Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/catrya.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider, manifest.txt.sig.catrya and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg --verify manifest.txt.sig.catrya manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 9A718444050F091D3D24CF6CE15E232F243D73E6
gpg: Good signature from "Catrya (github) <140891948+Catrya@users.noreply.github.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.18.0
🚀 Features
- feat(price): Phase 4 — unify live quote path on cache + enforce staleness by @grunch in #783
- feat(transport): make inner protocol version follow active transport by @grunch in #785
- feat(price): Phase 3 — El Toque fiat-cross provider (CUP/MLC) by @grunch in #778
- feat(transport): log active transport at mostrod startup by @grunch in #781
- feat(transport): Phase 2 — anti-spam gates for protocol v2 by @grunch in #780
- feat(bond): notify slashed party on dispute slash (#768) by @Catrya in #779
- feat(transport): Phase 1 — wire protocol v2 (NIP-44 direct) into mostrod by @grunch in #776
🐛 Bug Fixes
- fix(ci): build windows-gnu release binary natively, not with cross by @grunch in #801
- fix: surface InvalidOrderId to clients as CantDo(NotFound) by @AndreaDiazCorreia in #752
- fix(nip33): rename info tag protocol_versions -> protocol_version by @grunch in #782
💼 Other
- Update CHANGELOG for version 0.18.0 by @grunch
📚 Documentation
- docs: harden cashu spec after review (fee crash-safety, reuse guard, action ownership) by @grunch in #794
- docs(cashu): phased implementation spec series for Cashu escrow by @grunch in #788
🧪 Testing
⚙️ Miscellaneous Tasks
- Release mostro version 0.18.0 by @grunch
- chore: standardize v0.19.0 deprecation notices for the v1 transport by @grunch in #800
- chore: upgrade sqlx to 0.9 and drop sqlx-crud by @arkanoider in #791
- chore: drop sqlx-crud; use mostro_core::db::Crud by @arkanoider in #789
- ci(mutation): run as scheduled audit + opt-in instead of on every push to main by @grunch in #787
Contributors
- @grunch made their contribution in #801
- @arkanoider made their contribution in #791
- @AndreaDiazCorreia made their contribution in #752
- @Catrya made their contribution in #779
Full Changelog: v0.17.5...v0.18.0