v0.10.2

v0.10.2 — release notes come from the tag annotation (2026-10-25)

No messenger code changed since v0.10.1. One pipeline fix, proven end to end.

• publish no longer creates releases with gh release create --notes-from-tag.
  That flag reads the tag from the local checkout and silently falls back to the
  commit subject when the annotation is not there — which is why the v0.10.1
  release page showed a one-line body. The step now reads the tag object through
  the API (falling back to the commit message for a lightweight tag) and creates
  the release with --notes-file.
• The v0.10.1 release body was corrected in place to its tag annotation.

All six targets build on GitHub Actions from the tag, each with a .sha256
sibling plus SHA256SUMS, and multiple.intoto.jsonl from the SLSA generic
generator pinned at v2.1.0:

slsa-verifier verify-artifact spore-linux-amd64 \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/liqdmetal/spore --source-tag v0.10.2

spore version reports v0.10.2. Behaviour is identical to v0.10.1.

v0.10.1 — first pipeline-built release, with SLSA provenance

v0.10.1 — first pipeline-built release, with SLSA provenance

No messenger code changed since v0.10.0. This tag ships the same source built
end to end by .github/workflows/release.yml, and it is the first release that
exists because of that pipeline rather than a local cross-compile.

• All six targets (linux/darwin/windows × amd64/arm64) build on GitHub Actions
  from the tag, each with a .sha256 sibling plus SHA256SUMS.

• multiple.intoto.jsonl comes from the SLSA generic generator pinned at
  v2.1.0 and covers all six digests:

  slsa-verifier verify-artifact spore-linux-amd64 \
    --provenance-path multiple.intoto.jsonl \
    --source-uri github.com/liqdmetal/spore --source-tag v0.10.1

• A dispatch rebuild or a re-pushed tag replaces the binaries and drops the
  previous attestation before uploading, so stale provenance can never sit
  next to new digests.

spore version reports v0.10.1. Behaviour is otherwise identical to
v0.10.0, which stays published without provenance.

v0.10.0 — iroh E2 body store, peer transport, E2-over-peer PUT

iroh E2 body store, peer transport, and E2-over-peer PUT

Built from 6301ded (feat(peerstore): add PUT mechanism for E2-over-peer).

This release turns the E2 body store into something that works without a
relay: ciphertext bodies live in content-addressed storage with portable
BLAKE3 locators, and can be fetched over disk, a peer, or an iroh sidecar.

What landed since v0.9.0

• Iroh E2 store, peer transport, carrier sidecar — content-addressed body
  storage with BLAKE3 locators, disk:// and peer:// schemes, and the
  spore-iroh Rust sidecar. The ratchet wire protocol gains E2 Pointer V2
  with locator support; peer discovery, the peerstore server and device
  approval gained work alongside it.
• Production wiring for iroh:// and disk:// — the config moved out of
  the dead e2Store path into newE2BodyStore, the constructor that actually
  runs, so the schemes work on the send path instead of only in tests.
• iroh-blobs 0.103.1 — 0.100 through 0.103.0 are yanked from crates.io;
  this is the current released version.
• E2-over-peer PUT — spore-peer accepts a PUT request
  ({"put": {"cid": "<64 hex>", "body": "<hex body>"}}), stores the body with
  a 24-hour expiry and confirms receipt, bypassing the relay entirely.

Downloads

Six statically linked Go binaries, one per target:

OS	amd64	arm64
Linux	spore-linux-amd64	spore-linux-arm64
macOS	spore-darwin-amd64	spore-darwin-arm64
Windows	spore-windows-amd64.exe	spore-windows-arm64.exe

Every asset has a matching .sha256 file, and SHA256SUMS covers all six.

curl -fsSLO https://github.com/liqdmetal/spore/releases/download/v0.10.0/spore-linux-amd64
curl -fsSLO https://github.com/liqdmetal/spore/releases/download/v0.10.0/spore-linux-amd64.sha256
sha256sum -c spore-linux-amd64.sha256
chmod +x spore-linux-amd64 && ./spore-linux-amd64 version   # spore v0.10.0

The shipped linux/amd64 artifact was downloaded from this release,
checksum-verified and run; the full spore demo send → receive → burn
lifecycle was exercised on Windows amd64 and Linux amd64 on the same source.

Honest notes

• No SLSA provenance on this release. v0.7.0-v0.8.6 shipped
  multiple.intoto.jsonl from a signing generator; these binaries come out of
  .github/workflows/release.yml on a GitHub Actions runner, so the workflow
  run log and the checksums are the only attestations.
• spore-peer binaries are not included. The peer and iroh sidecar are
  Rust and were not part of this build; the peer code for the PUT path is in
  this tag but has no published artifact yet.
• The peer transport is unauthenticated. As the commit notes say: use a
  trusted LAN or VPN for remote peers.
• Version numbering. This supersedes both v0.9.0 (tagged but never
  published) and v0.5.1 (a stray tag with no assets). It is a minor bump
  because the iroh store and peer transport are features, not fixes.

v0.5.1 — production-ready E2 store path

Changes

• Fixed build-breaking regression (dead e2Store function)
• Wired iroh:// and disk:// into production E2 store path
• Updated iroh-blobs to 0.103.1 (0.103.0 yanked)
• All tests pass on Windows and CentOS

v0.8.6

Full Changelog: v0.8.5...v0.8.6

v0.8.5

Full Changelog: v0.8.4...v0.8.5

v0.8.4

Full Changelog: v0.8.3...v0.8.4

v0.8.2 — operator visibility for the approval pipeline

Live lock contention in approval-metrics, requester replay guard proven
end-to-end on DERO/EVM/Solana, expiry-mid-flight refusal proven before
any broadcast, and a TTL headroom warning on the send rerun.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

v0.8.0

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Full Changelog: v0.6.0...v0.7.0