v0.7.0-rc2

Database Migrations

Note that downgrading from v0.7.0-rc2 to previous tapd versions is not presently supported. You should create backups of tapd database state before upgrading to tapd v0.7.0-rc2.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.7.0-rc2.sig and manifest-v0.7.0-rc2.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.7.0-rc2.sig manifest-v0.7.0-rc2.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.7.0-rc2.sig.ots and manifest-v0.7.0-rc2.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.7.0-rc2.sig.ots -f manifest-roasbeef-v0.7.0-rc2.sig
ots verify manifest-v0.7.0-rc2.txt.ots -f manifest-v0.7.0-rc2.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.24.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.7.0-rc2
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.7.0-rc2 /verify-install.sh v0.7.0-rc2
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.7.0-rc2.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.7.0-rc2.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.7.0-rc2" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.7.0-rc2" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (curated)

See the in-repo release notes for a detailed list of high-level changes made since v0.6.1.

Release Notes (auto-generated)

What's Changed Since v0.7.0-rc1

• rpc: update new supply commit calls to use the global universe server rate limiter by @Roasbeef in #1785
• tapd: add universe.disable-supply-verifier-chain-watch config flag by @ffranr in #1796
• tools: migrate linter config to v2 by @jtobin in #1790
• tapd: bump maxFeeRatio for funded psbts by @GeorgeTsagk in #1545
• scripts: add jtobin release signing key by @jtobin in #1798
• Mark pre-commit outputs spent on supply insert in supplyverifier by @ffranr in #1797
• scripts: add darioanongba signing key by @darioAnongba in #1803
• scripts: signing key maintenance by @jtobin in #1806
• supplycommit+rpcserver: move ignore asset logic from RPC server to supplycommit pkg by @ffranr in #1801
• rfq+taprpc: add asset ID and group key to PeerAccepted[Buy/Sell]Quote by @ffranr in #1805
• allow building taprpc by itself by @ZZiigguurraatt in #1789
• gemini: add config and style guidelines by @Roasbeef in #1804
• Bump go to v1.24.6 by @GeorgeTsagk in #1815
• cmd: add locator args to supplycommit fetch by @jtobin in #1819
• tapdb: fix flaky TestQueryMessages due to close timestamps by @ffranr in #1816
• itest: introduce rpcassert package with RPC helpers to reduce flakes by @ffranr in #1799
• cli: include unset and zero-valued proto fields in JSON output by @ffranr in #1821
• Filter AddrReceives by timestamp by @darioAnongba in #1794
• Add support for fetching latest supply commitment via new locator type by @ffranr in #1823
• itest: fix address receives test: timestamp in the future by @darioAnongba in #1828
• taprpc: upgrade falafel to v0.9.2 by @darioAnongba in #1827
• Full asset burn by @darioAnongba in #1791
• tapgarden: harden MockKeyRing and fix flaky queueSeedlingsInBatch test by @ffranr in #1824
• universerpc+itest: add and verify string outpoint in SupplyCommitChainData by @ffranr in #1822
• Extract supply pre-commits from mint leaves during supply verifier sync by @ffranr in #1820
• docs: add docs that detail the asset chan funding process by @Roasbeef in #1783
• docs: add docs on e2e RFQ arch by @Roasbeef in #1787
• taprpc+itest: whitelist FetchSupplyLeaves RPC and add integration test by @ffranr in #1829
• Add block header support to supply RPCs and related integration tests by @ffranr in #1839
• tapdb: error on dirty database versions by @ViktorT-11 in #1826
• proof+tapsend: sanity-check STXO proof structure at creation time by @ffranr in #1836
• rfq+server: properly configure gRPC keep alive settings for client+server by @Roasbeef in #1834
• Feature bits by @GeorgeTsagk in #1748
• Prepare tap channels for v1 proofs by @GeorgeTsagk in https://github.com/lightningl...

v0.7.0-rc1

Database Migrations

Note that downgrading from v0.7.0.rc-1 to previous tapd versions is not presently supported. You should create backups of tapd database state before upgrading to tapd v0.7.0.rc-1.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.7.0-rc1.sig and manifest-v0.7.0-rc1.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.7.0-rc1.sig manifest-v0.7.0-rc1.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.7.0-rc1.sig.ots and manifest-v0.7.0-rc1.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.7.0-rc1.sig.ots -f manifest-roasbeef-v0.7.0-rc1.sig
ots verify manifest-v0.7.0-rc1.txt.ots -f manifest-v0.7.0-rc1.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.12, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.7.0-rc1
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.7.0-rc1 /verify-install.sh v0.7.0-rc1
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.7.0-rc1.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.7.0-rc1.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.7.0-rc1" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.7.0-rc1" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (curated)

See the in-repo release notes for a detailed list of high-level changes made since v0.6.1.

