v0.13.10

Keycard Shell keys (secp256k1) now verify wherever the CLI runs: the keyserver, thurin status, thurin key ssh. Typed data handed to an external signer (--signer, --sign-out) now lists EIP712Domain, as hardware signers expect. Before anything is signed, the CLI shows the network and how the claim will be published. Bundles identity-kit 2.2.1.

SHA256SUMS is signed by thurinlabs.eth's key (08B9374FDFBEC67EFFA24E669D3D86E35361EF7B) and named on-chain.

v0.13.9

The keyserver takes v6 (RFC 9580) keys: gpg --recv-keys with a 64-hex fingerprint, with or without 0x, and its index splits any fingerprint at the middle. Claiming a v6 key with Sequoia: docs.thurin.id/#/cli. Bundles identity-kit 2.2.1.

SHA256SUMS is signed by thurinlabs.eth's key (08B9374FDFBEC67EFFA24E669D3D86E35361EF7B) and named on-chain.

v0.13.8

No ETH? The CLI says so before asking to send, and points to the ways round it. --authorize now tries a relay that pays on mainnet, and falls back to the link if it can't. A send that fails for funds says so plainly instead of a raw error. Bundles identity-kit 2.2.1.

SHA256SUMS is signed by thurinlabs.eth's key (08B9374FDFBEC67EFFA24E669D3D86E35361EF7B) and named on-chain.

v0.13.7

Smart accounts can use permissions and the relay. Permissions are now checked the way the registry checks them: the owner's own key (normal and EIP-7702 accounts), or else the owner account's own answer (EIP-1271: Safes, smart-account wallets). The check lives in identity-kit 2.1.0, shared with thurin.id. Supersedes 0.13.6.

v0.13.6

Superseded by 0.13.7. Accepts smart-account permissions (EIP-1271), as the registry does. 0.13.7 does the same with the check moved into identity-kit; use 0.13.7.

Verify this release: https://docs.thurin.id/#/guides/verify-release

v0.13.5

One signed file, nothing fetched at install. Every dependency (viem, openpgp.js, noble, and the rest) is now bundled into dist/thurin.js, built from a lockfile with a hash for every package. Installing the CLI fetches nothing else, so the checksum named on-chain covers every line that runs. Installs shrink from ~96 MB to 2.5 MB. Bundled licenses ship in dist/THIRD-PARTY-LICENSES.txt.

v0.13.4

The relay reports its version. GET / on a relay (e.g. relay.thurin.id) now includes "version", so anyone can see which build a relay is running, and a relay left on an old build no longer goes unnoticed.

Verify this release: https://docs.thurin.id/#/guides/verify-release

v0.13.3

wallet create and export --private-key print secrets only to a terminal

v0.13.2

Plain words when gpg can't sign

When gpg fails while signing a claim or running thurin encrypt, the CLI now says what to do instead of passing gpg's raw error through:

• a timeout: "gpg gave up waiting for your key. If it's a security key, touch it when it blinks (and check it's the right one plugged in), then try again."
• a cancelled PIN prompt, a card that isn't plugged in, or a refused PIN: one sentence each.

Anything else still shows gpg's own words.

Also

• The test tools moved to vitest 5 (their security advisories were in development tools only; nothing that ships changed).
• keys.thurin.id and relay.thurin.id run this version.
• Named on-chain from thurinlabs.eth: thurin record get thurinlabs.eth releases

Verify this release: https://docs.thurin.id/#/guides/verify-release

v0.13.1

PGPRegistry v3

The CLI now reads and writes the v3 registry, 0xFa6956c11163517249f8A67F5560a4406B519451 on Ethereum mainnet (verified on Etherscan and Sourcify). Built on identity-kit 2.0.0. v3 started empty, so claims made on v2 need publishing again; v2 stays on-chain and older CLIs keep reading it.

thurin encrypt

Encrypt a message or a file to anyone's verified key, by name, address, or fingerprint:

echo "meet at noon" | thurin encrypt bendoubleu.eth > note.asc
thurin encrypt bendoubleu.eth report.pdf --sign

Only to the claim that counts, and only while its encryption subkey is valid; otherwise one sentence says why. It warns when the key arrived in the last 7 days. The recipient's key ID is left out of the message (--show-recipient puts it back), and nothing is imported into your keyring.

thurin key ssh

thurin key ssh <identity> prints the SSH keys from the claim that counts, as authorized_keys lines. Point sshd's AuthorizedKeysCommand at it and a revoked claim stops the next login. SSH (authentication) subkeys are kept when you publish a key.

Also

• Transactions tip at least 0.05 gwei, from what recent blocks paid: many nodes suggest 0, and a zero-tip transaction can wait minutes. The relay does the same. (New in 0.13.1; 0.13.0 was published earlier the same day without it.)
• --show-network lists the hosts a command contacted when it ends; nothing is stored.
• An expired or revoked key is refused in plain words before gpg is asked to sign.
• thurin key fetch returns the key of the claim that counts, the same one status shows.
• keys.thurin.id and relay.thurin.id run this version.
• Named on-chain from thurinlabs.eth: thurin record get thurinlabs.eth releases

Verify this release: https://docs.thurin.id/#/guides/verify-release