v1.7.1

[jackjackbits]

bitchat 1.7.1 is a security and reliability release. Every change below was field-verified on devices before tagging.

Security

• Noise sessions are bound to claimed peer identities, and leave messages must be signed (Bind Noise sessions to claimed peer identities #1432). A peer can no longer complete a handshake claiming someone else's ID and receive DMs encrypted for them.
• Private media is encrypted before BLE fragmentation (Encrypt private media before BLE fragmentation #1434) — DM photos and voice notes no longer cross the mesh as plaintext; relays never see the bytes.
• Announce signing keys are TOFU-pinned against mesh identity spoofing (Pin announce signing keys to stop mesh identity spoofing #1349). Relayed public messages from a claimed sender are rejected until a verified announce is seen — fail closed.
• Identity keys are now device-bound (ThisDeviceOnly, never synchronized) (Make panic wipe deterministic and device-bound #1431). They cannot be extracted via backup or cloud sync — and consequently an identity no longer survives migrating to a new phone or deleting and reinstalling the app. Existing installs migrate automatically on first unlock; nothing to do on upgrade.
• Panic wipe is deterministic and complete (Make panic wipe deterministic and device-bound #1431), and what a locked or seized device reveals is reduced across the board (Harden what a locked or seized device gives away #1484, Give media the explicit file-protection class other stores use #1552 — media now carries an explicit file-protection class, chosen so locked-device mesh receive keeps working).
• Shared content requires review before import (Require review before importing shared content #1430). Hostile-network resilience plus per-release source verifiability (Keep working when the network is hostile, and make the app verifiable #1486, Close the three holes the #1486 review found #1488) — every tagged release ships a SOURCE-MANIFEST.txt; see docs/VERIFYING-A-BUILD.md.

Reliability

• The DM pipeline survives the hard cases: atomic Noise reconnects, early-ciphertext preservation, durable delivery receipts, retry after key replacement, transactional media deletion, conversations kept canonical across transport aliases and alive across Bluetooth toggles (Keep open DMs alive across Bluetooth settings #1460–Make private-media deletion transactional #1468, Retry unacknowledged DMs after Noise replacement #1462).
• BLE transport re-architecture into a single engine domain with a deterministic multi-node simulation harness (BLE transport architecture V3: one engine domain, capability ports, feature-owned state #1498 series). Peer-ID rotation no longer leaves ghost identities — on either link of a dual-link pair (Fix #1538: release stale bindings on rotation instead of leaving a ghost identity #1554) or across a reconnect after rotation (Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection #1566).
• A restore-path deadlock that could freeze the app on relaunch is fixed (Fix restore-path main↔bleQueue deadlock and courier drop amplification #1425), and a courier-storm amplification with it.

New & fixed

• Persian localization (فارسی) and an in-app language picker (Add Persian (fa) localization and an in-app language picker #1443).
• Nearby notes are tap-to-reveal — the location subscription is consent-gated (Nearby notes: tap-to-reveal (consent-gate the location subscription) + subscription hygiene #1422).
• Verified seal next to names you've verified (fix: show verified seal next to sender names in chat #1506); blocked people excluded from @-mention suggestions (Don't suggest blocked people in @-mentions #1543).
• The composer keeps focus after sending with the return key (Keep the composer focused after sending with the return key #1490); low-precision geohashes resolve at country level (fix: use country-level resolution for low-precision geohashes #1044); people-sheet environment hardening (fix: stop EnvironmentObject crash in the people sheet #1567).

What's Changed

• Quality pass on the 1.7.0 batch: fix confirmed bugs, bump to 1.7.1 by @jackjackbits in Quality pass on the 1.7.0 batch: fix confirmed bugs, bump to 1.7.1 #1418
• Bridge dedup: content-derived stable mesh message ID by @jackjackbits in Bridge dedup: content-derived stable mesh message ID #1419
• PTT hardening: per-peer burst keys + live-capture storage quota by @jackjackbits in PTT hardening: per-peer burst keys + live-capture storage quota #1420
• Close forged-directness link-rebind DoS on DM routing by @jackjackbits in Close forged-directness link-rebind DoS on DM routing #1421
• Nearby notes: tap-to-reveal (consent-gate the location subscription) + subscription hygiene by @jackjackbits in Nearby notes: tap-to-reveal (consent-gate the location subscription) + subscription hygiene #1422
• Fix restore-path main↔bleQueue deadlock and courier drop amplification by @jackjackbits in Fix restore-path main↔bleQueue deadlock and courier drop amplification #1425
• Consolidate duplicate BLE links after restore; duplicate fragment-stream suppression; onChange coalescing by @jackjackbits in Consolidate duplicate BLE links after restore; duplicate fragment-stream suppression; onChange coalescing #1426
• Harden PTT audio and the 1.7.1 release by @jackjackbits in Harden PTT audio and the 1.7.1 release #1423
• fix: use country-level resolution for low-precision geohashes by @malkovitc in fix: use country-level resolution for low-precision geohashes #1044
• Harden public intake bounds against untrusted growth by @Chessing234 in Harden public intake bounds against untrusted growth #1451
• Add Persian (fa) localization and an in-app language picker by @RodsF1 in Add Persian (fa) localization and an in-app language picker #1443
• Make panic wipe deterministic and device-bound by @jackjackbits in Make panic wipe deterministic and device-bound #1431
• Bind Noise sessions to claimed peer identities by @jackjackbits in Bind Noise sessions to claimed peer identities #1432
• Run iOS tests and repair coverage reporting by @jackjackbits in Run iOS tests and repair coverage reporting #1429
• Make developer cleanup artifact-only by @jackjackbits in Make developer cleanup artifact-only #1433
• Avoid index rebuilds at conversation cap by @jackjackbits in Avoid index rebuilds at conversation cap #1435
• Route GeoRelay updates through reviewed data by @jackjackbits in Route GeoRelay updates through reviewed data #1436
• perf: verify Nostr inbound signatures once, off the main actor by @jackjackbits in perf: verify Nostr inbound signatures once, off the main actor #1352
• Fix BLE identity state races by @jackjackbits in Fix BLE identity state races #1428
• Pin announce signing keys to stop mesh identity spoofing by @jackjackbits in Pin announce signing keys to stop mesh identity spoofing #1349
• Require review before importing shared content by @jackjackbits in Require review before importing shared content #1430
• Deflake GeoRelayDirectoryTests under constrained runners by @jackjackbits in Deflake GeoRelayDirectoryTests under constrained runners #1479
• Encrypt private media before BLE fragmentation by @jackjackbits in Encrypt private media before BLE fragmentation #1434
• Make nearby notes tests parallel-safe by @jackjackbits in Make nearby notes tests parallel-safe #1471
• Relabel private Nostr envelopes honestly in docs; harden legacy envelope validation by @jackjackbits in Relabel private Nostr envelopes honestly in docs; harden legacy envelope validation #1480
• Make ordinary Noise reconnects atomic and race-safe by @jackjackbits in Make ordinary Noise reconnects atomic and race-safe #1463
• Preserve early Noise ciphertext across reconnect promotion by @jackjackbits in Preserve early Noise ciphertext across reconnect promotion #1464
• Deliver live DM transport events synchronously by @jackjackbits in Deliver live DM transport events synchronously #1465
• Persist authenticated private-media delivery receipts by @jackjackbits in Persist authenticated private-media delivery receipts #1466
• Retry confirmed private media after reconnect by @jackjackbits in Retry confirmed private media after reconnect #1467
• Make private-media deletion transactional by @jackjackbits in Make private-media deletion transactional #1468
• Keep open DMs alive across Bluetooth settings by @jackjackbits in Keep open DMs alive across Bluetooth settings #1460
• Keep DMs canonical across transport aliases by @jackjackbits in Keep DMs canonical across transport aliases #1461
• Retry unacknowledged DMs after Noise replacement by @jackjackbits in Retry unacknowledged DMs after Noise replacement #1462
• Harden iOS-sim CI: destination fallback + Noise reconnect test determinism by @jackjackbits in Harden iOS-sim CI: destination fallback + Noise reconnect test determinism #1483
• docs: correct inaccurate privacy and metadata claims by @jackjackbits in docs: correct inaccurate privacy and metadata claims #1485
• Harden what a locked or seized device gives away by @jackjackbits in Harden what a locked or seized device gives away #1484
• Keep working when the network is hostile, and make the app verifiable by @jackjackbits in Keep working when the network is hostile, and make the app verifiable #1486
• Close the three holes the Keep working when the network is hostile, and make the app verifiable #1486 review found by @jackjackbits in Close the three holes the #1486 review found #1488
