Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 0 additions & 39 deletions RELEASING.md
Original file line number Diff line number Diff line change
Expand Up @@ -91,45 +91,6 @@ prior release's recorded squash commit; tag ancestry is deliberately irrelevant.
Every push to `main` continues to publish the rolling relay `:main` and
`:sha-<7>` tags, plus matching `:debug-main` and `:debug-sha-<7>` variants.

#### NIP-FI upload proof freshness (relay floor)

Desktop, CLI, and mobile clients mint Blossom upload authorization proofs with
a **60-second expiry** (`expiration = now + 60`). **Older** relays (≤ `v0.2.1`)
re-run the full auth verifier — including the expiry check — after receiving the
full upload body, so a 60-second proof that was valid when admitted can expire
during a large or slow transfer, causing a spurious rejection.

The repair (commit `75e9bef748d2149ce459b14da842e706a51a5f78`, landed in this
PR) replaces the post-body full-verifier call with a hash-only check
(`verify_upload_hash_only`): the relay verifies the freshness and all other
proof fields before reading the body; the only check after transfer is that the
body's SHA-256 matches what was declared in the signed proof.

Clients cannot lengthen proofs beyond 60 seconds (NIP-FI §Strict limits the
max proof window to 60 s). This is a relay-side concern:

- **The relay release that includes this PR's changes** (the first relay
tag > `v0.2.1`, containing commit `75e9bef748d2149ce459b14da842e706a51a5f78`)
performs a hash-only post-body check, eliminating the expiry window during
transfer. **Update this line with the concrete relay tag once it is cut.**
- **Older self-hosted relays** (≤ `v0.2.1`) re-verify the full proof expiry
after transfer and may reject large uploads over slow connections.
Upgrading the relay is the fix; no client workaround exists within Strict
constraints.

**Prerequisite before distributing desktop, CLI, or mobile builds that mint
60-second upload proofs:** verify that all supported relay environments have
been upgraded to a relay release containing commit
`75e9bef748d2149ce459b14da842e706a51a5f78`. An unknown or unverified deployment
does not satisfy this prerequisite. Deployments running ≤ `v0.2.1` must be
upgraded before receiving these clients.

When releasing a new **relay** version that carries the post-body hash-only
check, record the concrete tag here so release operators can verify the
prerequisite. When releasing **desktop, CLI, or mobile** for environments where
self-hosted relays may be running pre-floor versions, document the floor in
release notes and require operators to upgrade before distributing these clients.

### Mobile

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the relay floor until migration is confirmed

The commit's own pre-merge checklist says relay-owner confirmation is still pending, so deleting the prerequisite now removes the only release warning before its condition is known to be satisfied. If any supported deployment still runs relay v0.2.1 or earlier, distributing a current desktop, CLI, or mobile client can make large or slow uploads fail after the 60-second proof expires; retain the gate until the owner confirms the fleet migration, then record the confirmed relay floor before removing it.

AGENTS.md reference: AGENTS.md:L35-L38

Useful? React with 👍 / 👎.


1. **Publish a candidate.** From a clean checkout whose `origin` is the
Expand Down
Loading