Pool/relay stability fixes, compact block relay, and signed auto-update + release automation

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/release.yml

@@ -0,0 +1,254 @@
+name: Release
+
+# Fires when VERSION changes on main. workflow_dispatch is also enabled so
+# the pipeline can be test-run without bumping the version.
+on:
+  push:
+    branches: [main]
+    paths:
+      - VERSION
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+      should_release: ${{ steps.v.outputs.should_release }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - id: v
+        run: |
+          VERSION=$(cat VERSION | tr -d '[:space:]')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "Tag v$VERSION already exists, skipping release."
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  preflight:
+    needs: check-version
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate release config before spending build minutes
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+          UPDATE_PUBKEY: ${{ vars.UPDATE_PUBKEY }}
+        run: |
+          fail=0
+
+          if [ -z "$UPDATE_PUBKEY" ]; then
+            echo "::error::UPDATE_PUBKEY repo variable is not set (Settings > Secrets and variables > Actions > Variables). Run tools/generate_update_key.sh."
+            fail=1
+          elif ! echo -n "$UPDATE_PUBKEY" | grep -qE '^[0-9a-fA-F]{64}$'; then
+            echo "::error::UPDATE_PUBKEY is set but isn't 64 hex characters — got: '${UPDATE_PUBKEY}'. Re-check tools/generate_update_key.sh output."
+            fail=1
+          fi
+
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            echo "::error::UPDATE_SIGNING_KEY secret is not set (Settings > Secrets and variables > Actions > Secrets)."
+            fail=1
+          else
+            python3 - "$UPDATE_SIGNING_KEY" > /tmp/preflight_key.pem <<'PYEOF'
+          import sys, re, textwrap
+          body = re.sub(r'-----(BEGIN|END) PRIVATE KEY-----', '', sys.argv[1])
+          body = re.sub(r'\s+', '', body)
+          print("-----BEGIN PRIVATE KEY-----")
+          print("\n".join(textwrap.wrap(body, 64)))
+          print("-----END PRIVATE KEY-----")
+          PYEOF
+            if ! openssl pkey -in /tmp/preflight_key.pem -noout 2>/tmp/preflight_err.txt; then
+              cat /tmp/preflight_err.txt
+              echo "::error::UPDATE_SIGNING_KEY doesn't parse as a valid private key, even after PEM normalization."
+              fail=1
+            elif [ -n "$UPDATE_PUBKEY" ]; then
+              # Cross-check the secret and the variable are actually the same
+              # keypair -- catches "rotated one half, forgot the other" early.
+              DERIVED=$(openssl pkey -in /tmp/preflight_key.pem -pubout -outform DER 2>/dev/null | tail -c 32 | od -An -tx1 | tr -d ' \n')
+              if [ "$DERIVED" != "$(echo -n "$UPDATE_PUBKEY" | tr 'A-F' 'a-f')" ]; then
+                echo "::error::UPDATE_SIGNING_KEY and UPDATE_PUBKEY don't match (public key derived from the secret is $DERIVED). They must come from the same tools/generate_update_key.sh run."
+                fail=1
+              fi
+            fi
+            rm -f /tmp/preflight_key.pem
+          fi
+
+          exit $fail
+
+  build-linux:
+    needs: [check-version, preflight]
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install AppImage icon dependency
+        run: pip install --break-system-packages pillow
+      - name: Build AppImage
+        run: |
+          if [ -z "${{ vars.UPDATE_PUBKEY }}" ]; then
+            echo "::error::UPDATE_PUBKEY repo variable is not set. Run tools/generate_update_key.sh and add its hex output as a repo variable (Settings > Secrets and variables > Actions > Variables)."
+            exit 1
+          fi
+          make linux REPO=${{ github.repository }} UPDATE_PUBKEY=${{ vars.UPDATE_PUBKEY }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-build
+          path: "*-*-x86_64.AppImage"
+
+  build-windows:
+    needs: [check-version, preflight]
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: msys2/setup-msys2@v2
+        with:
+          msystem: UCRT64
+          update: true
+          install: >-
+            base-devel
+            git
+            zip
+      - name: Build (MSYS2 UCRT64)
+        run: |
+          if [ -z "${{ vars.UPDATE_PUBKEY }}" ]; then
+            echo "::error::UPDATE_PUBKEY repo variable is not set."
+            exit 1
+          fi
+          make windows REPO=${{ github.repository }} UPDATE_PUBKEY=${{ vars.UPDATE_PUBKEY }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-build
+          path: "*-*-windows.zip"
+
+  release:
+    needs: [check-version, build-linux, build-windows]
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Build short changelog
+        id: notes
+        run: |
+          PREV_TAG=$(git tag --sort=-creatordate | head -n1 || true)
+          if [ -n "$PREV_TAG" ]; then
+            RANGE="$PREV_TAG..HEAD"
+          else
+            RANGE="HEAD"
+          fi
+          {
+            echo "notes<<EOF"
+            echo "Top changes in this release:"