Release Notes (auto generated)

What's Changed

• [group key addrs 1/?]: add new authmailbox RPC server and client by @guggero in #1502
• universe: use correct ID comparison for sync config by @guggero in #1610
• Improve robustness of GenGroupAnchorVerifier with anchor checks by @ffranr in #1602
• universe/supplycommit: create new state machine responsible for maintaining the supply commitment for an asset by @Roasbeef in #1464
• Refactor: Split Pre-Commitment Logic to Support New Asset Groups by @ffranr in #1589
• [group key addrs 3/5]: misc refactor by @guggero in #1611
• tapdb: retroactively insert old asset burns into burn table by @guggero in #1612
• CI: fix litd itest by @guggero in #1615
• [group key addrs 2/5]: internal/ecies: add encrypt/decrypt with ECIES by @guggero in #1512
• tapdb: add implementation of supplycommit.SupplyTreeView by @Roasbeef in #1507
• [group key addrs 4/5]: implement mailbox server and message store database by @guggero in #1614
• ecies: add version byte prefix to encoding format by @ffranr in #1619
• tapfreighter+itest: store change script key to DB by @guggero in #1620
• tapdb: add implementation of supplycommit.CommitmentTracker and supplycommit.StateMachineStore by @Roasbeef in #1508
• build(deps): bump the go_modules group across 4 directories with 1 update by @dependabot[bot] in #1624
• tapdb: sanitize db errors before returning by @Roasbeef in #1630
• tapdb: support delegation key and universe commitment flag in seedlings by @ffranr in #1638
• [group key addrs 5/6]: Add Pedersen unique script key type by @guggero in #1621
• mod+server: update to lnd v0.19.2-beta.rc2, taprpc to v1.0.9 by @guggero in #1644
• itest: run in parallel, fix local flake by @guggero in #1641
• itest: convert AssertBalanceByID to eventually-style call by @ffranr in #1651
• universe: fix asset stats being extremely slow by @guggero in #1650
• server+tapchannel: fix deadlock potential, queue msgs by @guggero in #1652
• tapchannel: add a one unit extra tolerance to invoice acceptor by @GeorgeTsagk in #1639
• AddInvoice correctly handles existing route hints by @GeorgeTsagk in #1627
• supplycommit: add MultiStateMachineManager for managing group state machines by @ffranr in #1643
• Bump LND out of RC and fix CLI short name by @ffranr in #1657
• Bugfix supply commit state machine by @ffranr in #1655
• Refactor: move LND-related services into new lndservices package by @ffranr in #1668
• [group key addrs 6/7]: bug fixes and refactors by @guggero in #1658
• RPC: Add Ignore Tree Endpoints by @ffranr in #1554
• ci: fix litd itest by @guggero in #1671
• universe+tapdb: add new block_height field to universe_leaves use that to implement block height based supply tree queries by ...

v0.6.1

This minor release contains important bug fixes.

Database Migrations

tapd v0.6.x contains non-revertible database migrations. After running tapd v0.6.x, these database migrations prevent downgrading tapd to a previous v0.5.x release. Create backups of tapd database state, before upgrading to tapd v0.6.x. Please report any database migration issues.

Breaking changes

See previous version v0.5.1 release notes for changes prior to v0.5.x.
There are no breaking changes between v0.5.1 and v0.6.0, but grouped asset channel funding will only work with the next version of Lightning Terminal (v0.15.0-alpha) which is going to be published soon.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.6.1.sig and manifest-v0.6.1.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.6.1.sig manifest-v0.6.1.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.6.1.sig.ots and manifest-v0.6.1.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.6.1.sig.ots -f manifest-roasbeef-v0.6.1.sig
ots verify manifest-v0.6.1.txt.ots -f manifest-v0.6.1.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.9, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.6.1
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.6.1 /verify-install.sh v0.6.1
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.6.1.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.6.1.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.1" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.1" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• release: create minor release v0.6.1 side branch by @guggero in #1654

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Database Migrations

tapd v0.6.0 contains non-revertible database migrations. After running tapd v0.6.0, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.6.0. Please report any database migration issues.

