• v1.16.3 bbee3fa2ab

    v1.16.3
    All checks were successful
    CI / Rust clippy (push) Successful in 1m32s
    CI / Rust fmt (push) Successful in 1m5s
    CI / Rust test (push) Successful in 4m49s
    CI / UI (SvelteKit) (push) Successful in 1m4s
    CI / Security Audit (push) Successful in 1m13s
    Release / Docker Multi-Arch (push) Successful in 20m0s
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m47s
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m38s
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m3s
    Release / Linux .deb + .rpm (arm64) (push) Successful in 10m55s
    Release / Linux AppImage (aarch64) (push) Successful in 10m2s
    Release / Linux AppImage (x86_64) (push) Successful in 9m4s
    docs / build (push) Successful in 23s
    Release / Cosign sign artifacts (push) Successful in 16s
    Release / Forgejo Release (push) Successful in 27s
    Stable

    dvb-projekt released this 2026-07-11 17:23:30 +00:00 | 74 commits to main since this release

    Localisation-completeness release. No behaviour, protocol, API, or schema
    changes; the Rust test suite is unchanged (1098 + 3 ignored).

    Fixed

    • The last hardcoded-German UI strings are now fully internationalised in all
      8 languages.
      Three admin pages — API Tokens, Audit Log and Notifications —
      rendered German regardless of the selected locale, as did the relative
      "just now / 5m ago" timestamps (format.ts), the energy/bitcoin-core/overview
      fallbacks, the device auto-scan labels, and several store/runtime error
      messages (auth, notifications, profile). All of these now route through
      i18n.t() with complete translations in de/en/es/pt-BR/fr/it/ja/zh
      (~130 new keys × 8 locales), so selecting a language now translates the
      entire interface. The German dual-license and locale files are unchanged
      in meaning.

    Added

    • i18n guard in CI. ui/scripts/i18n-guard.mjs (wired into pnpm run check)
      enforces three invariants on every push: all 8 locale files share the exact
      same key set, every i18n.t('key') reference exists in the base locale, and
      no hardcoded German (umlaut) text remains in .svelte/.ts source — so an
      untranslated string can no longer regress.

    Docs

    • Both end-user manuals (general + Umbrel) updated: the "these admin pages are
      in German" notes are removed (they render English now), the Bitcoin Core
      template-source / IPC flow is documented in depth, every admin sub-page has a
      screenshot, and a note clarifies the screenshots use example/test data.

    dvb-WarpPool v1.16.3 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.16.3 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.16.2 6d79153816

    v1.16.2
    All checks were successful
    CI / Rust clippy (push) Successful in 1m32s
    CI / Rust fmt (push) Successful in 1m2s
    CI / Rust test (push) Successful in 4m37s
    CI / UI (SvelteKit) (push) Successful in 59s
    CI / Security Audit (push) Successful in 1m8s
    Release / Docker Multi-Arch (push) Successful in 19m37s
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m43s
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m56s
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m39s
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m27s
    Release / Linux AppImage (aarch64) (push) Successful in 10m33s
    Release / Linux AppImage (x86_64) (push) Successful in 9m30s
    docs / build (push) Successful in 20s
    Release / Cosign sign artifacts (push) Successful in 14s
    Release / Forgejo Release (push) Successful in 24s
    Stable

    dvb-projekt released this 2026-07-10 20:03:35 +00:00 | 78 commits to main since this release

    Bugfix + docs-accuracy release. No behaviour, protocol, or API changes; the
    Rust test suite is unchanged (1098 + 3 ignored).

    Fixed

    • Umbrel "IPC interface is off" warning now clears after a good probe. On
      Umbrel the APP_BITCOIN_IPC_ENABLED env var is injected at container start, so
      enabling the toggle later left the admin banner stale even though IPC was live.
      The banner is now gated on the socket-probe result — it disappears the moment
      the template-source test returns OK. (Workaround on older builds: restart the
      WarpPool app so the env is re-read.)

    Changed

    • macOS .dmg is now built with hdiutil instead of create-dmg, which
      failed non-interactively on Finder TCC. Packaging only.
    • Benchmark workflow is manual-dispatch only — decoupled from tag pushes so
      the fat-LTO bench build can't OOM the CI box. CI only.