• Keep the composer focused after sending with the return key by @jackjackbits in Keep the composer focused after sending with the return key #1490
• Add a real security policy by @jackjackbits in Add a real security policy #1489
• Deflake CI, and make the flake class unrepeatable by @jackjackbits in Deflake CI, and make the flake class unrepeatable #1491
• Add Play Store link to README by @sashko in Add Play Store link to README #1524
• BLE transport architecture V3: one engine domain, capability ports, feature-owned state by @jackjackbits in BLE transport architecture V3: one engine domain, capability ports, feature-owned state #1498
• Defer alert-binding dismissal writes out of the view update by @jackjackbits in Defer alert-binding dismissal writes out of the view update #1537
• Link layer slice 1: extract the central-role radio policy into BLERadioController by @jackjackbits in Link layer slice 1: extract the central-role radio policy into BLERadioController #1539
• Link layer slice 2: cohere link-auth state and split bindings from the physical store by @jackjackbits in Link layer slice 2: cohere link-auth state and split bindings from the physical store #1540
• Link layer slice 3: bindings and link-auth become engine-owned (the option-B domain flip) by @jackjackbits in Link layer slice 3: bindings and link-auth become engine-owned (the option-B domain flip) #1547
• Link layer slice 4: deterministic multi-node mesh simulation (and the panic-announce bug it caught) by @jackjackbits in Link layer slice 4: deterministic multi-node mesh simulation (and the panic-announce bug it caught) #1548
• Link layer slice 5: BLELinkEvent — the port has a name, the delegates have their own files by @jackjackbits in Link layer slice 5: BLELinkEvent — the port has a name, the delegates have their own files #1551
• Fix Dual-link rotation leaves the retired identity as a ghost until its stale link drops #1538: release stale bindings on rotation instead of leaving a ghost identity by @jackjackbits in Fix #1538: release stale bindings on rotation instead of leaving a ghost identity #1554
• Fix $$ escaping that broke every Xcode just recipe by @jozanek in Fix $$ escaping that broke every Xcode just recipe #1525
• Fix built-in relay actor isolation by @kudala-bharani in Fix built-in relay actor isolation #1528
• Don't suggest blocked people in @-mentions by @Chessing234 in Don't suggest blocked people in @-mentions #1543
• Make DeliveryStatus non-optional with an explicit .notSentYet state by @viditkulsh in Make DeliveryStatus non-optional with an explicit .notSentYet state #1503
• Replace try! regex construction with a non-trapping SafeRegex helper by @viditkulsh in Replace try! regex construction with a non-trapping SafeRegex helper #1501
• fix: show verified seal next to sender names in chat by @Chessing234 in fix: show verified seal next to sender names in chat #1506
• chore: fix receive typo and refresh relay count by @Chessing234 in chore: fix receive typo and refresh relay count #1510
• Normalize nicknames to Unicode NFC at storage and comparison boundaries by @viditkulsh in Normalize nicknames to Unicode NFC at storage and comparison boundaries #1502
• fix(ble): don't spend the fragment scheduler's slot budget on blocked requests by @krishrathi1 in fix(ble): don't spend the fragment scheduler's slot budget on blocked requests #1530
• Make the completion-grace restart test deterministic by @jackjackbits in Make the completion-grace restart test deterministic #1563
• Fix the SimulatedMesh announce-loss flake by @jackjackbits in Fix the SimulatedMesh announce-loss flake #1564
• Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection by @jackjackbits in Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection #1566
• fix: stop EnvironmentObject crash in the people sheet by @Chessing234 in fix: stop EnvironmentObject crash in the people sheet #1567
• Give media the explicit file-protection class other stores use by @heyaim in Give media the explicit file-protection class other stores use #1552
• Pin that unknown file TLVs are skipped, not fatal by @vincenzopalazzo in Pin that unknown file TLVs are skipped, not fatal #1550
• Deflake VoiceRecorderTests: replace timed semaphores with async events by @jackjackbits in Deflake VoiceRecorderTests: replace timed semaphores with async events #1572
• Silence the four release-build warnings by @jackjackbits in Silence the four release-build warnings #1583

New Contributors

• @Chessing234 made their first contribution in Harden public intake bounds against untrusted growth #1451
• @RodsF1 made their first contribution in Add Persian (fa) localization and an in-app language picker #1443
• @sashko made their first contribution in Add Play Store link to README #1524
• @jozanek made their first contribution in Fix $$ escaping that broke every Xcode just recipe #1525
• @kudala-bharani made their first contribution in Fix built-in relay actor isolation #1528
• @viditkulsh made their first contribution in Make DeliveryStatus non-optional with an explicit .notSentYet state #1503
• @krishrathi1 made their first contribution in fix(ble): don't spend the fragment scheduler's slot budget on blocked requests #1530
• @heyaim made their first contribution in Give media the explicit file-protection class other stores use #1552
• @vincenzopalazzo made their first contribution in Pin that unknown file TLVs are skipped, not fatal #1550

Full Changelog: v1.7.0...v1.7.1

---

This discussion was created from the release v1.7.1.

[vincenzopalazzo]

LGTM, thanks!