v0.9.1

Highlights

• The FROST nonce replay guard never fired (#933): mark_nonce_used had no callers anywhere in the workspace, so no entry was ever marked used, the reject branch was unreachable, and a repeated round-1 commitment fell through and was signed. Two signature shares over one nonce under different challenges give s = (z1 - z2) / (c1 - c2), which is the signer's key share, so this is the guard that exists to make that impossible. Commitments are now claimed at the point they are handed to the signing path. The store also writes via temporary file, fsync and rename: File::flush is a no-op, so a claim previously lived in the page cache only and a power loss between claiming and signing lost it, which is precisely the reboot-replay case the store exists to stop. A versionless store is refused rather than silently trusted.

• Entropy health checks now sample the OS source directly (#932): the check ran only on mixed output, and the mix folds in a monotonic counter, timing deltas and live heap and stack addresses, so three post-mix samples come out distinct, non-zero and far apart even when the OS source writes a constant. A gate that can only observe the combiner is the same shape as the bug it exists to catch. The OS source is now checked on its own before anything is mixed in, with the mixed output still checked separately to catch a broken mixer. A regression test asserts that a constant OS pool satisfies every post-mix criterion, which is why the pre-mix sample is required.

• Nostr relay pool updated past a signature-verification bypass (RUSTSEC-2026-0224): nostr-relay-pool inserted its verification-cache entry before the signature check ran, so a first delivery with a bad signature still created the entry and a later delivery of the same event ID with a forged signature skipped verification entirely and was persisted as validated. That allows unsigned events attributed to any public key to be written into an application's trusted store. Updated 0.44.1 to 0.44.2, where the entry is only inserted after verification succeeds. Reported by Ali Al-Sorehi; discovered here by the release gate.

• Approval prompts carry the request label and say whether it was proven (#929, #930): the co-signing prompt shows which request is asking, and surfaces state whether that label was cryptographically verified or merely claimed, so a name on its own cannot imply it was checked.

• CI no longer exposes its job token to a tree the PR author controls (#934).

• Rate-limit tests no longer race the derivation they trigger (#931).

Neither of the first two items is known to have been exploited, and no evidence of exploitation was looked for. Both are guards that were not doing what they were written to do.

Install

• CLI / Desktop: download the asset for your platform from the Assets section below.
• StartOS: bundled via keep-startos.
• Build from source: see the README.

Verify

sha256sum -c SHA256SUMS

Full changelog

v0.9.0...v0.9.1