0.3.0 — Pairing and Debian Packages

Two things landed since 0.2.0: you can lock the receiver behind a pincode,
and you can install it from a .deb instead of compiling it.

Pairing: --pincode

AirPlay 2 has no AirPlay 1-style Digest password — its access control is
pairing — so the openairplay1 --password idea takes a different shape here.
Start the receiver with --pincode 4821 and a sender has to enter that code
before it can pair; without the flag nothing changes and the receiver keeps
pairing transiently, which is what you want on a trusted home network.

Getting a real sender to ask for the code turned out to hinge on one bit:
the receiver has to advertise AirPlay status-flag bit 7 ("password
required", 0x4 → 0x84), or iOS silently pairs transiently and never
prompts. From there the sender sends pair-pin-start, the receiver answers an
empty 200 ("the device is displaying the code" — for a headless receiver, the
code is yours), and the pincode becomes the SRP password for pair-setup
M1–M4: the wrong code fails SRP proof verification, the right one installs the
encrypted channel exactly as the transient path does. Notably iOS never sends
M5/M6 in this flow — it completes at M4.

All of that was pinned against a real iPhone on iOS 26 and written up in
notes/protocol.md.
The pincode is never logged.

Debian packages

Until now the only ways to run the receiver were cargo build or
cargo install — both needing a Rust toolchain on the target machine, and
neither leaving you with something that survives a reboot. This release ships
.deb packages for amd64, arm64 and armhf (Debian's ARMv7 port),
so the natural home for this thing — a small always-on Linux box wired to an
amplifier — is one command away:

sudo apt-get install -y ./openairplay2-receiver_0.3.0-1_arm64.deb

What you get is a systemd service, enabled and started, running as its own
openairplay2 user and configured by editing
/etc/default/openairplay2-receiver. The pairing identity lives in
/var/lib/openairplay2, so upgrading never asks your Mac to pair again, and
upgrades swap the running daemon rather than leaving the old binary playing.
Each package carries a signed build-provenance attestation:

gh attestation verify openairplay2-receiver_0.3.0-1_arm64.deb --repo st3fan/openairplay2

ARMv6 boards (Pi Zero W, Pi 1) are deliberately refused at install time: dpkg
cannot tell Debian armhf from Raspbian armhf, and the alternative is an illegal
instruction at runtime.

Behind that, releasing changed shape. Publishing a GitHub Release is now the
only event that ships anything: the release workflow checks the tag against the
crate version and dispatches two workflows in parallel — one publishing both
crates to crates.io, one building all three architectures (amd64 and arm64
natively, armhf cross-compiled, since no 32-bit ARM runners exist) and
attaching them here with SHA256SUMS.

Also

A receiver left running while music plays is quiet now: info is startup and
problems only, and every per-request, per-packet and per-session diagnostic
moved to RUST_LOG=debug. And the binary handles SIGTERM, which is how
systemd stops a service. The library's API is unchanged from 0.2.0.

Release done by Claude with permission of @st3fan.

What's Changed

• Plan: publish openairplay2 to crates.io by @st3fan in #25
• Packaging metadata for crates.io by @st3fan in #26
• Documentation pass: warn(missing_docs) and fill the gaps by @st3fan in #27
• CI and release automation by @st3fan in #28
• Make the receiver publishable; README badges and install lines by @st3fan in #29
• Bump versions to 0.2.0 by @st3fan in #31
• Plan: persistent pairing (AirPlay 2 pincode) by @st3fan in #32
• Pincode: --pincode gates pairing — status bit 7 + pair-pin-start + SRP password by @st3fan in #38
• Protocol: AirPlay 2 pairing & pincode notes (validated on iOS 26) by @st3fan in #39
• Plan: reduce logging — info = startup/problems, wire diagnostics under debug by @st3fan in #42
• Tone down logging: info = startup/problems, wire diagnostics to debug by @st3fan in #41
• Plan: Debian packages for amd64 and arm64 by @st3fan in #44
• Package the receiver as a .deb (cargo-deb, systemd unit) by @st3fan in #45
• Release: dispatch to cargo.yml and debian.yml, attach .debs by @st3fan in #46
• Plan: armhf .deb for 32-bit ARM, cross-compiled by @st3fan in #48
• armhf: a third .deb, cross-compiled from amd64 by @st3fan in #49
• Bump to 0.3.0 by @st3fan in #51

Full Changelog: v0.2.0...v0.3.0