Breaking changes

See previous version v0.5.1 release notes for changes prior to v0.5.x.
There are no breaking changes between v0.5.1 and v0.6.0, but grouped asset channel funding will only work with the next version of Lightning Terminal (v0.15.0-alpha) which is going to be published soon.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.6.0.sig and manifest-v0.6.0.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.6.0.sig manifest-v0.6.0.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.6.0.sig.ots and manifest-v0.6.0.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.6.0.sig.ots -f manifest-roasbeef-v0.6.0.sig
ots verify manifest-v0.6.0.txt.ots -f manifest-v0.6.0.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.9, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.6.0
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.6.0 /verify-install.sh v0.6.0
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.6.0.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.6.0.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• rpcserver: better rfq channel selection by @GeorgeTsagk in #1357
• Proof of Concept: Simplifying Concurrency with ContextGuard.Goroutine by @ffranr in #1380
• cmd/commands: add offset and limit params to roots cmd by @guggero in #1393
• Refactor Group Key Code by @ffranr in #1396
• scripts: update georgetsagk.asc gpg key by @GeorgeTsagk in #1394
• misc CI/build system improvements by @guggero in #1381
• rfq+rfqmath: fix sats-per-asset conversion in mock price oracle by @ffranr in #1399
• tapdb+sqlc: sqlc: add script to merge SQL migrations into consolidated schemas by @Roasbeef in #1387
• Remove redundant PayToTaprootScript functions by @ffranr in #1404
• Support Directory Exclusion in Golang Version Linter Check by @ffranr in #1405
• make: fix sqlc-check by @guggero in #1406
• Implement PrevId[] UTXO selection for FundVirtualPSBT RPC method; valid for single PrevId at first by @habibitcoin in #1172
• tapdb: expand allowed proof types in universe-related tables by @Roasbeef in #1386
• proof: add new IgnoreChecker proof rejection cache by @Roasbeef in #1400
• tapdb: fix aider mistakes and inconsistencies by @guggero in #1415
• [wallet 1/3]: refactor in preparation for group key channel funding by @guggero in #1402
• Add sync loadtest by @GeorgeTsagk in #1352
• [wallet 2/3]: refactor funding logic to use allocation code by @guggero in #1407
• Add pre-commitment output to mint anchor TX by @ffranr in #1325
• Support group keys for RFQ negotiation flows by @GeorgeTsagk in #1382
• Add itest oracle harness by @GeorgeTsagk in #1395
• Update lnd compile-time dependency to v0.19 by @guggero in #1422
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1449
• tapcli: Global flags to accept ENV vars overrides. by @gcaracuel in #1447
• multi: update to tagged lnd v0.19.0-beta.rc1 by @guggero in #1454
• tapchannel: validate proof courier before opening or accepting channels by @guggero in #1412
• [custom channels]: refactor channel JSON, add more custom data parsers by @guggero in #1441
• Support group keys on SendPayment & AddInvoice by @GeorgeTsagk in #1423
• tapd+tapdb: return anchor block height in ListTransfers if available by @bhandras in #1461
• build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 in /tools in the go_modules group across 1 directory by @dependabot in #1469
• [wallet 3/3]: group key support for channel funding by @guggero in #1413
• Block on Proof Courier Service Connectio...

v0.6.0-rc3

Database Migrations

tapd v0.6.0-rc3 contains non-revertible database migrations. After running tapd v0.6.0-rc3, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.6.0-rc3. Please report any database migration issues.