    Docs

    • Post-migration accuracy sweep across all user-facing prose: supply-chain claims
      corrected to the project Cosign key (keyless-OIDC / SLSA-3 applied only to
      GitHub-era releases ≤ v1.15.0), residual GitHub→Forgejo terminology, feature
      drift (shipped hardening no longer listed as gaps), and Bitcoin Core's IPC
      interface marked experimental. Block-explorer docs corrected — it is shipped
      and chain-aware, not a gap or a config key.

    dvb-WarpPool v1.16.2 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.16.2 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.16.1 47fe255b41

    v1.16.1
    All checks were successful
    CI / Rust clippy (push) Successful in 1m30s
    CI / Rust fmt (push) Successful in 1m4s
    CI / Rust test (push) Successful in 4m57s
    CI / UI (SvelteKit) (push) Successful in 57s
    CI / Security Audit (push) Successful in 1m9s
    docs / build (push) Successful in 21s
    benches / Criterion benches (push) Non-gating baseline; the bench compile OOM-killed on the 8GB CI box (infra, not a bench/code failure). benches are now manual-dispatch only.
    Release / Docker Multi-Arch (push) Successful in 20m54s
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m30s
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m13s
    Release / Linux .deb + .rpm (amd64) (push) Successful in 9m59s
    Release / Linux .deb + .rpm (arm64) (push) Successful in 10m58s
    Release / Linux AppImage (aarch64) (push) Successful in 10m0s
    Release / Linux AppImage (x86_64) (push) Successful in 9m4s
    Release / Cosign sign artifacts (push) Successful in 14s
    Release / Forgejo Release (push) Successful in 24s
    Stable

    dvb-projekt released this 2026-07-10 11:02:08 +00:00 | 84 commits to main since this release

    A UI fix so the v1.16.0 IPC feature is actually discoverable. No behaviour or
    protocol changes.

    Fixed

    • Admin → Bitcoin Core is now in the navigation. The /admin/bitcoin-core
      page (the bitcoin.conf editor and the GBT/IPC template-source switch shipped
      in v1.16.0) existed but was never linked in the admin sub-navigation, so the
      IPC toggle could only be reached by typing the URL. Added the "Bitcoin Core"
      tab (with the label in all 8 UI languages).

    dvb-WarpPool v1.16.1 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.16.1 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.16.0 3f989da324

    v1.16.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m28s
    CI / Rust fmt (push) Successful in 1m2s
    CI / Rust test (push) Successful in 4m35s
    CI / UI (SvelteKit) (push) Successful in 56s
    CI / Security Audit (push) Successful in 1m7s
    Release / Docker Multi-Arch (push) Successful in 19m59s
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m59s
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m50s
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m32s
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m27s
    Release / Linux AppImage (aarch64) (push) Successful in 10m43s
    Release / Linux AppImage (x86_64) (push) Successful in 9m44s
    docs / build (push) Successful in 23s
    Release / Cosign sign artifacts (push) Successful in 15s
    Release / Forgejo Release (push) Successful in 25s
    benches / Criterion benches (push) Benchmarks pass; the upload-artifact step (Forgejo infra) was fixed in benches.yml
    Stable

    dvb-projekt released this 2026-07-09 20:26:06 +00:00 | 93 commits to main since this release

    Adds an opt-in low-latency block-template source over Bitcoin Core's IPC
    interface and hardens concurrent admin config saves. No breaking changes —
    GBT remains the default template source, so existing setups are unaffected.

    Added

    • Bitcoin Core IPC template backend (opt-in, Core >= 31). A new
      warppool-bitcoin-ipc crate speaks Bitcoin Core's Cap'n Proto mining
      interface to pull block templates directly, bypassing the GBT+ZMQ round
      trip. A shared TemplateSource trait keeps the GBT and IPC paths
      interchangeable. Select it via [node] template_source = "ipc" (default
      "gbt") with [node] ipc_socket_path pointing at Core's -ipcbind UNIX
      socket, or from Admin → Bitcoin Core with a live GBT/IPC switch that
      probes the socket before committing and fails safe back to GBT if the
      socket is unreachable. On Umbrel the Bitcoin app has exposed the IPC socket
      since its v1.3.0 (requires Bitcoin Core v31.0). Measured template latency
      ~5–12 ms (IPC) versus ~90–100 ms (GBT+ZMQ, under Core's ZMQ queue lag).

    Fixed

    • Concurrent admin config saves no longer lose updates. Overlapping writes
      to config.toml from the admin API now share a write lock, so two saves
      racing at the same time can no longer clobber each other (lost-update race).

