Skip to content

0.6.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 17:34
· 14 commits to master since this release
0.6.3
3cd9c95

Patch release on the 0.6 line. Rolls up 0.6.1 and 0.6.2 — both tagged, neither reached a GitHub Release because signing failed — and ships the first verifiable signed artifact. No engine changes since 0.6.0: same library, newer runtime pin.

Changed

  • Runtime pin moved to Elixir 1.20.3 + OTP 29.0.5 (ERTS 17.0.5)
  • Hackney 4.7.2, H2 0.11.0, QUIC 1.8.0, WebTransport 0.4.4 (HTTP stack behind HTTPoison, used by HTTP trackers, scrape, and BEP 19 web seeds)

Fixed

  • Release signing: cosign sign-blob now writes a --bundle, since current cosign always emits the Sigstore bundle format and silently ignores --output-signature/--output-certificate. Named *.tar.sigstore.json so OpenSSF Scorecard's Signed-Releases check recognizes it
  • Hex.pm publishing is idempotent — a re-run skips a version already published instead of failing
  • Transient GitHub OIDC token failures now retry instead of stalling CI in an interactive device-code flow

In the package (0.6.x engine)

BEP 52 BitTorrent v2 — pure-v2 download/resume + hybrid dual-swarm discovery (phases 1–5/6) · BEP 16 superseeding · BEP 14 local service discovery · BEP 19 HTTP web seeds · BEP 48 scrape-driven tracker health · BEP 11 PEX hardening (private-torrent isolation, bounded snapshots) · lazy piece storage (on-demand workers, idle terminate) · measured per-address-family dial throttle · 30 s mid-download checkpoint · global 2 MiB recv-buffer ceiling on every wire frame + stall watchdog. 23 BEPs total — per-BEP status and gaps.

MSE/PE encryption is full and bidirectional, interop-verified against Transmission, qBittorrent and libtorrent.

Verify the release artifact

cosign verify-blob \
  --bundle elixir_torrent-0.6.3.tar.sigstore.json \
  --certificate-identity-regexp "https://github.com/daniboybye/ElixirTorrent" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  elixir_torrent-0.6.3.tar

Keyless — identity comes from the release workflow's GitHub OIDC token, so verification proves the tarball was built by this repository.

Install via Hex: {:elixir_torrent, "~> 0.6.3"} · requires Elixir ~> 1.20 · changelog · docs · full diff

Assets 4
Loading