exo/reed
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 9 Packages Wiki Activity Actions 1
9 releases 10 tags
  • v0.5.0-rc1 a6e4d78cea

    Reed v0.5.0-rc1
    Some checks failed
    release / desktop-linux (linux/arm64, aarch64-unknown-linux-gnu) (push) Has been cancelled
    Details
    release / desktop-macos (push) Has been cancelled
    Details
    reproducible / double-build (push) Has been cancelled
    Details
    reproducible / desktop-linux (push) Has been cancelled
    Details
    release / toolchain-image (push) Has been cancelled
    Details
    release / desktop-linux (linux/amd64, x86_64-unknown-linux-gnu) (push) Has been cancelled
    Details
    release / build (push) Has been cancelled
    Details
    Pre-release

    admin_ekaii released this 2026-10-18 01:53:29 +00:00 | 98 commits to main since this release

    Release candidate of Reed 0.5.0 (pre-release). Relays now form a network instead of a single server: three directory authorities vote every hour on which relays are up and publish one signed consensus, which a device accepts only when a majority of the authorities it ships with signed it. Relays join with an admission token, your queues can live on several relays, and version 0.4 apps keep reaching the original relay as before. As CHANGELOG.md says, this is a release candidate of the relay only: the apps move to 0.5.0 with the authorities' bootstrap snapshot once the authorities are live, and the bootstrap snapshot attached here lists no relays yet. The APK, AppImage and .deb in this pre-release are built from the same tag for testing, while the hosted web app is not updated by this pre-release and stays on 0.4.1. CHANGELOG.md in the tag has the full list, including the security fixes from the federation review.

    Included

    • reed-v0.5.0-rc1-universal.apk: the signed universal Android APK (reed-v0.5.0-rc1-universal-unsigned.apk is the unsigned build it was signed from)
    • reed-v0.5.0-rc1-linux-x86_64.AppImage and reed-v0.5.0-rc1-linux-x86_64.deb
    • reed-relay and reed-cli static musl binaries for x86_64 and aarch64 Linux
    • SBOMs in CycloneDX format (*.cdx.json)
    • reed-v0.5.0-rc1-vendored.tar.zst (vendored sources) and reed-v0.5.0-rc1-web-dist.tar.zst (web client build)
    • webcat-manifest.json and webcat-bundle.json (the WEBCAT manifest, logged to Sigsum, and its bundle)
    • the bootstrap pair reed-v0.5.0-rc1-bootstrap-authorities.json and reed-v0.5.0-rc1-bootstrap-consensus.bin, with reed-v0.5.0-rc1-bootstrap-vectors.json
    • release.json, signing-cert-sha256.txt, SHA256SUMS and SHA256SUMS.sigstore.json

    Not in this pre-release

    • No macOS DMG.
    • No aarch64 Linux packages (no aarch64 AppImage or .deb). The relay and CLI binaries are available for aarch64.

    Verify

    1. Check the signature on SHA256SUMS with the cosign public key from the tag (tools/release/keys/reed-release-cosign.pub):

      cosign verify-blob --key reed-release-cosign.pub --bundle SHA256SUMS.sigstore.json SHA256SUMS

    2. Check the downloaded files against it:

      sha256sum -c SHA256SUMS

      SHA256SUMS lists the SBOMs as sbom/<name>: put the downloaded .cdx.json files in an sbom/ folder first, or add --ignore-missing to check only what you downloaded.

    3. Android: the APK signer certificate SHA-256 must be 52c1d0ef5f1ca2ab8baa3c21fbf14240b9088d2a3e734b05b79e86b5f5ed5d2c (apksigner verify --print-certs reed-v0.5.0-rc1-universal.apk). It is also in signing-cert-sha256.txt.

    Linux .deb and the final 0.5.0

    The package version is 0.5.0-rc1. dpkg reads the hyphen as a Debian revision, so 0.5.0-rc1 sorts above 0.5.0 and apt treats the final 0.5.0 as a downgrade (it asks, and refuses under -y). To install the final over this candidate, use sudo apt install --allow-downgrades ./reed-v0.5.0-linux-<arch>.deb or sudo dpkg -i ./reed-v0.5.0-linux-<arch>.deb. Users who only install final releases are not affected.

    Relay image: forgejo.ekaii.fr/exo/reed-relay@sha256:7c788350e30d35973ff9222585678ca8d9d0134336527a96ed6be654a12633c7, cosign-signed with the release key (verify: cosign verify --key reed-release-cosign.pub forgejo.ekaii.fr/exo/reed-relay@sha256:7c788350e30d35973ff9222585678ca8d9d0134336527a96ed6be654a12633c7).

    Reproducibility: the Mac did not reproduce this candidate. The build host built every artefact twice, from two copies at two paths, and the two builds were identical (the APK, the web dist and the core files: 28 of 28; the x86_64 AppImage and .deb by content). As the independent check, F-Droid's own build environment (the fdroidserver buildserver-trixie image running fdroiddata's CI steps) rebuilt the APK from the tag on 2026-10-18 at 12:15 UTC, and the result equals the published reed-v0.5.0-rc1-universal.apk apart from the signature (apksigcopier compare, and fdroid's own comparison against this release's APK). That rebuild ran on the same build host, but with a different toolchain and environment.

    Downloads