    Internal

    • Deterministic lowdiff_diag capture tests (Stratum V1 + V2). The opt-in
      low-difficulty diagnostic tests captured tracing output via a thread-local
      subscriber, which could be gated out under parallel test load when a
      neighbouring test's first-hit callsite registration recomputed the global
      tracing max-level against the (off) global default. The tests now pin the
      max-level floor, so they pass deterministically; no production behaviour
      changed.

    dvb-WarpPool v1.16.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.16.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.15.0 ff9cda20a0

    v1.15.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m27s
    CI / Rust fmt (push) Successful in 1m0s
    CI / Rust test (push) Successful in 4m29s
    CI / UI (SvelteKit) (push) Successful in 53s
    CI / Security Audit (push) Successful in 1m4s
    Stable

    dvb-projekt released this 2026-07-09 15:50:21 +00:00 | 96 commits to main since this release

    A full internal security/correctness audit (25 confirmed findings, all fixed and
    adversarially re-reviewed) plus a user-facing feature. No breaking changes.

    Added

    • Suppressible dashboard health warnings (GitHub #76). The Bitcoin Core
      health banner now has a per-warning "Hide permanently" button (visible when
      logged in as admin), and a new Admin → Health page lists suppressed
      warnings so they can be brought back. Persistent and operator-controlled;
      also seedable via a new [server] suppress_health_warnings config option.
      Especially useful for a deliberately pruned node whose "pruned" notice
      otherwise reappeared on every reload.

    Fixed — money path (critical/high)

    • Found blocks are submitted with the exact winning header. A block found
      by a version-rolling miner (overt ASICBoost — practically every modern ASIC,
      plus NerdAxe/NerdQaxe) was reassembled with the un-rolled block version, so
      Bitcoin Core rejected it (high-hash) and the reward was lost. The
      block-found event now carries the exact rolled version and reconstructs the
      block from the job it was actually mined on. Fixed for both Stratum V1 and V2.
    • Stratum V2 initial SetNewPrevHash sent prev_hash in display (BE) order
      on channel open instead of internal LE, so the first shares after a channel
      opened were scored low-difficulty until the next broadcast. Now matches the
      broadcast path and the pool's own PoW check.
    • Transient Bitcoin Core RPC errors (proxy 502/503/504, non-JSON 5xx bodies)
      are now retried instead of being misclassified as a fatal auth error, so a
      brief gateway hiccup at submitblock time no longer drops the retry.

    Security

    • 2FA can no longer be reset without a valid code. POST /api/auth/2fa/setup
      now requires a current TOTP when 2FA is already enabled.
    • Read-only API tokens can no longer read node RPC credentials via
      GET /api/admin/bitcoin-core/conf (now requires a full-privilege identity).
    • The LAN miner active-scan (/api/miners/active-scan?cidr=) now requires
      authentication and is restricted to private RFC1918 ranges (SSRF/port-scan
      hardening).
    • The setup wizard no longer passes the bitcoind RPC password as a
      command-line argument
      (was visible in the process table); it authenticates
      via -conf. The non-unix fallback RPC password now uses a CSPRNG.
    • Opt-in cosign verification for the macOS DMG updater (symmetric with the
      Linux path).
    • Push unsubscribe requires proof-of-possession (the subscription's auth
      secret) so knowing only the endpoint URL can't cancel someone's alerts.
    • Telegram/Slack notifications escape miner- and operator-controlled fields
      (MarkdownV2), so a crafted worker name or the default brand can no longer
      break the block-found notification.
    • The desktop launcher verifies process identity before killing a stale
      PID from daemon.pid, so a recycled PID can't take down an unrelated process.

    Fixed — data & UI

    • import_backup deduplicates block records by content (block hash) instead of
      a surrogate id, so restoring a backup no longer silently drops a historical
      block.
    • Lifetime-energy accounting is now atomic (single transaction, fixed cutoff)
      and reset/eviction are serialized, so a crash or a mid-eviction reset can no
      longer double-count or lose kWh; historical/lifetime cost is grid-priced
      instead of collapsing to ~0 during a solar-excess window.
    • The share dedup set is now bounded (FIFO) and only cleared on a new block, so
      replayed shares are rejected without unbounded memory growth.
    • Diff-ETA math is hardened against non-finite/zero RPC values.
    • UI: the hashrate-chart tooltip is out-of-bounds safe, a transient network/5xx
      error no longer logs the operator out, and the bitcoin.conf editor now writes
      rpcallowip/network correctly (no longer silently dropped) and edits
      section-based configs without creating duplicates.

    dvb-WarpPool v1.15.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.15.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
      --key cosign.pub \
      --bundle SHA256SUMS.bundle \
      SHA256SUMS
    sha256sum --check SHA256SUMS
    

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads