Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/catrya.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/andreadiazcorreia.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider, manifest.txt.sig.catrya, manifest.txt.sig.andreadiazcorreia and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg --verify manifest.txt.sig.catrya manifest.txt
gpg --verify manifest.txt.sig.andreadiazcorreia manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 9A718444050F091D3D24CF6CE15E232F243D73E6
gpg: Good signature from "Catrya (github) <140891948+Catrya@users.noreply.github.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using EDDSA key 57376B6467F41F565ADDC65B1ED8B40E3A46E21D
gpg: Good signature from "Andrea Diaz Correia <andrea.diaz.correia@gmail.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
Reputation import (preview, do not enable)
This release adds the [reputation_import] settings section (trust list of
reputation issuers). It is disabled by default. Do not set enabled = true
yet: the import-reputation action is handled starting with the next
release, and a node with import enabled on 0.19.3 advertises the capability
(reputation_import_issuers in its info event) without answering import
requests.
Note that the section is validated at startup even while disabled: a
malformed [reputation_import] block (empty or duplicate issuer names,
unparsable or repeated keys, a zero or too-long lifetime) stops the daemon.
What's Changed in v0.19.3
🚀 Features
- feat(reputation): add the import trust list by @grunch in #1028
- feat: answer user-info with own reputation by @arkanoider in #1052
- feat: handle declare-payer by @grunch in #1023
- feat: add payer history config and storage by @grunch in #1022
- feat: let the maker choose the Cashu mint by @grunch in #1047
- feat: publish the info event in Cashu mode by @grunch in #1045
🐛 Bug Fixes
💼 Other
- Update CHANGELOG for version 0.19.3 by @grunch
⚙️ Miscellaneous Tasks
- Release mostro version 0.19.3 by @grunch
- ci: map user_info.rs in the ortsom gate by @arkanoider in #1056
- ci: map the payer release tests in the gate map by @grunch in #1051
- ci: build Docker images natively and cache deps by @grunch in #1042
Contributors
- @grunch made their contribution
- @arkanoider made their contribution in #1052
Full Changelog: v0.19.2...v0.19.3