s
    Release / Cosign sign artifacts (push) Successful in 29s
    Release / Forgejo Release (push) Successful in 39s
    Stable

    dvb-projekt released this 2026-09-15 07:03:44 +00:00 | 253 commits to main since this release

    A patch release for one thing: the Umbrel sidecar port introduced in 1.28.0
    reached more of the pool than it should have. Details below; update if you
    run the app from the community store.

    Security

    • Umbrel: the LAN sidecar port (18335, added in 1.28.0) mapped straight
      onto the main API port, which also exposed the first-run setup wizard and
      /api/auth/bootstrap to the LAN — without the Umbrel login — until the
      owner had completed them. The port now maps to a new read-only API
      listener
      ([server].api_readonly_listen, env
      DVB_WARPPOOL_API_READONLY_LISTEN, container port 18339): GET/HEAD/OPTIONS
      only (plus the token-guarded POST /api/tune/push), /api/auth/* and
      /api/admin/* refused outright, never bound by the setup wizard. Sidecars
      keep reading /api/workers and /api/energy there.
      Installations of 1.28.0–1.30.0 that completed the wizard promptly were only
      exposed for that window; update anyway.

    Added

    • [server].api_readonly_listen (see above) for any deployment whose main
      port sits behind a login proxy but where a LAN sidecar needs pool data.

    dvb-WarpPool v1.30.1 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.30.1 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads