v0.12.2

Highlights

A compromised certificate authority is no longer trusted. The private keys of several emSign intermediate CAs are public, so anyone holding them can issue a TLS certificate for any host that chains to emSign ECC Root CA - G3. keep compiles its trusted roots in, so every earlier release still trusts that root for relay connections, Esplora and warden calls, and the gateway's http_request tool. This release removes the root and rejects certificate paths through those intermediates (#1102). Upgrade every keep install; the matching keep-android release does the same for the app.

Agents can use SSH keys they never hold (#1042). keep secret ssh-keygen creates an SSH key inside the vault, and keep agent ssh-agent is a local SSH agent that holds no key and has the gateway sign each request: logins only to the hosts and users the grant names, bound to the host's key, and SSHSIG signatures (for SSH-signed git commits) only in the namespaces it names. See "SSH keys for agents" in docs/USAGE.md.

Fixes

• FROST wallets with four or more recovery tiers can be set up. The descriptor for such a wallet was written in a form keep could not read back, so coordinated setup failed; miniscript 13.2.0 writes it correctly (#1103). Wallets with up to three tiers have the same descriptor and checksum as before.

Upgrading

• No vault migration. A vault opened by v0.12.1 opens unchanged.
• Once the vault holds an SSH key, v0.12.1 and earlier cannot list its secrets: they do not know the new secret kind, so any listing fails. To go back, restore a backup made before the key was created.

Security

• Compromised CA root removed (#1102): webpki-roots 1.0.10 and rustls-webpki 0.103.16 in every build, including the Python and TypeScript agent bindings' lockfiles.
• Relay certificate pins are enforced on the live connection (#1049, #1050, #1052), on the bunker's and the NIP-46 client's relay sockets as well as the pin probe, and relay sockets go through the configured SOCKS proxy (#1051).
• NIP-46 bunker hardening. It never auto-approves the event kinds a client names on connect (#1090), signs a relay auth only with a standing permission (#1072), denies an approval that goes unanswered (#1068), ignores requests dated outside its run (#1092), replaces the connect secret and stops when a client is revoked (#1096), stops when its share or relay pins change (#1088), and a keyring bunker signs with the signing key, not the transport key (#1091).
• FROST randomness is checked at each draw that a nonce, DKG, dealer or refresh secret is built from (#1064, #1066), with a health criterion that catches a partially filled buffer (#1073).
• PSBT key origins are bounded, both those read from a PSBT and those a FROST wallet PSBT can make keep derive (#1044, #1046).
• negentropy 0.5.2 for a reconciliation allocation DoS (#1060); memsecurity 4.0 (#1086).

Mobile core

keep-mobile, the core of the Android app, gains the phone side of agent approvals (#1045) and a warden-signed spending policy for unattended key-path spends. The policy:

• bounds each spend by destination and amount, and spends across a rolling window (#1061, #1062);
• refuses rather than allows when the policy cannot be verified, its spending history cannot be read, or the record of an accepted policy is missing (#1063, #1065, #1101);
• expires after thirty days, judged against a time floor the device clock cannot lower (#1070, #1071);
• refuses a stored policy older than the newest one accepted (#1100);
• can be removed, and its wardens changed, only with a trusted warden's signature (#1080).

Verifying this release

Download SHA256SUMS, SHA256SUMS.asc, privkeyio-signing-key.asc and the files you want into one folder:

gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

Look for Good signature from "Kyle Santiago <kyle@privkey.io>" on key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38, and OK for each file. The warning that the key is not certified is expected, and means only that you have not marked it trusted yourself.

Binaries are built reproducibly from the tagged commit, and the tag is signed with the same key, so git verify-tag v0.12.2 checks the source they were built from. Releases are signed by one maintainer key; threshold signing is not in place yet.

Full Changelog: v0.12.1...v0.12.2