9 releases 10 tags

RSS feed

• v0.5.0 1962e4cd6a

  Compare

  Reed v0.5.0 Stable

  admin_ekaii released this 2026-10-21 22:49:47 +00:00 | 9 commits to main since this release

  No known key found for this signature in database

  Reed 0.5.0. The apps join the relay network that 0.5.0-rc1 brought to the relays: each app ships the three directory authorities' keys and a recent signed list of relays checked against them, so a fresh install knows where to go before it has reached any relay. reed-public, the original relay, stays the home of every account, so contacts still on 0.4 keep reaching you. Messages stay end-to-end encrypted: no relay and no authority can read them. Also in this release: a voice note goes only to the conversation you recorded it in (web and desktop), the desktop app does what the web app does (Start without a passphrase, voice notes and photos, the Requests screen), and a security update of rustls-webpki to 0.103.16 and webpki-roots to 1.0.10 (RUSTSEC-2026-0382, RUSTSEC-2026-0381). CHANGELOG.md in the tag has the full list. The hosted web app at app.reed.ekaii.fr runs this release.

  Included

  • reed-v0.5.0-universal.apk: the signed universal Android APK (reed-v0.5.0-universal-unsigned.apk is the unsigned build it was signed from)
  • reed-v0.5.0-linux-x86_64.AppImage and reed-v0.5.0-linux-x86_64.deb
  • reed-relay and reed-cli static musl binaries for x86_64 and aarch64 Linux, with their cargo audit reports (audit-*.txt, no advisory found)
  • SBOMs in CycloneDX format (*.cdx.json)
  • reed-v0.5.0-vendored.tar.zst (vendored sources) and reed-v0.5.0-web-dist.tar.zst (web client build)
  • webcat-manifest.json and webcat-bundle.json (the WEBCAT manifest, logged to Sigsum, and its bundle)
  • the bootstrap pair reed-v0.5.0-bootstrap-authorities.json and reed-v0.5.0-bootstrap-consensus.bin (the signed consensus of 2026-10-21 15:00 UTC, 3 of 3 signatures, listing reed-public), with reed-v0.5.0-bootstrap-vectors.json
  • release.json, signing-cert-sha256.txt, reproduce-desktop-x86_64-unknown-linux-gnu.txt, SHA256SUMS and SHA256SUMS.sigstore.json

  Not in this release

  • No macOS DMG.
  • No aarch64 Linux packages (no aarch64 AppImage or .deb). The relay and CLI binaries are available for aarch64.

  Verify

  1. Check the signature on SHA256SUMS with the cosign public key from the tag (tools/release/keys/reed-release-cosign.pub):

     cosign verify-blob --key reed-release-cosign.pub --bundle SHA256SUMS.sigstore.json SHA256SUMS
     

  2. Check the downloaded files against it:

     sha256sum -c SHA256SUMS
     

     SHA256SUMS lists the SBOMs as sbom/<name>: put the downloaded .cdx.json files in an sbom/ folder first, or add --ignore-missing to check only what you downloaded.

  3. Android: the APK signer certificate SHA-256 must be 52c1d0ef5f1ca2ab8baa3c21fbf14240b9088d2a3e734b05b79e86b5f5ed5d2c (apksigner verify --print-certs reed-v0.5.0-universal.apk), the same as every earlier release, so it installs over the previous version and keeps your data. It is also in signing-cert-sha256.txt.

  4. The tag is signed: git -c gpg.ssh.allowedSignersFile=tools/release/keys/allowed_signers verify-tag v0.5.0.

  Upgrading from the 0.5.0-rc1 Linux .deb

  dpkg reads the hyphen in 0.5.0-rc1 as a Debian revision, so it sorts above 0.5.0 and apt treats this release as a downgrade. Use sudo apt install --allow-downgrades ./reed-v0.5.0-linux-x86_64.deb or sudo dpkg -i ./reed-v0.5.0-linux-x86_64.deb.

  Relay image: forgejo.ekaii.fr/exo/reed-relay@sha256:ad21da3b88e494985e5660bda61c22a033b620a31a074579698fbc9fee76b18d, cosign-signed with the release key (verify: cosign verify --key reed-release-cosign.pub forgejo.ekaii.fr/exo/reed-relay@sha256:ad21da3b88e494985e5660bda61c22a033b620a31a074579698fbc9fee76b18d). It runs on the three directory authorities and on reed-public since 2026-10-22.

