Taproot Assets v0.8.7

In this release, we rebuild tapd and tapcli with Go 1.27.3 to address
CVE-2026-111943. Go's
crypto/x509 verifier now rejects certificate chains containing a specific
set of intermediate certificates due to security concerns around their
operation. We recommend that all users upgrade.

Updating the Go installation on a host does not patch an existing binary.
Install the new release binaries, or rebuild from the v0.8.7 tag with
Go 1.27.3.

Changes

• Raise the minimum Go version and release toolchain to Go 1.27.3, including
  the Docker build images and generated RPC bindings.
• Backport the applicable lint, formatting, and test maintenance updates to
  the v0.8 release branch.

See the release-specific notes
and full changes since v0.8.6.

The release tag points to commit
5be24d78f5bb7fe6628f1564817db3257cb4272a.

Database migrations and upgrade notes

There are no new database migrations relative to v0.8.6. Back up your
databases before upgrading.

If you use Taproot Assets channels, follow the
operational safety guidelines
and arrange a controlled update of affected nodes. Users upgrading from a
version older than v0.8.6 must also review the
v0.8.6 upgrade instructions,
including the guidance for nodes with a configured RFQ oracle. Restarting a
node does not clear pending HTLCs.

Verifying the release

Download the archive for your platform, manifest-v0.8.7.txt, and
manifest-roasbeef-v0.8.7.sig. The detached PGP signature authenticates the
manifest, which contains the SHA-256 hashes of the release archives and
binaries.

Download the release signing key
and check that its primary fingerprint is
A5B61896952D9FDA83BC054CDC42612E89237182 before importing it:

gpg --show-keys --with-fingerprint roasbeef.asc
gpg --import roasbeef.asc
gpg --verify manifest-roasbeef-v0.8.7.sig manifest-v0.8.7.txt
shasum -a 256 <downloaded-archive>

Compare the archive hash with its entry in manifest-v0.8.7.txt.

The manifest and signature also have OpenTimestamps proofs:

ots verify manifest-v0.8.7.txt.ots
ots verify manifest-roasbeef-v0.8.7.sig.ots

Bitcoin confirmation is required to verify the timestamp attestation. If a
proof reports pending confirmation, retry after the confirmations arrive.

Reproducing the release

The release binaries are built with Go 1.27.3. From the v0.8.7 source tag,
run:

make docker-release tag=v0.8.7

To build a single platform, add sys=<OS-ARCH>. The release also includes
taproot-assets-source-v0.8.7.tar.gz and vendor.tar.gz for a contained
rebuild. See the reproducible build guide
for the build and verification steps. Compare the resulting hashes with
the entries in manifest-v0.8.7.txt.

Contributors (alphabetical order)

• George Tsagkarelis
• Jared Tobin
• Olaoluwa Osuntokun