pool v0.6.4-beta

v0.6.4-beta is a minor release that make the grpc stream connection with the server more stable.

Under the hood, it sets new defaults for the grpc's client keepalive parameters.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.6.4-beta.txt and manifest-v0.6.4-beta.sig are in the current directory) with:

gpg --verify manifest-v0.6.4-beta.sig manifest-v0.6.4-beta.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible, on Linux. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.19.7, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.6.4-beta

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.4-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.4-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.4-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.4-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• server: specify gRPC keepalive params by @guggero in #457

Full Changelog: v0.6.3-beta...v0.6.4-beta

pool v0.6.3-beta

v0.6.3-beta is a minor release that includes a bug fix for L402 auth tokens (formerly known as LSAT). This only affects Pool standalone users who don't have an account yet. Users of the integrated Pool daemon in Lightning Terminal are not affected.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.6.3-beta.txt and manifest-v0.6.3-beta.sig are in the current directory) with:

gpg --verify manifest-v0.6.3-beta.sig manifest-v0.6.3-beta.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible, on Linux. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.19.7, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.6.3-beta

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.3-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.3-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.3-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.3-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• mod: bump lnd to v0.16.0-beta final by @guggero in #448
• multi: stop using lnwire.WriteElement by @morehouse in #449
• mod: downgrade google.golang.org/grpc to fix L402 by @guggero in #451

New Contributors

• @morehouse made their first contribution in #449

Full Changelog: v0.6.2-beta...v0.6.3-beta

pool v0.6.2-beta

v0.6.2-beta is a minor release that includes:

• New account modification fees RPC.
• New Musig2v100 compatibility type.
• Bug fixes.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.6.2-beta.txt and manifest-v0.6.2-beta.sig are in the current directory) with:

gpg --verify manifest-v0.6.2-beta.sig manifest-v0.6.2-beta.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible, on Linux. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.19.7, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.6.2-beta

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.2-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.2-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.2-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.2-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

What's Changed

• scripts: use git describe --tags by @positiveblue in #418
• Expose historical account action fees via RPC by @ffranr in #395
• docker: perform dependencies installation in separate run layer by @ffranr in #419
• build(deps): bump github.com/lightningnetwork/lnd from 0.15.1-beta to 0.15.4-beta by @dependabot in #420
• multi: configurable RequestShutdown call-back in config by @ellemouton in #421
• cmd/pool: fix confirmation constraint description by @guggero in #423
• build: update go to v1.19.4-beta by @positiveblue in #427
• rpcserver: format rpcLog error by @positiveblue in #426
• rpc: populate allowed/not allowed node ids when listing orders by @positiveblue in #429
• account recovery: increase default number of keys to try by @guggero in #436
• build(deps): bump github.com/prometheus/client_golang from 1.11.0 to 1.11.1 by @dependabot in #437
• build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 by @dependabot in #439
• Fix linter problems by @guggero in #441
• build(deps): bump golang.org/x/crypto from 0.0.0-20211215153901-e495a2d5b3d3 to 0.1.0 by @dependabot in #442
• build(deps): bump golang.org/x/net from 0.1.0 to 0.7.0 by @dependabot in #444
• build: add darwin-arm64 (Apple Silicon) as a release target by @dstadulis in #445
• build: remove Pool release targets no longer built for lnd by @dstadulis in #446
• Add new account version that supports MuSig2 v1.0.0-rc2 protocol (coming with lnd 0.16.0-beta) by @guggero in #435
• version: bump to v0.6.2-beta by @positiveblue in #447

New Contributors

• @dependabot made their first contribution in #420
• @dstadulis made their first contribution in #445

Full Changelog: v0.6.1-beta...v0.6.2-beta

pool v0.6.1-beta

v0.6.1-beta is a minor release that includes:

• Improvements in the account onchain transaction labels
• Bug fixes.
• CLI helper fixes.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.6.1-beta.txt and manifest-v0.6.1-beta.sig are in the current directory) with:

gpg --verify manifest-v0.6.1-beta.sig manifest-v0.6.1-beta.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.18.5, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.6.1-beta

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.1-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.1-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.0-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.0-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• cmd: use --amt in submit order description by @positiveblue in #404
• Add .editorconfig as copied from lnd. by @ffranr in #407
• account: improve account onchain transaction labels by @ffranr in #396
• rpcserver: populate auction_type in the ListOrders endpoint by @positiveblue in #412
• account: transaction labels code cleanup by @ffranr in #413
• cmd: allow min_chan_amt > amt for outbound liquidity orders by @positiveblue in #406
• cmd: update --confirmation_constraints description by @positiveblue in #414
• version: bump to v0.6.1-beta by @positiveblue in #415

Full Changelog: v0.6.0-beta...v0.6.1-beta

pool v0.6.0-beta

Pool is finally graduating to it's beta release with new, cutting-edge market features!

