Eclair v0.14.4

This is a patch release that contains security hardening fixes, most originating from @erickcestari and project Loupe.
We highly recommend upgrading, as some of these issues can be exploited by malicious nodes.

The detailed release notes can be found here.

Verifying signatures

You will need gpg and our release signing key E04E48E72C205463. Note that you can get it:

• from our website: https://acinq.co/pgp/drouinf2.asc
• from github user @sstone, a committer on eclair: https://api.github.com/users/sstone/gpg_keys

To import our signing key:

$ gpg --import drouinf2.asc

To verify the release file checksums and signatures:

$ gpg -d SHA256SUMS.asc > SHA256SUMS.stripped
$ sha256sum -c SHA256SUMS.stripped

Building

Eclair builds are deterministic. To reproduce our builds, please use the following environment (*):

• Ubuntu 26.04.1
• Adoptium OpenJDK 21.0.12.1

Then use the following command to generate the eclair-node packages:

./mvnw clean install -DskipTests

That should generate eclair-node/target/eclair-node-<version>-XXXXXXX-bin.zip with sha256 checksums that match the one we provide and sign in SHA256SUMS.asc

(*) You may be able to build the exact same artefacts with other operating systems or versions of JDK 21, we have not tried everything.

Upgrading

This release is fully compatible with previous eclair versions. You don't need to close your channels, just stop eclair, upgrade and restart.