Breaking changes

See previous version v0.5.1 release notes for changes prior to v0.5.x.
There are no breaking changes between v0.5.1 and v0.6.0-rc2, but grouped asset channel funding will only work with the next version of Lightning Terminal (v0.15.0-alpha) which is going to be published soon.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.6.0-rc3.sig and manifest-v0.6.0-rc3.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.6.0-rc3.sig manifest-v0.6.0-rc3.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.6.0-rc3.sig.ots and manifest-v0.6.0-rc3.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.6.0-rc3.sig.ots -f manifest-roasbeef-v0.6.0-rc3.sig
ots verify manifest-v0.6.0-rc3.txt.ots -f manifest-v0.6.0-rc3.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.9, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.6.0-rc3
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.6.0-rc3 /verify-install.sh v0.6.0-rc3
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.6.0-rc3.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.6.0-rc3.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc3" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc3" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• rpcserver: better rfq channel selection by @GeorgeTsagk in #1357
• Proof of Concept: Simplifying Concurrency with ContextGuard.Goroutine by @ffranr in #1380
• cmd/commands: add offset and limit params to roots cmd by @guggero in #1393
• Refactor Group Key Code by @ffranr in #1396
• scripts: update georgetsagk.asc gpg key by @GeorgeTsagk in #1394
• misc CI/build system improvements by @guggero in #1381
• rfq+rfqmath: fix sats-per-asset conversion in mock price oracle by @ffranr in #1399
• tapdb+sqlc: sqlc: add script to merge SQL migrations into consolidated schemas by @Roasbeef in #1387
• Remove redundant PayToTaprootScript functions by @ffranr in #1404
• Support Directory Exclusion in Golang Version Linter Check by @ffranr in #1405
• make: fix sqlc-check by @guggero in #1406
• Implement PrevId[] UTXO selection for FundVirtualPSBT RPC method; valid for single PrevId at first by @habibitcoin in #1172
• tapdb: expand allowed proof types in universe-related tables by @Roasbeef in #1386
• proof: add new IgnoreChecker proof rejection cache by @Roasbeef in #1400
• tapdb: fix aider mistakes and inconsistencies by @guggero in #1415
• [wallet 1/3]: refactor in preparation for group key channel funding by @guggero in #1402
• Add sync loadtest by @GeorgeTsagk in #1352
• [wallet 2/3]: refactor funding logic to use allocation code by @guggero in #1407
• Add pre-commitment output to mint anchor TX by @ffranr in #1325
• Support group keys for RFQ negotiation flows by @GeorgeTsagk in #1382
• Add itest oracle harness by @GeorgeTsagk in #1395
• Update lnd compile-time dependency to v0.19 by @guggero in #1422
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1449
• tapcli: Global flags to accept ENV vars overrides. by @gcaracuel in #1447
• multi: update to tagged lnd v0.19.0-beta.rc1 by @guggero in #1454
• tapchannel: validate proof courier before opening or accepting channels by @guggero in #1412
• [custom channels]: refactor channel JSON, add more custom data parsers by @guggero in #1441
• Support group keys on SendPayment & AddInvoice by @GeorgeTsagk in #1423
• tapd+tapdb: return anchor block height in ListTransfers if available by @bhandras in #1461
• build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 in /tools in the go_modules group across 1 directory by @dependabot in #1469
• [wallet 3/3]: group key support for channel funding by @guggero in https://github.co...

v0.6.0-rc2

Database Migrations

tapd v0.6.0-rc2 contains non-revertible database migrations. After running tapd v0.6.0-rc2, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.6.0-rc2. Please report any database migration issues.

Breaking changes

See previous version v0.5.1 release notes for changes prior to v0.5.x.
There are no breaking changes between v0.5.1 and v0.6.0-rc2, but grouped asset channel funding will only work with the next version of Lightning Terminal (v0.15.0-alpha) which is going to be published soon.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.6.0-rc2.sig and manifest-v0.6.0-rc2.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.6.0-rc2.sig manifest-v0.6.0-rc2.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.6.0-rc2.sig.ots and manifest-v0.6.0-rc2.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.6.0-rc2.sig.ots -f manifest-roasbeef-v0.6.0-rc2.sig
ots verify manifest-v0.6.0-rc2.txt.ots -f manifest-v0.6.0-rc2.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.9, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.6.0-rc2
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.6.0-rc2 /verify-install.sh v0.6.0-rc2
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.6.0-rc2.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.6.0-rc2.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc2" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc2" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• rpcserver: better rfq channel selection by @GeorgeTsagk in #1357
• Proof of Concept: Simplifying Concurrency with ContextGuard.Goroutine by @ffranr in #1380
• cmd/commands: add offset and limit params to roots cmd by @guggero in #1393
• Refactor Group Key Code by @ffranr in #1396
• scripts: update georgetsagk.asc gpg key by @GeorgeTsagk in #1394
• misc CI/build system improvements by @guggero in #1381
• rfq+rfqmath: fix sats-per-asset conversion in mock price oracle by @ffranr in #1399
• tapdb+sqlc: sqlc: add script to merge SQL migrations into consolidated schemas by @Roasbeef in #1387
• Remove redundant PayToTaprootScript functions by @ffranr in #1404
• Support Directory Exclusion in Golang Version Linter Check by @ffranr in #1405
• make: fix sqlc-check by @guggero in #1406
• Implement PrevId[] UTXO selection for FundVirtualPSBT RPC method; valid for single PrevId at first by @habibitcoin in #1172
• tapdb: expand allowed proof types in universe-related tables by @Roasbeef in #1386
• proof: add new IgnoreChecker proof rejection cache by @Roasbeef in #1400
• tapdb: fix aider mistakes and inconsistencies by @guggero in #1415
• [wallet 1/3]: refactor in preparation for group key channel funding by @guggero in #1402
• Add sync loadtest by @GeorgeTsagk in #1352
• [wallet 2/3]: refactor funding logic to use allocation code by @guggero in #1407
• Add pre-commitment output to mint anchor TX by @ffranr in #1325
• Support group keys for RFQ negotiation flows by @GeorgeTsagk in #1382
• Add itest oracle harness by @GeorgeTsagk in #1395
• Update lnd compile-time dependency to v0.19 by @guggero in #1422
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1449
• tapcli: Global flags to accept ENV vars overrides. by @gcaracuel in #1447
• multi: update to tagged lnd v0.19.0-beta.rc1 by @guggero in #1454
• tapchannel: validate proof courier before opening or accepting channels by @guggero in #1412
• [custom channels]: refactor channel JSON, add more custom data parsers by @guggero in #1441
• Support group keys on SendPayment & AddInvoice by @GeorgeTsagk in #1423
• tapd+tapdb: return anchor block height in ListTransfers if available by @bhandras in #1461
• build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 in /tools in the go_modules group across 1 directory by @dependabot in #1469
• [wallet 3/3]: group key support for channel funding by @guggero in https://github.co...

