Release v0.18.6

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/catrya.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/andreadiazcorreia.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider, manifest.txt.sig.catrya, manifest.txt.sig.andreadiazcorreia and manifest.txt are in the current directory) with:

gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg --verify manifest.txt.sig.catrya manifest.txt
gpg --verify manifest.txt.sig.andreadiazcorreia manifest.txt

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 9A718444050F091D3D24CF6CE15E232F243D73E6
gpg: Good signature from "Catrya (github) <140891948+Catrya@users.noreply.github.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using EDDSA key 57376B6467F41F565ADDC65B1ED8B40E3A46E21D
gpg: Good signature from "Andrea Diaz Correia <andrea.diaz.correia@gmail.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

What's Changed in v0.18.6

🚀 Features

• feat: boot node-identity guard for Lightning node changes (Phase 4) by @grunch in #936
• feat: advertise maintenance mode in the info event, republish on change (Phase 3) by @grunch in #935
• feat: admin RPC for maintenance mode — SetMaintenanceMode + GetMaintenanceStatus (Phase 2) by @grunch in #934
• feat: maintenance (drain) mode — persistent flag + escrow gate (Phase 1) by @grunch in #933
• feat(cashu): take flow escrow request + unblock creation — Track A TA-2 by @grunch in #830

🐛 Bug Fixes

• fix(ci): scope publishing to version tag pushes by @AndreaDiazCorreia in #909
• fix: compare-and-swap the trade-pubkey rotation (#811) by @AndreaDiazCorreia in #903
• fix: keep dev fee audit events (kind 8383) for one year by @grunch in #924
• fix: verify the event signature before the spam gate by @AndreaDiazCorreia in #892
• fix(ci): make the release build toolchain verifiable and reproducible by @AndreaDiazCorreia in #905
• fix: clear next-trade fields on sell child orders by @21Mill in #891
• fix: stamp dispute events with a monotonic created_at by @grunch in #899
• fix: follow-ups to the payout dispatch queue (post-merge audit of #883) by @Catrya in #893

💼 Other

• Update CHANGELOG for version 0.18.6 by @grunch

🚜 Refactor

• refactor: removed dead code identified in issue by @Arowolokehinde in #848

📚 Documentation

• docs: operator runbook for migrating to a different Lightning node (Phase 5) by @grunch in #937
• docs: maintenance mode / Lightning node migration spec by @grunch in #932
• docs: payment-account history / anti-triangulation implementation spec by @grunch in #917
• docs(cashu): specs for Tracks B/C/D (release, coop-cancel, dispute) by @grunch in #833

⚙️ Miscellaneous Tasks

• Release mostro version 0.18.6 by @grunch

Contributors

• @grunch made their contribution
• @AndreaDiazCorreia made their contribution in #909
• @Arowolokehinde made their contribution in #848
• @21Mill made their contribution in #891
• @Catrya made their contribution in #893

Full Changelog: v0.18.5...v0.18.6