+            git log $RANGE --no-merges --pretty=format:'%H %s' | \
+              while read -r hash subject; do
+                n=$(git show --numstat --pretty=format: "$hash" | awk '{s+=$1+$2} END{print s+0}')
+                echo "$n|- $subject"
+              done | sort -t'|' -k1,1 -rn | head -n 8 | cut -d'|' -f2
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Sign release assets
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+        run: |
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            echo "::error::UPDATE_SIGNING_KEY secret is not set — cannot sign release assets. Auto-update will refuse to install this release."
+            exit 1
+          fi
+          # Tolerate the secret being pasted as a single flattened line (no
+          # newline between -----BEGIN/body/-----END): strip all whitespace
+          # and the markers, then rebuild proper 64-char-wrapped PEM.
+          python3 - "$UPDATE_SIGNING_KEY" > /tmp/update_signing_key.pem <<'PYEOF'
+          import sys, re, textwrap
+          raw = sys.argv[1]
+          body = re.sub(r'-----(BEGIN|END) PRIVATE KEY-----', '', raw)
+          body = re.sub(r'\s+', '', body)
+          print("-----BEGIN PRIVATE KEY-----")
+          print("\n".join(textwrap.wrap(body, 64)))
+          print("-----END PRIVATE KEY-----")
+          PYEOF
+          if ! openssl pkey -in /tmp/update_signing_key.pem -noout 2>/tmp/keyerr.txt; then
+            cat /tmp/keyerr.txt
+            echo "::error::UPDATE_SIGNING_KEY secret is not a valid private key even after PEM normalization."
+            rm -f /tmp/update_signing_key.pem
+            exit 1
+          fi
+          for f in artifacts/*-*-x86_64.AppImage artifacts/*-*-windows.zip; do
+            [ -f "$f" ] || continue
+            openssl pkeyutl -sign -rawin -inkey /tmp/update_signing_key.pem -in "$f" -out "$f.sig"
+          done
+          rm -f /tmp/update_signing_key.pem
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ needs.check-version.outputs.version }}
+          name: ${{ github.event.repository.name }} v${{ needs.check-version.outputs.version }}
+          body: ${{ steps.notes.outputs.notes }}
+          files: |
+            artifacts/*-*-x86_64.AppImage
+            artifacts/*-*-windows.zip
+            artifacts/*.sig
+
+  revert-version-on-failure:
+    # Only for an actual VERSION-bump push, and only if the bump was real
+    # (should_release) but something downstream failed before a release
+    # actually got published. workflow_dispatch runs are excluded -- those
+    # can be triggered on any commit for testing, not necessarily one that
+    # bumped VERSION, so there's nothing to revert.
+    needs: [check-version, preflight, build-linux, build-windows, release]
+    if: >
+      always() &&
+      github.event_name == 'push' &&
+      needs.check-version.outputs.should_release == 'true' &&
+      (needs.preflight.result == 'failure' ||
+       needs.build-linux.result == 'failure' ||
+       needs.build-windows.result == 'failure' ||
+       needs.release.result == 'failure')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Restore VERSION to its value before this failed bump
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Only proceed if the failed commit is still the tip of main --
+          # if something else has been pushed since (e.g. a fix, pushed
+          # right after seeing the failure), don't touch VERSION at all;
+          # require a manual look instead of guessing what's now correct.
+          if [ "$(git rev-parse HEAD)" != "${{ github.sha }}" ]; then
+            echo "::warning::main has moved since this run started -- leaving VERSION as-is. Check manually before reusing v${{ needs.check-version.outputs.version }}."
+            exit 0
+          fi
+
+          OLD_VERSION=$(git show "${{ github.sha }}~1:VERSION")
+          echo -n "$OLD_VERSION" > VERSION
+          git add VERSION
+          git commit -m "release: restore VERSION to $OLD_VERSION -- v${{ needs.check-version.outputs.version }} release failed"
+          git push origin main
+          echo "VERSION restored to $OLD_VERSION -- release of v${{ needs.check-version.outputs.version }} failed, that number is free to reuse once whatever broke is fixed."

.gitignore

@@ -14,6 +14,24 @@ wallet.dat
 nostr.key
 btf_enc.key
 
+# Key material and secrets the node creates in its data directory. *.dat
+# above already covers wallet.dat; these aren't .dat files and are every
+# bit as sensitive: btf_enc.key/nostr.key are this node's .btf identity,
+# walletrpc.token is bearer authority to spend from the wallet.
+*.key
+walletrpc.token
+
+# Wallet/key backups
+bitflash-keys-*
+
+# Mempool dump, if a node is configured to write one
+mempool.txt
+
+# Patches and scratch files kept alongside a working tree
+*.patch
+*.rej
+*.orig
+
 # Third-party build trees (rebuilt by the build scripts)
 RandomX/
 deps/
@@ -22,9 +40,11 @@ secp256k1-build/
 
 # Distributable binaries (published as GitHub Releases, not committed)
 dist/
+*.tgz
 *.tar.gz
 *.zip
 
 # Editor/OS cruft
 .DS_Store
 Thumbs.db
+src/bitflash