v0.6.0-rc1

Database Migrations

tapd v0.6.0-rc1 contains non-revertible database migrations. After running tapd v0.6.0-rc1, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.6.0-rc1. Please report any database migration issues.

Breaking changes

See previous version v0.5.1 release notes for changes prior to v0.5.x.
There are no breaking changes between v0.5.1 and v0.6.0-rc1, but grouped asset channel funding will only work with the next version of Lightning Terminal (v0.15.0-alpha) which is going to be published soon.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.6.0-rc1.sig and manifest-v0.6.0-rc1.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.6.0-rc1.sig manifest-v0.6.0-rc1.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.6.0-rc1.sig.ots and manifest-v0.6.0-rc1.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.6.0-rc1.sig.ots -f manifest-roasbeef-v0.6.0-rc1.sig
ots verify manifest-v0.6.0-rc1.txt.ots -f manifest-v0.6.0-rc1.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.23.9, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.6.0-rc1
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.6.0-rc1 /verify-install.sh v0.6.0-rc1
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.6.0-rc1.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.6.0-rc1.tar.gz
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc1" ./cmd/tapd
go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.6.0-rc1" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• rpcserver: better rfq channel selection by @GeorgeTsagk in #1357
• Proof of Concept: Simplifying Concurrency with ContextGuard.Goroutine by @ffranr in #1380
• cmd/commands: add offset and limit params to roots cmd by @guggero in #1393
• Refactor Group Key Code by @ffranr in #1396
• scripts: update georgetsagk.asc gpg key by @GeorgeTsagk in #1394
• misc CI/build system improvements by @guggero in #1381
• rfq+rfqmath: fix sats-per-asset conversion in mock price oracle by @ffranr in #1399
• tapdb+sqlc: sqlc: add script to merge SQL migrations into consolidated schemas by @Roasbeef in #1387
• Remove redundant PayToTaprootScript functions by @ffranr in #1404
• Support Directory Exclusion in Golang Version Linter Check by @ffranr in #1405
• make: fix sqlc-check by @guggero in #1406
• Implement PrevId[] UTXO selection for FundVirtualPSBT RPC method; valid for single PrevId at first by @habibitcoin in #1172
• tapdb: expand allowed proof types in universe-related tables by @Roasbeef in #1386
• proof: add new IgnoreChecker proof rejection cache by @Roasbeef in #1400
• tapdb: fix aider mistakes and inconsistencies by @guggero in #1415
• [wallet 1/3]: refactor in preparation for group key channel funding by @guggero in #1402
• Add sync loadtest by @GeorgeTsagk in #1352
• [wallet 2/3]: refactor funding logic to use allocation code by @guggero in #1407
• Add pre-commitment output to mint anchor TX by @ffranr in #1325
• Support group keys for RFQ negotiation flows by @GeorgeTsagk in #1382
• Add itest oracle harness by @GeorgeTsagk in #1395
• Update lnd compile-time dependency to v0.19 by @guggero in #1422
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1449
• tapcli: Global flags to accept ENV vars overrides. by @gcaracuel in #1447
• multi: update to tagged lnd v0.19.0-beta.rc1 by @guggero in #1454
• tapchannel: validate proof courier before opening or accepting channels by @guggero in #1412
• [custom channels]: refactor channel JSON, add more custom data parsers by @guggero in #1441
• Support group keys on SendPayment & AddInvoice by @GeorgeTsagk in #1423
• tapd+tapdb: return anchor block height in ListTransfers if available by @bhandras in #1461
• build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 in /tools in the go_modules group across 1 directory by @dependabot in #1469
• [wallet 3/3]: group key support for channel funding by @guggero in https://github.co...

v0.5.1-alpha

Database Migrations

tapd v0.5.1 contains non-revertible database migrations. After running tapd v0.5.1, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.5.1. Please report any database migration issues.