  Reproducibility: the Mac did not reproduce this release. The build host built every artefact twice, from two copies at two paths, and the two builds were identical (the APK, the web dist and the core files: 28 of 28; the x86_64 AppImage and .deb by content). As the independent check, F-Droid's own build environment (the fdroidserver buildserver-trixie image running fdroiddata's CI steps) rebuilt the APK from the tag on 2026-10-22 at 01:59 UTC, and the result equals the published reed-v0.5.0-universal.apk apart from the signature (apksigcopier compare). That rebuild ran on the same build host, but with a different toolchain and environment. The F-Droid recipe in the tag lists one scandelete path that the v0.5.0 tree no longer needs (fdroidserver refuses it); the rebuild used the recipe with that one line removed, as main now has it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • SHA256SUMS
    5 downloads · 2026-10-22 00:29:16 +00:00 · 2.2 KiB
  • SHA256SUMS.sigstore.json
    1 download · 2026-10-22 00:29:16 +00:00 · 3.8 KiB
  • audit-reed-cli-v0.5.0-aarch64-linux-musl.txt
    0 downloads · 2026-10-22 00:31:06 +00:00 · 301 B
  • audit-reed-cli-v0.5.0-x86_64-linux-musl.txt
    0 downloads · 2026-10-22 00:31:07 +00:00 · 300 B
  • audit-reed-relay-v0.5.0-aarch64-linux-musl.txt
    0 downloads · 2026-10-22 00:31:07 +00:00 · 303 B
  • audit-reed-relay-v0.5.0-x86_64-linux-musl.txt
    0 downloads · 2026-10-22 00:31:07 +00:00 · 302 B
  • reed-cli-v0.5.0-aarch64-linux-musl
    0 downloads · 2026-10-22 00:29:45 +00:00 · 32 MiB
  • reed-cli-v0.5.0-x86_64-linux-musl
    2 downloads · 2026-10-22 00:30:19 +00:00 · 36 MiB
  • reed-cli_x86_64-unknown-linux-musl.cdx.json
    0 downloads · 2026-10-22 00:31:04 +00:00 · 737 KiB
  • reed-ffi_aarch64-apple-ios.cdx.json
    0 downloads · 2026-10-22 00:31:04 +00:00 · 755 KiB
  • reed-ffi_aarch64-linux-android.cdx.json
    0 downloads · 2026-10-22 00:31:05 +00:00 · 754 KiB
  • reed-ffi_armv7-linux-androideabi.cdx.json
    0 downloads · 2026-10-22 00:31:05 +00:00 · 750 KiB
  • reed-relay-v0.5.0-aarch64-linux-musl
    0 downloads · 2026-10-22 00:30:21 +00:00 · 14 MiB
  • reed-relay-v0.5.0-x86_64-linux-musl
    1 download · 2026-10-22 00:30:24 +00:00 · 15 MiB
  • reed-relay_aarch64-unknown-linux-musl.cdx.json
    0 downloads · 2026-10-22 00:31:05 +00:00 · 335 KiB
  • reed-relay_x86_64-unknown-linux-musl.cdx.json
    0 downloads · 2026-10-22 00:31:06 +00:00 · 336 KiB
  • reed-v0.5.0-bootstrap-authorities.json
    0 downloads · 2026-10-22 00:30:24 +00:00 · 737 B
  • reed-v0.5.0-bootstrap-consensus.bin
    0 downloads · 2026-10-22 00:30:24 +00:00 · 1.4 KiB
  • reed-v0.5.0-bootstrap-vectors.json
    0 downloads · 2026-10-22 00:30:24 +00:00 · 7.6 KiB
  • reed-v0.5.0-linux-x86_64.AppImage
    0 downloads · 2026-10-22 00:29:13 +00:00 · 110 MiB
  • reed-v0.5.0-linux-x86_64.deb
    0 downloads · 2026-10-22 00:29:16 +00:00 · 15 MiB
  • reed-v0.5.0-universal-unsigned.apk
    0 downloads · 2026-10-22 00:30:40 +00:00 · 64 MiB
  • reed-v0.5.0-universal.apk
    7 downloads · 2026-10-22 00:28:53 +00:00 · 64 MiB
  • reed-v0.5.0-vendored.tar.zst
    0 downloads · 2026-10-22 00:31:03 +00:00 · 97 MiB
  • reed-v0.5.0-web-dist.tar.zst
    0 downloads · 2026-10-22 00:31:03 +00:00 · 1.7 MiB
  • reed-wasm_wasm32-unknown-unknown.cdx.json
    0 downloads · 2026-10-22 00:31:06 +00:00 · 171 KiB
  • release.json
    1 download · 2026-10-22 02:05:08 +00:00 · 2.8 KiB
  • reproduce-desktop-x86_64-unknown-linux-gnu.txt
    0 downloads · 2026-10-22 00:31:06 +00:00 · 1.8 KiB
  • signing-cert-sha256.txt
    0 downloads · 2026-10-22 00:29:16 +00:00 · 65 B
  • webcat-bundle.json
    0 downloads · 2026-10-22 00:29:17 +00:00 · 8.5 KiB
  • webcat-manifest.json
    0 downloads · 2026-10-22 00:29:17 +00:00 · 7.9 KiB