path: root/78/01e058936180c7bfed159cf40b3e1521d828ec

Return-Path: <laanwj@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id 35FD63C8
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 12 Oct 2015 16:59:41 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-wi0-f171.google.com (mail-wi0-f171.google.com
	[209.85.212.171])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id F131920A
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 12 Oct 2015 16:59:39 +0000 (UTC)
Received: by wieq12 with SMTP id q12so29512276wie.1
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon, 12 Oct 2015 09:59:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
	h=date:from:to:subject:message-id:mime-version:content-type
	:content-disposition:content-transfer-encoding;
	bh=3GRTqFvTf2HnwPrWwmbaes0pkoiQ3HCPYD6JeSfPXcc=;
	b=i+W/+M5NguKhgnfAZZEzx2V2ObczUq54tu5QYmJRDWl81ExRZWD2QyjNSRlap/lWNt
	8y6N9TrjvSbla2p3M1q8EjCZRrqC+/3bHhZkIpViFswv8g+1OFrdhiQXIeERfdLSx5Zk
	8XPBQwVdrGeGSnyMLYVz8e6h4gplFRoOymEqSpElgwyZRl0tJZo1MoCIqAdrXi3iObdO
	lNb7YaNwtsiJzGDFMdus82ATzXjiC+mJokSQ+eFeHlnWUVlt+cDZHidin3ntI11oAMVb
	CGBd2NAkkBGEOzrdESz/9QOGH6SrjLEUjfxKkwnb4huHjYIcGsV4ZcvwRlbmQ1G84Hea
	dmVg==
X-Received: by 10.194.113.101 with SMTP id ix5mr31692647wjb.107.1444669178753; 
	Mon, 12 Oct 2015 09:59:38 -0700 (PDT)
Received: from amethyst.visucore.com (dhcp-089-098-228-253.chello.nl.
	[89.98.228.253]) by smtp.gmail.com with ESMTPSA id
	pk7sm20930218wjb.2.2015.10.12.09.59.37
	for <bitcoin-dev@lists.linuxfoundation.org>
	(version=TLS1_2 cipher=AES128-SHA256 bits=128/128);
	Mon, 12 Oct 2015 09:59:37 -0700 (PDT)
Date: Mon, 12 Oct 2015 18:59:37 +0200
From: "Wladimir J. van der Laan" <laanwj@gmail.com>
To: Bitcoin development mailing list <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <20151012165936.GA25231@amethyst.visucore.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM,
	RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
Subject: [bitcoin-dev] Bitcoin Core 0.11.1 release candidate 2 available
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Oct 2015 16:59:41 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Bitcoin Core version 0.11.1 release candidate 2 is now available from:

  <https://bitcoin.org/bin/bitcoin-core-0.11.1/test>

This is a release candidate for a new minor version release, bringing security
fixes.
(release candidate 1 was never released as binaries)

Please report bugs using the issue tracker at github:

  <https://github.com/bitcoin/bitcoin/issues>

Preliminary release notes for 0.11.1 follow:

Upgrading and downgrading
=========================

How to Upgrade
- --------------

If you are running an older version, shut it down. Wait until it has completely
shut down (which might take a few minutes for older versions), then run the
installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or
bitcoind/bitcoin-qt (on Linux).

Downgrade warning
- ------------------

Because release 0.10.0 and later makes use of headers-first synchronization and
parallel block download (see further), the block files and databases are not
backwards-compatible with pre-0.10 versions of Bitcoin Core or other software:

* Blocks will be stored on disk out of order (in the order they are
received, really), which makes it incompatible with some tools or
other programs. Reindexing using earlier versions will also not work
anymore as a result of this.

* The block index database will now hold headers for which no block is
stored on disk, which earlier versions won't support.

If you want to be able to downgrade smoothly, make a backup of your entire data
directory. Without this your node will need start syncing (or importing from
bootstrap.dat) anew afterwards. It is possible that the data from a completely
synchronised 0.10 node may be usable in older versions as-is, but this is not
supported and may break as soon as the older version attempts to reindex.

This does not affect wallet forward or backward compatibility. There are no
known problems when downgrading from 0.11.x to 0.10.x.

Notable changes
===============

Fix buffer overflow in bundled upnp
- ------------------------------------

Bundled miniupnpc was updated to 1.9.20151008. This fixes a buffer overflow in
the XML parser during initial network discovery.

Details can be found here: http://talosintel.com/reports/TALOS-2015-0035/

This applies to the distributed executables only, not when building from source or
using distribution provided packages.

Additionally, upnp has been disabled by default. This may result in a lower
number of reachable nodes on IPv4, however this prevents future libupnpc
vulnerabilities from being a structural risk to the network
(see https://github.com/bitcoin/bitcoin/pull/6795).

Test for LowS signatures before relaying
- -----------------------------------------

Make the node require the canonical 'low-s' encoding for ECDSA signatures when
relaying or mining.  This removes a nuisance malleability vector.