Breaking changes between 0.4.x and 0.5.x

Downstream Projects - litd

litd v0.14.x-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality. See upgrade instructions below if you opened Asset channels with such an experimental version.

tapd v0.5.x changes

Oracle RPC:
The RPC protobuf definitions for the Price Oracle have changed. Asset exchange rates are now expressed as FixedPoint to achieve better precision.
The rationale for the change and the new math behind it are described in the new RFQ document.
Code examples for a Price Oracle server are available here.

Configuration changes:
The configuration value (universe.public-access) and command line flag (--universe.public-access) now needs a value and is no longer a boolean. The value now controls whether the node's universe database can be accessed over RPC and either read (value r) or written to (value w) or both (value rw).
So existing nodes with the configuration file value universe.public-access=true need to change the value to universe.public-access=rw. Users specifying the command line flag --universe.public-access just need to append a value, for example --universe.public-access=rw.

⚠️ CRITICAL INSTRUCTIONS ⚠️:

Required-upgrade path for existing litd installations:

To avoid loss of channel funds: Any litd node which ran Taproot Asset channels using any litd v0.13.9xx-experimental versions MUST FOLLOW all of the following procedures:
litd v0.14.0-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality.
If one channel peer is running litd version <= v0.13.9xx-experimental channel operations are are NOT forwards compatible with litd v0.14.x-alpha versions.

• All Taproot-Asset Lightning channels created using litd version <=, v0.13.9xx-experimental must be cooperatively closed before upgrading to v0.14.x-alpha.
  • Channel Closure instructions
  • Monitor status of lncli pendingchannels: Ensure pending_htlcs response is empty before progressing
    Example: lncli listchannels | jq '.channels[] | select(.pending_htlcs != [])'
• Avoid force closing the channels. If there are pending/in-flight HTLCs, wait for HTLCs to be resolved.
• Once all channels are fully closed (e.g. lncli pendingchannels is empty), both nodes must be upgraded to the new v0.14.0-alpha version before new channels can be opened. Please coordinate the upgrade with your peer if you're not operating both nodes.
• Daemon installations which exclusively contain Taproot Assets on-chain outputs that are not contained within lightning channels, are not required to follow this upgrade path. Anything mentioned above only relates to assets in channels. Normal on-chain assets are not affected.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.5.1.sig and manifest-v0.5.1.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.5.1.sig manifest-v0.5.1.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.5.1.sig.ots and manifest-v0.5.1.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.5.1.sig.ots -f manifest-roasbeef-v0.5.1.sig
ots verify manifest-v0.5.1.txt.ots -f manifest-v0.5.1.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.22.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.5.1
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.5.1 /verify-install.sh v0.5.1
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.5.1.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.5.1.tar.gz
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1" ./cmd/tapd
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• Improve logging by @ffranr in #1269
• refactor: using slices.Contains to simplify the code by @zhoufanjin in #1283
• GitHub: update tapd's CI litd branch to testing target by @dstadulis in #1291
• tapdb: thread through enabled flag correctly by @guggero in #1296
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1292
• universe: improve logging for single asset sync attempt by @guggero in #1294
• tapcfg: read multiverse cache from cfg instead of using default by @Roasbeef in #1297
• chore: fix some function names in comment by @crystalstall in #1273
• Part 1: Asset Minting with V1 Asset Group Key and Chantools Cold Storage Support by @ffranr in https://github...

v0.5.1-alpha RC3

Database Migrations

tapd v0.5.1 contains non-revertible database migrations. After running tapd v0.5.1, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.5.1. Please report any database migration issues.

Breaking changes between 0.4.x and 0.5.x

Downstream Projects - litd

litd v0.14.x-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality. See upgrade instructions below if you opened Asset channels with such an experimental version.

tapd v0.5.x changes

Oracle RPC:
The RPC protobuf definitions for the Price Oracle have changed. Asset exchange rates are now expressed as FixedPoint to achieve better precision.
The rationale for the change and the new math behind it are described in the new RFQ document.
Code examples for a Price Oracle server are available here.

