Skip to content

Blockula v1.0.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 17:56
· 44 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.4
fb9f287
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Blockula v1.0.4: Terms of Use and a Privacy Policy, agreed before any wallet; Face ID before every spend. UNSIGNED, like every release so far.

This release is not signed. The offline ML-DSA-65 release key doesn't exist yet, so there's no
checksums.txt.sig and no release key id to pin. blockula release install refuses to install without one.

The one-line install.sh and the MCP's install_node check each archive's SHA-256 against checksums.txt,
whose first line is # blockula-release v1.0.4. With a logged-in gh, they also check its SLSA build
provenance (gh attestation verify <file> --repo jackdishman/blockula --source-ref refs/tags/v1.0.4), and
they report which checks ran. A compromised GitHub account or release workflow could produce both. The
stronger check is a bit-for-bit rebuild of the Linux archives:
COMMIT=fb9f287d3755da90c94a5955dab398f6ddb9d846 scripts/reproduce-release.sh v1.0.4.

Blockula is for education and research only. Each chain's coins have no value: nobody sells them, buys them or gets paid in them.

What's new

  • Terms of Use and a Privacy Policy (#124). Before it makes, restores, links or unlocks a wallet, the wallet asks you to agree. The agreement is remembered per device, and asked again when the terms change. Both pages are served at /terms and /privacy by blockula.app and by every node's wallet, and the explorer's footer links them. The terms say it plainly: for education and research only, the coins have no value, experimental and unaudited, self-custody, public and permanent.
  • Face ID, fingerprint or PIN before every spend (#126). This covers Send and payment links, the explorer's action forms, claiming a name, staking, and adding a key that can spend. The wallet asks the passkey again even while it's unlocked, and checks that the answer derives the same key. Nothing is signed before the check, and a cancel signs and sends nothing.
  • ML-DSA 0.1.2 and ML-KEM 0.3.4 (#125). These are constant-time hardening and zeroization updates. ML-DSA-65 signatures are byte-identical, and every v1 block replays as before. Commonware stays on 2026.9.0.
  • Hosting:
    • deploy/host-validator.sh runs a validator for an existing chain on Fly, with a beginner's guide in docs/BECOME-A-VALIDATOR.md (#121).
    • deploy/host-chain.sh takes PEER_HTTP, so a restarted validator of a two-validator chain can sign again (#123).
  • Tokenomics (#124). A value-bearing mainnet's genesis builder now has no founder allocation and no distribution bucket. Nothing in this release makes such a chain. docs/PUBLIC-CHAIN.md says what the permanent demo chain promises.
  • npm: @blockula/sdk and @blockula/mcp are 1.0.4.

No protocol change: v1 blocks replay exactly as before.

Assets 13
Loading