Skip to content

Release v0.17.5

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jun 16:01
· 2 commits to main since this release
v0.17.5
This tag was signed with the committer’s verified signature.
grunch Francisco Calderón
GPG key ID: 3852B843679AD6F0
Verified
Learn about vigilant mode.
5b07be2
This commit was signed with the committer’s verified signature.
grunch Francisco Calderón
GPG key ID: 3852B843679AD6F0
Verified
Learn about vigilant mode.

Mostro v0.17.5 is out!

This release adds anti-abuse bonds.

In simple terms: before starting certain trades, each side may need to lock a small bond. If they complete the trade normally, they get it back. If they disappear, stall the trade, or waste the other person’s time, they can lose part or all of it.

Why this matters:

• it makes spam and fake intent more expensive
• it discourages people from opening trades they don’t plan to finish
• it protects honest users from griefing and endless waiting
• it helps the marketplace stay usable without turning Mostro into a custodial system

The goal is simple:
real traders should have a smoother experience, bad actors should have a harder time.

Anti abuse bond is optional and it is decided by the Mostro node operator.

Mostro remains P2P and non-custodial, but now with stronger incentives to behave seriously.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/catrya.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider, manifest.txt.sig.catrya and manifest.txt are in the current directory) with:

gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg --verify manifest.txt.sig.catrya manifest.txt

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 9A718444050F091D3D24CF6CE15E232F243D73E6
gpg: Good signature from "Catrya (github) <140891948+Catrya@users.noreply.github.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

What's Changed in v0.17.5

🚀 Features

  • feat(price): Phase 2 — direct backup quoters + multi-source aggregation by @grunch in #773
  • feat(bond): Phase 7 — maker timeout slash by @grunch in #775
  • feat(bond): Phase 6 — range-order maker bond with proportional slashes by @grunch in #770
  • feat(price): Phase 1 — Yadio provider + PriceManager wiring by @grunch in #753
  • feat(bond): Phase 5 — maker bond (non-range) + dispute slash by @grunch in #767
  • feat(bond): Phase 4.5 — re-prompt winner for payout invoice on payment failure by @grunch in #755
  • feat(bond): Phase 4 — timeout slash for the taker bond by @grunch in #744
  • feat(price): Phase 0 — multi-source price module foundation by @grunch in #747

🐛 Bug Fixes

  • fix(price): repair test-only price seeding broken by #753/#770 merge skew by @grunch in #774
  • fix: let daemon finalize disputes without solver row by @arkanoider in #746

💼 Other

  • Update CHANGELOG for version 0.17.5 by @grunch

📚 Documentation

  • docs(bond): Phase 8 — public config exposure + operator docs by @grunch in #777
  • docs: document daemon event kinds by @ermeme[bot] in #769
  • docs: clarify Cashu escrow uses per-order trade keys by @grunch in #757
  • docs: add Cashu 2-of-3 multisig escrow architecture spec by @a1denvalu3 in #756

⚙️ Miscellaneous Tasks

  • Release mostro version 0.17.5 by @grunch

Contributors

Full Changelog: v0.17.4...v0.17.5

Assets 10
Loading