Configuration changes:
The configuration value (universe.public-access) and command line flag (--universe.public-access) now needs a value and is no longer a boolean. The value now controls whether the node's universe database can be accessed over RPC and either read (value r) or written to (value w) or both (value rw).
So existing nodes with the configuration file value universe.public-access=true need to change the value to universe.public-access=rw. Users specifying the command line flag --universe.public-access just need to append a value, for example --universe.public-access=rw.

⚠️ CRITICAL INSTRUCTIONS ⚠️:

Required-upgrade path for existing litd installations:

To avoid loss of channel funds: Any litd node which ran Taproot Asset channels using any litd v0.13.9xx-experimental versions MUST FOLLOW all of the following procedures:
litd v0.14.0-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality.
If one channel peer is running litd version <= v0.13.9xx-experimental channel operations are are NOT forwards compatible with litd v0.14.x-alpha versions.

• All Taproot-Asset Lightning channels created using litd version <=, v0.13.9xx-experimental must be cooperatively closed before upgrading to v0.14.x-alpha.
  • Channel Closure instructions
  • Monitor status of lncli pendingchannels: Ensure pending_htlcs response is empty before progressing
    Example: lncli listchannels | jq '.channels[] | select(.pending_htlcs != [])'
• Avoid force closing the channels. If there are pending/in-flight HTLCs, wait for HTLCs to be resolved.
• Once all channels are fully closed (e.g. lncli pendingchannels is empty), both nodes must be upgraded to the new v0.14.0-alpha version before new channels can be opened. Please coordinate the upgrade with your peer if you're not operating both nodes.
• Daemon installations which exclusively contain Taproot Assets on-chain outputs that are not contained within lightning channels, are not required to follow this upgrade path. Anything mentioned above only relates to assets in channels. Normal on-chain assets are not affected.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.5.1-rc3.sig and manifest-v0.5.1-rc3.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.5.1-rc3.sig manifest-v0.5.1-rc3.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.5.1-rc3.sig.ots and manifest-v0.5.1-rc3.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.5.1-rc3.sig.ots -f manifest-roasbeef-v0.5.1-rc3.sig
ots verify manifest-v0.5.1-rc3.txt.ots -f manifest-v0.5.1-rc3.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.22.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.5.1-rc3
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.5.1-rc3 /verify-install.sh v0.5.1-rc3
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.5.1-rc3.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.5.1-rc3.tar.gz
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1-rc3" ./cmd/tapd
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1-rc3" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• Improve logging by @ffranr in #1269
• refactor: using slices.Contains to simplify the code by @zhoufanjin in #1283
• GitHub: update tapd's CI litd branch to testing target by @dstadulis in #1291
• tapdb: thread through enabled flag correctly by @guggero in #1296
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1292
• universe: improve logging for single asset sync attempt by @guggero in #1294
• tapcfg: read multiverse cache from cfg instead of using default by @Roasbeef in #1297
• chore: fix some function names in comment by @crystalstall in #1273
• Part 1: Asset Minting with V1 Asset Group...

v0.5.1-alpha RC2

Database Migrations

tapd v0.5.1 contains non-revertible database migrations. After running tapd v0.5.1, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.5.1. Please report any database migration issues.

Breaking changes between 0.4.x and 0.5.x

Downstream Projects - litd

litd v0.14.x-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality. See upgrade instructions below if you opened Asset channels with such an experimental version.

tapd v0.5.x changes

Oracle RPC:
The RPC protobuf definitions for the Price Oracle have changed. Asset exchange rates are now expressed as FixedPoint to achieve better precision.
The rationale for the change and the new math behind it are described in the new RFQ document.
Code examples for a Price Oracle server are available here.

Configuration changes:
The configuration value (universe.public-access) and command line flag (--universe.public-access) now needs a value and is no longer a boolean. The value now controls whether the node's universe database can be accessed over RPC and either read (value r) or written to (value w) or both (value rw).
So existing nodes with the configuration file value universe.public-access=true need to change the value to universe.public-access=rw. Users specifying the command line flag --universe.public-access just need to append a value, for example --universe.public-access=rw.

⚠️ CRITICAL INSTRUCTIONS ⚠️:

Required-upgrade path for existing litd installations:

To avoid loss of channel funds: Any litd node which ran Taproot Asset channels using any litd v0.13.9xx-experimental versions MUST FOLLOW all of the following procedures:
litd v0.14.0-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality.
If one channel peer is running litd version <= v0.13.9xx-experimental channel operations are are NOT forwards compatible with litd v0.14.x-alpha versions.

