Tags give the ability to mark specific points in history as being important
-
v0.19.3
protectedRelease: Release v0.19.38162063c · ·agape-node 0.19.3 The first release from the public repository at gitlab.com/friendowment/agapao. Nothing changes how blocks apply, and nodes can upgrade whenever suits them. - Signed as friendowment/agapao: Sigstore names https://gitlab.com/friendowment/agapao//.gitlab-ci.yml@refs/tags/v0.19.3 as the identity. install.sh and wallets from 0.19.2 on accept it. Releases up to 0.19.2 stay at gitlab.com/friendowment/agape-history/-/releases and are signed as friendowment/agape (README, "Verifying a download by hand"). - The first signed checkpoint file in the new project's package registry, which the weekly job builds on from now on. - wasmtime 48.0.6 and rustls 0.23.46, for advisories published this week. The eleven wasmtime ones (RUSTSEC-2026-0353 to 0364) are in the component model, async calls, exceptions and GC types, all of which the contract runtime switches off (agape-vm/src/engine.rs); the four rustls ones (RUSTSEC-2026-0346 to 0349) are in the TLS client that the CLI and the wallet core use to reach a node's API. zbus 5's zvariant, zvariant_derive and zbus_names are now unmaintained, with no known vulnerability; only the desktop wallet on Linux has them, and deny.toml records why. - Checkpoint files: the Sigstore verifier accepts a Rekor checkpoint note only with exactly one signature line, Rekor's. The fuzzer found that a note with a broken line and a blank line ahead of Rekor's genuine signature verified. The signed text couldn't be changed, so nothing could be forged, but the verifier now refuses anything but the note Rekor wrote. - A devnet checkpoint at height 362,068. - The README, whitepaper, website and the API document's link to API.md point at the public repository. docs/releasing.md notes that tags up to v0.19.2 aren't in the public history, so those releases can't be rebuilt from it. The wallet is 0.19.3 (Play versionCode 19003).