Zero v21

Zero release 21, built from commit 21063fb.

Changes

Security

• zebra: peers submitting invalid shielded proofs are now banned. Failed
  Orchard/Ironwood Halo2 proofs, Orchard binding signatures, and Sprout
  JoinSplit signatures previously collapsed to a zero misbehaviour score,
  letting a peer force expensive verification indefinitely.
  (GHSA-2p4c-3q4q-p463, 036f233)
• zebra: known-block queries drain rejected-block notifications before
  checking sent hashes, so an honest block body sharing a header hash with a
  rejected body is accepted immediately instead of stalling sync as a
  duplicate. (GHSA-8gxx-hc65-vv82, 81b5121)

Fixed

• zebra: outbound peer connections require the peer to advertise NODE_NETWORK,
  and rejected peers are recorded so they are not redialed. Without this, the
  current mainnet peer population (dominated by non-serving services=0 nodes
  since the zcashd EoS halt) fills all outbound slots and stalls fresh syncs
  at genesis indefinitely. Verified A/B: patched node syncs from the same
  seeders where stock zebra 6.2.x stalls. Upstreamed as
  ZcashFoundation/zebra#11061. (2af34be)

Source archives

One ZIP per vendored component (tracked source at the released commit):

• zcashd-v21.zip
• zebra-v21.zip
• zaino-v21.zip
• zallet-v21.zip
• orchard-v21.zip
• librustzcash-v21.zip
• lightwalletd-v21.zip

Binaries

Prebuilt for linux/x86_64 (built on ubuntu-22.04, glibc 2.35+; stripped).
Telemetry disabled (no sentry/opentelemetry); getblocktemplate and
prometheus metrics included.

• zebrad-v21-linux-x86_64 (with .sha256)

Note

The "Source code (zip)" and "Source code (tar.gz)" entries are
generated automatically by GitHub from the tag. They are not part of
the Zero release; use the assets above.