Skip to content

v0.6.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 15:35
· 199 commits to master since this release
v0.6.3
This tag was signed with the committer’s verified signature.
bkeroack Benjamen Keroack
SSH Key Fingerprint: n0/Fx+2vE8+eOoDJqj0o9HwsP0sUTh1czs9g5D4Iq3A
Verified
Learn about vigilant mode.
930abdc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

📄 Canonical release notes: docs/release-notes/0.6.3.md

satd 0.6.3

Released 2026-10-21 · git tag v0.6.3 · Changelog

satd 0.6.3 is a security release on the 0.6 line, cut from the release/0.6
branch. It has a single change, to sat-cli and sat-tui: with -rpctls,
the CA named by -rpccacert is now the only authority they trust for the
node's certificate. Until now it was added to the public CA roots compiled
into the binary, so any public CA could vouch for the node. The node itself
is unchanged from 0.6.2. It is a drop-in upgrade from 0.6.0, 0.6.1 or 0.6.2,
with no reindex and no configuration changes.

Highlights

  • -rpccacert is the only trust anchor for sat-cli and sat-tui.
    A certificate for the node's hostname from a public CA, issued by mistake
    or with a stolen key, is no longer accepted in place of your own.

Security

0.6.2 refused certificates issued through the compromised eMudhra (emSign)
intermediates, but a sat-cli or sat-tui given -rpccacert still trusted
every other public root as well. A public CA that issued a certificate for
the RPC hostname, by mistake or after a key compromise like emSign's, could
stand in for the node and receive the RPC credentials (cookie, password or
bearer token) the client sends.

From 0.6.3, sat-cli and sat-tui build their TLS configuration
themselves. With -rpccacert, the root store holds that CA alone. Without
it, the store is the public root set, the same webpki-roots 1.0.10 set as
0.6.2, so a node behind a publicly trusted certificate still needs no flag.
A client certificate for an mTLS listener (-rpcclientcert,
-rpcclientkey) is presented exactly as before.

satd's own TLS listeners, alert webhooks and the --fast-start download are
unchanged from 0.6.2.

Streaming SDKs

Neither SDK changes, and neither needs to: given a CA, both already trust
only that CA. Without one, each falls back to a public root set that the
SDK release does not fix:

  • Rust (satd-events-client) uses the webpki-roots set through tonic,
    and certificate paths are checked by rustls-webpki. Your own project's
    Cargo.lock picks both versions, not the SDK's release. Run
    cargo update -p rustls-webpki -p webpki-roots to reach rustls-webpki
    0.103.16 and webpki-roots 1.0.10, which refuse the emSign intermediates.
  • Go (clients/go) uses the operating system's trust store. Update the
    system's ca-certificates.

The SDKs are released at 0.6.3 to keep their versions in step with the node.

Upgrade notes

  • Drop-in upgrade from 0.6.0, 0.6.1 or 0.6.2. Same storage schema, no
    reindex, no configuration changes. Replace the binaries and restart, or
    pull the 0.6.3 container image.
  • Upgrade sat-cli and sat-tui on every machine that reaches a TLS RPC
    listener, not just the node. This release changes nothing else.
  • -rpccacert must name the CA that issued the node's certificate. If
    you pass -rpccacert to reach a node whose certificate comes from a public
    CA, the connection is now refused. Drop the flag, since the public roots
    apply without it, or name that CA's root.
  • Everything in the 0.6.2 upgrade notes still
    applies, including updating the operating system's trust store. The 0.6.2
    appliance images were not built; the 0.6.3 images replace the 0.6.0 ones.

About this release

satd is free software under the MIT License.

  • Stability & compatibility — Tier 1 surfaces (Bitcoin Core-compatible
    JSON-RPC wire shape, CLI flag names/defaults, bitcoin.conf keys, on-disk
    layout, Electrum/Esplora surfaces) are governed by
    STABILITY_POLICY.md. satd follows
    semantic versioning; while in the
    0.x pre-1.0 line, deprecations may be accelerated (see the policy).
  • Security & disclosure — report vulnerabilities per
    SECURITY.md. Consensus-affecting bugs are treated as
    P0 with same-day acknowledgement.
  • Verifying this release — tarballs are signed with minisign, container
    images with cosign (keyless OIDC), and git tags with SSH signatures (no GPG).
    The key matrix and verification steps are in
    SECURITY.md.
  • Intentional differences from Bitcoin Core — catalogued in
    CORE_DIFFERENCES.md.
  • Operating satd — observability, the full flag matrix, tuning, and the
    downstream packaging contract live in the
    Operator Manual.

What's Changed

  • release 0.6.3: -rpccacert is the only trust anchor for sat-cli and sat-tui by @bkeroack in #1047

Full Changelog: v0.6.2...v0.6.3

Contributors

bkeroack
Assets 55
Loading