• All Taproot-Asset Lightning channels created using litd version <=, v0.13.9xx-experimental must be cooperatively closed before upgrading to v0.14.x-alpha.
  • Channel Closure instructions
  • Monitor status of lncli pendingchannels: Ensure pending_htlcs response is empty before progressing
    Example: lncli listchannels | jq '.channels[] | select(.pending_htlcs != [])'
• Avoid force closing the channels. If there are pending/in-flight HTLCs, wait for HTLCs to be resolved.
• Once all channels are fully closed (e.g. lncli pendingchannels is empty), both nodes must be upgraded to the new v0.14.0-alpha version before new channels can be opened. Please coordinate the upgrade with your peer if you're not operating both nodes.
• Daemon installations which exclusively contain Taproot Assets on-chain outputs that are not contained within lightning channels, are not required to follow this upgrade path. Anything mentioned above only relates to assets in channels. Normal on-chain assets are not affected.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightninglabs/taproot-assets/main/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.5.1-rc2.sig and manifest-v0.5.1-rc2.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.5.1-rc2.sig manifest-v0.5.1-rc2.txt

You should see the following if the verification was successful:

gpg: Signature made Wed Sep 30 17:35:20 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Timestamp

In addition to time-stamping the git tag with OpenTimestamps, we also timestamp the manifest file along with its signature. Two files are included in our release artifacts: manifest-roasbeef-v0.5.1-rc2.sig.ots and manifest-v0.5.1-rc2.txt.ots.

Assuming you have the opentimestamps client installed locally, the timestamps can be verified with the following commands:

ots verify manifest-roasbeef-v0.5.1-rc2.sig.ots -f manifest-roasbeef-v0.5.1-rc2.sig
ots verify manifest-v0.5.1-rc2.txt.ots -f manifest-v0.5.1-rc2.txt

Alternatively, the OpenTimestamps website can be used to verify these timestamps if one doesn't have a bitcoind instance accessible locally.

Assuming you are using the OpenTimestamps ots-git-gpg-wrapper you can verify the timestamp of the git tag by verifying the tag as explained in Verifying the Release Binaries.

These timestamps should give users confidence in the integrity of this release even after the key that signed the release expires.

Verifying the Release Binaries

Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved.
The release binaries are compiled with go1.22.6, which is required by verifiers to arrive at the same ones.

The make release command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then make release sys=<OS-ARCH> tag=<tag> can be used.

Finally, you can also verify the tag itself with the following command:

$ git verify-tag v0.5.1-rc2
gpg: Signature made Tue Sep 15 18:55:00 2020 PDT
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <[email protected]>" [ultimate]

Verifying the Docker Images

To verify the tapd and tapcli binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):

$ docker run --rm --entrypoint="" lightninglabs/taproot-assets:v0.5.1-rc2 /verify-install.sh v0.5.1-rc2
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/taproot-assets [command-line options]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming
that vendor.tar.gz and tapd-source-v0.5.1-rc2.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf tapd-source-v0.5.1-rc2.tar.gz
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1-rc2" ./cmd/tapd
GO111MODULE=on go install -v -mod=vendor -ldflags "-X github.com/lightninglabs/taproot-assets/build.Commit=v0.5.1-rc2" ./cmd/tapcli

The -mod=vendor flag tells the go build command that it doesn't need to fetch the dependencies, and instead, they're all enclosed in the local vendor directory.

Additionally, it's now possible to use the enclosed release.sh script to bundle a release for a specific system like so:

make release sys="linux-arm64 darwin-amd64"

⚡️⚡️⚡️ OK, now to the rest of the release notes! ⚡️⚡️⚡️

Release Notes (auto generated)

What's Changed

• Improve logging by @ffranr in #1269
• refactor: using slices.Contains to simplify the code by @zhoufanjin in #1283
• GitHub: update tapd's CI litd branch to testing target by @dstadulis in #1291
• tapdb: thread through enabled flag correctly by @guggero in #1296
• build(deps): bump the go_modules group across 2 directories with 1 update by @dependabot in #1292
• universe: improve logging for single asset sync attempt by @guggero in #1294
• tapcfg: read multiverse cache from cfg instead of using default by @Roasbeef in #1297
• chore: fix some function names in comment by @crystalstall in #1273
• Part 1: Asset Minting with V1 Asset Gro...