Mostro v2.1.1

⚡ Mostro v2.1.1

Non-custodial, peer-to-peer Bitcoin trading over Lightning and Nostr.

📥 Downloads

🤖 Android

File	Architecture	For
mostro-v2.1.1-arm64-v8a.apk	v8 — ARMv8-A, 64-bit (AArch64)	Modern phones. Pick this one if unsure.
mostro-v2.1.1-armeabi-v7a.apk	v7 — ARMv7-A, 32-bit	Old or entry-level phones that run a 32-bit Android.

Both need Android 7.0 (API 24) or later and are the same app: an APK holds
native machine code (the Flutter engine and Mostro's Rust core, which does all
the cryptography), and one file per CPU instruction set keeps each download to
a fraction of the size of a universal APK. Every release is signed with the
same key, so it installs over the previous version and keeps your data.

Which APK is mine?

• arm64-v8a (v8) targets the 64-bit ARMv8-A instruction set. Practically
  every phone released since 2016–2017 runs a 64-bit Android, Google Play has
  required 64-bit builds since August 2019, and recent devices — the Pixel 7
  and later, and any phone built on 2023-or-newer Arm cores — are
  64-bit only: they cannot run the v7 APK at all. 64-bit code is also
  noticeably faster at the elliptic-curve and encryption work the app does.
• armeabi-v7a (v7) targets 32-bit ARMv7-A with hardware floating point.
  It is for phones with a 32-bit CPU (Cortex-A7/A9/A15 class, roughly 2015
  and earlier) and for phones whose 64-bit-capable CPU ships with a
  32-bit Android — common in budget and Android Go models with 2 GB of RAM
  or less.
• To be sure: try v8 first. If Android answers "App not installed" or
  "package is not compatible with your phone", install v7. With a computer,
  adb shell getprop ro.product.cpu.abilist prints the supported ABIs —
  if arm64-v8a is in the list, use v8.
• x86 devices (emulators, some Chromebooks) are not covered by these builds.

mostro-v2.1.1.aab is the Android App Bundle for the Google Play Console — the store builds the per-device APKs from it. It is not installable on a phone.

🖥️ Desktop

File	Runs on
mostro-v2.1.1-linux-x64.tar.gz	x86-64, glibc 2.35 or later (Ubuntu 22.04, Debian 12, Fedora 36…)
mostro-v2.1.1-windows-x64.zip	Windows 10 or later, x86-64
mostro-v2.1.1-macos-universal.zip	macOS 10.15 or later — Apple Silicon and Intel (universal binary)

Linux — unpack and run

mkdir mostro && tar -xzf mostro-*-linux-x64.tar.gz -C mostro && ./mostro/mostro

Keep the folder together: the mostro binary loads lib/ and data/ from
next to itself. It needs GTK 3 and libsecret with a running keyring
(GNOME Keyring, KWallet) — that is where your keys are stored.

To add Mostro to your application menu, with its icon, run
./mostro/install.sh once (again after moving the folder;
--uninstall removes it). On Wayland the app shows a generic icon until then.

Windows — unzip and run mostro.exe

Unzip the whole folder and start mostro.exe from inside it; the DLLs and
data\ next to it are part of the app. The build carries no Authenticode
signature, so SmartScreen shows "Windows protected your PC": choose
More info → Run anyway. Check the file against SHA256SUMS.txt first.

macOS — allow an app Apple has not notarized

The app is ad-hoc signed and not notarized, so Gatekeeper refuses it on a
double click ("cannot be opened" or "is damaged"). After checking the zip
against SHA256SUMS.txt, unzip it, move mostro.app to Applications and
clear the quarantine flag once:

xattr -dr com.apple.quarantine /Applications/mostro.app

🍎 iOS

File	Runs on
mostro-v2.1.1-ios-unsigned.ipa	iPhone, iOS 14 or later (arm64)

iOS — for sideloading only

This .ipa is unsigned: iOS will not install it as it is, and it is not a
TestFlight or App Store build. It is meant to sideload with a tool that
re-signs it with your own Apple ID (AltStore, Sideloadly, or Xcode). Apps
signed with a free Apple ID expire after 7 days, and push notifications do
not work in a re-signed build — they need the project's own provisioning
profile.

Verify a download with sha256sum -c SHA256SUMS.txt --ignore-missing.

📋 What's changed

✨ Features

• reputation: name the source of an attestation before importing it (#886) by @grunch
• announcements: add the project's announcement keys (#892) by @grunch
• announcements: add the announce validator and the publishing doc (#891) by @grunch
• announcements: show announcements in the notification surface (#890) by @grunch
• reputation: sign a rebind authorisation for lnp2pBot (#885) by @grunch
• announcements: bridge the cache to Dart and add the Announcements toggle (#889) by @grunch
• notifications: switch to the trade's node from its card (#879) by @Catrya
• drawer: the release-stage chip says BETA (#876) by @grunch

🐛 Bug Fixes

• reputation: import screen picks up capabilities that arrive late (#888) by @grunch
• reputation: export failures no longer read as an invalid paste (#887) by @grunch
• orders: don't serialize the node switch's relay fetches (#877) by @Catrya
• android: opt out of Auto Backup and device transfer (#874) by @grunch

📚 Documentation

• readme: add screenshots and the download links of the website (#878) by @grunch

👷 Build & CI

• web: pin the web build to ubuntu-24.04 (#896) by @grunch

🧹 Chores

• cashu: bump cdk and cdk-sqlite to 0.18.2 (#871) by @Forte11Cuba

👥 Contributors

Thanks to everyone who made this release possible:

@Catrya · @Forte11Cuba · @grunch

---

Full diff: v2.1.0...v2.1.1 ·
History: CHANGELOG.md