Four new market primitives

• Order Signalling:
  Users' market orders can now be 'unsealed' into a publicly queryable order book to assist bidders/askers matching. [1]

• Taproot / MuSig Pool Accounts
  Pool contract state and signing stays off chain decreasing users fees, increasing privacy

• Unannounced Channels:
  Refrain from announcing channels to the global graph for more privacy
  $ pool orders submit bid --unannounced_channel ...

• New Market!
  v0.6.0 creates the ability for an asker to sell their outbound capacity and graph position/connections.
  $ pool orders submit bid --auction_type outbound ...
  in addition to Pool default inbound functionality
  $ pool orders submit bid --auction_type inbound ...

• Zero Conf Send/Receive!
  Pool offers Zero Conf channels to enable LN payments before block confirmation! Immediately after a Pool batch is broadcast to the mempool.

[1] Change Pool's defaults with the --isPublic=false flag on orders to keep orders sealed.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.6.0-beta.txt and manifest-v0.6.0-beta.sig are in the current directory) with:

gpg --verify manifest-v0.6.0-beta.sig manifest-v0.6.0-beta.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.18.5, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.6.0-beta

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.6.0-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.6.0-beta.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• Upgrade trader accounts to Taproot/MuSig2 by @guggero in #375
• multi: make profile IP configurable by @guggero in #391
• taproot: ensure check for expiry script spend correctly handles annex by @ffranr in #393
• rpcserver: handle 'StateExpiredPendingUpdate' case for account state by @jbrill in #394
• feature: add support for unannounced and zero conf channels by @positiveblue in #385
• feature: add outbound-liquidity auction market, bidder pays for channel acceptance by @positiveblue in #390
• cmd: make orders public by default by @positiveblue in #398
• version: bump to v0.6.0-beta by @positiveblue in #399

New Contributors

• @ffranr made their first contribution in #393
• @jbrill made their first contribution in #394

Full Changelog: v0.5.8-alpha...v0.6.0-beta

pool v0.5.8-alpha

This marks the eight minor release of poold in the 0.5.x series! The release contains bug fixes and compatibility fixes for lnd v0.15.1-beta and Taproot change inputs and is a recommended update.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.5.8-alpha.txt and manifest-v0.5.8-alpha.sig are in the current directory) with:

gpg --verify manifest-v0.5.8-alpha.sig manifest-v0.5.8-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.17.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.5.8-alpha

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.5.8-alpha.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.5.8-alpha.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• Switch account signing over to PSBT, allow deposits/account creation from P2TR inputs by @guggero in #370
• Usability fixes by @guggero in #378
• GitHub: add automatic Docker build by @guggero in #379
• funding: don't abort if cleanup fails by @guggero in #380
• tools: update Golang to 1.18, add fuzz tests by @guggero in #384
• poolrpc/gen_protos.sh: remove js build tag by @kaloudis in #387

New Contributors

• @kaloudis made their first contribution in #387

Full Changelog: v0.5.7-alpha...v0.5.8-alpha

pool v0.5.7-alpha

This marks the seventh minor release of poold in the 0.5.x series!

