Operator kit v0.4.0 — devnet.
Security: update recommended. Relay binaries prior to v0.4.0 bind Sphinx anti-replay protection to a mutable packet identifier rather than the packet bytes (fixed in commit 5d4c10e). A relay running an old binary could be induced to re-forward a captured packet, which weakens replay resistance on that hop. Message content is not exposed (end-to-end encryption is unaffected). Details: SECURITY.md in this repo.
Changes vs v0.3.0:
- Sphinx anti-replay bound to the packet bytes, not the mutable packet id (the fix above).
- The relay reads its transport seed from a file (
--secret-file) — the seed is no longer visible inpsfor the life of the daemon. The installer writes it 0600 and wires the unit accordingly. - Zero-SOL heartbeat: optional sponsoring gateway (
NW_SPONSOR_URL/sponsor_url) pays the beat fee; the operator key only signs. Comma-separate several gateways for failover. Without a sponsor, beats stay self-funded as before. - Sponsored registration documented in the printed next-steps (
register-node-sponsored). - 2-party re-onboard ceremony (
reonboard-ceremony-init/show/complete/void): recover an orphaned node (lost operator key) in ONE atomic transaction — deregister + re-register with the same node id and transport identity. Only a partially-signed transaction blob and a signature cross the wire; neither private key leaves its machine, and the operator-side CLI refuses to sign any transaction it cannot verify byte-for-byte against what it displays.
Install / upgrade: run the one-command installer from this repo (install-nullwire-node.sh), or replace the binaries with these artifacts after verifying them against SHA256SUMS.