VeilRoot v0.26.2.2

[ailerov]

VeilRoot Core — VNS/Nostr Protocol Hardening

This release completes a major hardening pass over the VeilRoot Naming Service (VNS), Nostr service descriptors, heartbeat validation, and Merkle-proof authentication.

VNS / Nostr Security

• Hardened Nostr event authentication with full BIP340 Schnorr signature verification.
• Added strict validation that the Nostr event public key matches the VNS registrant key.
• Added full NIP-01 event-ID reconstruction and verification.
• Rejects malformed, incorrectly encoded, or cryptographically invalid Nostr signatures and event IDs.
• Applied authenticated Nostr event handling to service descriptors and heartbeats.
• Hardened service-descriptor publishing so events are authenticated before being relayed.

VNS Service Descriptor Validation

Service descriptors are now authenticated against blockchain state before being accepted:

• VNS domain identity validation.
• Registrant public-key validation.
• VNS V1 fingerprint validation.
• Registration transaction Merkle-proof validation.
• Descriptor version validation and deterministic version selection.
• Detection and rejection of conflicting descriptors using the same version.
• Multiple configured Nostr relays are supported for redundancy without granting relay authority.

Heartbeat Security

Heartbeat processing now validates the complete proof chain before updating on-chain domain health state:

• Nostr event signature verification.
• Registrant-key verification.
• Domain verification.
• VNS fingerprint verification.
• Registration transaction Merkle-proof verification.
• Heartbeat candidate selection across configured relays.
• Validated heartbeats are queued for application by the blockchain owner thread.

Merkle Proof Hardening

• Added bounds checking for VNS registration transaction leaf indexes.
• Prevented integer underflow in transaction-count validation.
• Added Merkle proof depth limits to reject malformed proofs exceeding the supported path representation.
• Merkle verification continues to validate the supplied registration transaction against the actual block Merkle root.

Database / Compatibility

• Maintained compatibility with legacy VNS V1 LMDB domain records.

• Existing registrations remain readable while supporting the current multi-relay domain record format.

• Kept the VNS V1 fingerprint construction stable for compatibility with existing registrations:

  domain + registrant public key + fee tier

Testing

• VNS/Nostr test suite: 7/7 passed.

• Verified rejection of:

  • incorrect registrant keys
  • forged event IDs
  • missing descriptor versions
  • incorrect event kinds
  • incorrect domains

• Successfully tested the complete real-world VNS lifecycle:

  registration → heartbeat → service descriptor publication → domain resolution

• Updated binaries successfully deployed across the test network.

• Targeted regression testing confirmed the updated core changes remain functional.

Diagnostics

Added explicit logging for successful:

• Nostr signature verification.
• VNS fingerprint verification.
• VNS Merkle-proof verification.

These logs make the authentication chain observable during node operation and troubleshooting.

Relay Model

Nostr relays remain untrusted transport/storage infrastructure.

Relay availability does not grant authority over a VNS domain; descriptors and heartbeats are accepted only after cryptographic and blockchain validation.

Download Hashes

If you would like to verify that you have downloaded the correct file, please use the following SHA256 hashes:

---

This discussion was created from the release VeilRoot v0.26.2.2.