Consensus behavior is unchanged.

If widely deployed this change would eliminate the last remaining known vector
for nuisance malleability on SIGHASH_ALL P2PKH transactions. On the down-side
it will block most transactions made by sufficiently out of date software.

Unlike the other avenues to change txids on transactions this
one was randomly violated by all deployed bitcoin software prior to
its discovery. So, while other malleability vectors where made
non-standard as soon as they were discovered, this one has remained
permitted. Even BIP62 did not propose applying this rule to
old version transactions, but conforming implementations have become
much more common since BIP62 was initially written.

Bitcoin Core has produced compatible signatures since a28fb70e in
September 2013, but this didn't make it into a release until 0.9
in March 2014; Bitcoinj has done so for a similar span of time.
Bitcoinjs and electrum have been more recently updated.

This does not replace the need for BIP62 or similar, as miners can
still cooperate to break transactions.  Nor does it replace the
need for wallet software to handle malleability sanely[1]. This
only eliminates the cheap and irritating DOS attack.

[1] On the Malleability of Bitcoin Transactions
Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, Łukasz Mazurek
http://fc15.ifca.ai/preproceedings/bitcoin/paper_9.pdf

Minimum relay fee default increase
- -----------------------------------

The default for the `-minrelaytxfee` setting has been increased from `0.00001`
to `0.00005`.

This is necessitated by the current transaction flooding, causing
outrageous memory usage on nodes due to the mempool ballooning. This is a
temporary measure, bridging the time until a dynamic method for determining
this fee is merged (which will be in 0.12).

(see https://github.com/bitcoin/bitcoin/pull/6793, as well as the 0.11
release notes, in which this value was suggested)

0.11.1 Change log
=================

Detailed release notes follow. This overview includes changes that affect
behavior, not code moves, refactors and string updates. For convenience in locating
the code changes and accompanying discussion, both the pull request and
git merge commit are mentioned.

- - #6438 `2531438` openssl: avoid config file load/race
- - #6439 `980f820` Updated URL location of netinstall for Debian
- - #6384 `8e5a969` qt: Force TLS1.0+ for SSL connections
- - #6471 `92401c2` Depends: bump to qt 5.5
- - #6224 `93b606a` Be even stricter in processing unrequested blocks
- - #6571 `100ac4e` libbitcoinconsensus: avoid a crash in multi-threaded environments
- - #6545 `649f5d9` Do not store more than 200 timedata samples.
- - #6694 `834e299` [QT] fix thin space word wrap line break issue
- - #6703 `1cd7952` Backport bugfixes to 0.11
- - #6750 `5ed8d0b` Recent rejects backport to v0.11
- - #6769 `71cc9d9` Test LowS in standardness, removes nuisance malleability vector.
- - #6789 `b4ad73f` Update miniupnpc to 1.9.20151008
- - #6785 `b4dc33e` Backport to v0.11: In (strCommand == "tx"), return if AlreadyHave()
- - #6412 `0095b9a` Test whether created sockets are select()able
- - #6795 `4dbcec0` net: Disable upnp by default
- - #6793 `e7bcc4a` Bump minrelaytxfee default

Credits
=======

Thanks to everyone who directly contributed to this release:

- - Adam Weiss
- - Alex Morcos
- - Casey Rodarmor
- - Cory Fields
- - fanquake
- - Gregory Maxwell
- - Jonas Schnelli
- - J Ross Nicoll
- - Pavel Janík
- - Pavel Vasin
- - Peter Todd
- - Pieter Wuille
- - randy-waterhouse
- - Ross Nicoll
- - Suhas Daftuar
- - tailsjoin
- - ฿tcDrak
- - Tom Harding
- - Veres Lajos
- - Wladimir J. van der Laan

And those who contributed additional code review and/or security research:

- - timothy on IRC for reporting the issue
- - Vulnerability in miniupnp discovered by Aleksandar Nikolic of Cisco Talos

As well as everyone that helped translating on [Transifex](https://www.transifex.com/projects/p/bitcoin/).

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCgAGBQJWG+bQAAoJEHSBCwEjRsmmvKsH+wQ9mTICJoRL0nlZA/zBRis4
7ys15YFJMd5+8OQvCBw9Rr/FP3FHapHwouTbInl7gd1bED9AYXKFOe/H+nD/w3vO
tyvXbj/H4S6CNFYSlUSvLY28dTnoaSZF7GrIR/TtdQwcYsfXN/TJrZK03EMegMJX
8p9ggTfnUgUnqqYjq1gGSQdJk0aydKe4h8/rcepPkagoertOGUWlEHhZkMbkLt/q
vkZNjwjhf3SmvfwgXRJ37TjTdQB9sHYpZNPkKyI6XZ5J12it8DR8GSsPjPIkknOO
51iTw0Besm0benekFHk3IAgdfCbLokfQnTPFWxQNTzE09T5zV97LLGq1t6TC//k=
=1+qD
-----END PGP SIGNATURE-----