Releases: yunomiwell/nullwire-node
Release list
v0.4.0 — replay fix + zero-SOL heartbeat + re-onboard ceremony
Operator kit v0.4.0 — devnet.
Security: update recommended. Relay binaries prior to v0.4.0 bind Sphinx anti-replay protection to a mutable packet identifier rather than the packet bytes (fixed in commit 5d4c10e). A relay running an old binary could be induced to re-forward a captured packet, which weakens replay resistance on that hop. Message content is not exposed (end-to-end encryption is unaffected). Details: SECURITY.md in this repo.
Changes vs v0.3.0:
- Sphinx anti-replay bound to the packet bytes, not the mutable packet id (the fix above).
- The relay reads its transport seed from a file (
--secret-file) — the seed is no longer visible inpsfor the life of the daemon. The installer writes it 0600 and wires the unit accordingly. - Zero-SOL heartbeat: optional sponsoring gateway (
NW_SPONSOR_URL/sponsor_url) pays the beat fee; the operator key only signs. Comma-separate several gateways for failover. Without a sponsor, beats stay self-funded as before. - Sponsored registration documented in the printed next-steps (
register-node-sponsored). - 2-party re-onboard ceremony (
reonboard-ceremony-init/show/complete/void): recover an orphaned node (lost operator key) in ONE atomic transaction — deregister + re-register with the same node id and transport identity. Only a partially-signed transaction blob and a signature cross the wire; neither private key leaves its machine, and the operator-side CLI refuses to sign any transaction it cannot verify byte-for-byte against what it displays.
Install / upgrade: run the one-command installer from this repo (install-nullwire-node.sh), or replace the binaries with these artifacts after verifying them against SHA256SUMS.
v0.3.0 — relay kit + registry heartbeat
Relay stays registered via a heartbeat sidecar (60s TTL). node-heartbeat command; v0.3.0 core.
Security note (2026-08-20): relay binaries from this release contain a replay-protection weakness — please update to v0.4.0. Details: SECURITY.md.
nullwire-node v0.1.0
First public release. Relay + CLI, static musl binaries for aarch64 and x86_64. Verify downloads against SHA256SUMS — the installer fails closed on mismatch. One-command install: curl -fsSL https://raw.githubusercontent.com/yunomiwell/nullwire-node/main/install-nullwire-node.sh | sudo bash
Security note (2026-08-20): relay binaries from this release contain a replay-protection weakness — please update to v0.4.0. Details: SECURITY.md.