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.5.7-alpha.txt and manifest-v0.5.7-alpha.sig are in the current directory) with:

gpg --verify manifest-v0.5.7-alpha.sig manifest-v0.5.7-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.17.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.5.7-alpha

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.5.7-alpha.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.5.7-alpha.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• Filter order matches by node id by @positiveblue in #350
• order: Mark missing orders as failed in the client db by @positiveblue in #360
• poolscript: make sure negation works with btcec v2 by @guggero in #363
• multi: bump to latest lndclient and lnd versions by @guggero in #366
• mod: bump auctioneerrpc and aperture versions by @guggero in #368
• Add forgotten server account state by @guggero in #369
• multi: move RequiredPermissions to dedicated dir by @ellemouton in #371
• account+rpcserver: bump account key index on recovery by @guggero in #373
• Update dependencies, improve trace logging by @guggero in #376

Full Changelog: v0.5.6-alpha...v0.5.7-alpha

pool v0.5.6-alpha

This marks the sixth minor release of poold in the 0.5.x series! This release includes bug fixes.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F4FC70F07310028424EFC20A8E4256593F177720

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.5.6-alpha.txt and manifest-v0.5.6-alpha.sig are in the current directory) with:

gpg --verify manifest-v0.5.6-alpha.sig manifest-v0.5.6-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.17.3, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.5.6-alpha

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.5.6-alpha.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.5.6-alpha.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• rpcserver: report lease expiries correctly by @positiveblue in #347
• multi: bump btcec/v2 and btcutil to new versions by @guggero in #348
• rpcserver: marshall channel type in order list by @guggero in #351
• mod: update lndclient to use new SignOutputRaw by @positiveblue in #352
• rpcserver: fix recoveryPending attribute by @positiveblue in #355
• docker: bump go version + set arch platform by @positiveblue in #359
• cmd/debug: add DeleteOrder command by @positiveblue in #358
• rpcserver: roll back #330 by @guggero in #354

Full Changelog: v0.5.5-alpha...v0.5.6-alpha

pool v0.5.5-alpha

This marks the fifth minor release of poold in the 0.5.x series! This release includes bug fixes and a safety update for fully server-less account recovery.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://keybase.io/guggero/pgp_keys.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.5.5-alpha.txt and manifest-v0.5.5-alpha.sig are in the current directory) with:

gpg --verify manifest-v0.5.5-alpha.sig manifest-v0.5.5-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Do 25 Nov 2021 10:41:18 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]
Primary key fingerprint: F4FC 70F0 7310 0284 24EF  C20A 8E42 5659 3F17 7720

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.17.3, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.5.5-alpha

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.5.5-alpha.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.5.5-alpha.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (auto generated)

What's Changed

• rpcserver: fix nil version in subserver mode by @guggero in #337
• multi: use lndclient MacaroonService by @ellemouton in #336
• Client side account recovery by @positiveblue in #335
• sidecar: Init mailbox after server restarts by @positiveblue in #340
• sidecar: clean old shims for orders in current batch by @positiveblue in #342
• cmd: improve InitAccount cli message by @positiveblue in #344
• Fix sidecar message handlers by @positiveblue in #341

New Contributors

• @ellemouton made their first contribution in #336

Full Changelog: v0.5.4-alpha...v0.5.5-alpha

pool v0.5.4-alpha

This marks the fourth minor release of poold in the 0.5.x series! This release includes bug fixes, some developer improvements and enables the new script-enforced lease channel type for lnd v0.14.x-alpha or later.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://keybase.io/guggero/pgp_keys.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.5.4-alpha.txt and manifest-v0.5.4-alpha.sig are in the current directory) with:

gpg --verify manifest-v0.5.4-alpha.sig manifest-v0.5.4-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Mi 29 Jul 2020 14:59:19 CEST
gpg:                using RSA key 6E01EEC9656903B0542B8F1003DB6322267C373B
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.17.3, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

The signature on the tag itself can be verified with:

git verify-tag v0.5.4-alpha

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and poold-source-v0.5.4-alpha.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf lnd-source-v0.5.4-alpha.tar.gz
GO111MODULE=on go install -v -mod=vendor ./cmd/poold
GO111MODULE=on go install -v -mod=vendor ./cmd/pool

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

Release Notes (since v0.5.1-alpha)

New features

• Enabled account auto-renewal during batch participation.
• Enabled script-enforced lease channel type by default for lnd v0.14.x-alpha nodes and later.

Bug Fixes

• Fixed a bug with fully spent accounts and batch auto-renewal.

Miscellaneous improvements

• Refactored the account watcher for improved unit testing.
• Fixed typos and improved the documentation.
• Improved unit tests for the RenewAccount RPC.
• Fixed imprecise wording in README.
• Improved integration tests by making client batch version configurable.

Contributors (Alphabetical Order)

Jordi Montes
Olaoluwa Osuntokun
Oliver Gugger