cfd0d8249b
Upstream RNS 1.2.4 (2026-05-07) announces it is "probably the last release that is also published to GitHub" — pip continues until rnpkg is complete and RNS is self-hosting. All 13 verifiers pass against 1.2.4 / 0.9.7; no wire-format, signing, or protocol behavior changed between 1.2.0 and 1.2.4, so the changes here are purely currency: - Pin tools/requirements.txt to rns==1.2.4 / lxmf==0.9.7 so the verifier stays reproducible if upstream stops mirroring to PyPI before the migration is ready. - Add an "Upstream distribution shift" watch-list to todo.md (local Reticulum node, repo destination hash, rnpkg install/upgrade commands, rsg signature verification, mirroring source citations). - Bump SPEC.md frontmatter and re-anchor ~50 line citations across Identity.py, Transport.py, Resource.py, Link.py, Reticulum.py, Packet.py, and LXMF/* (Identity.py drift was the heaviest at +13 to +31 lines; Transport.py was variable). Fix one numeric (MAX_RANDOM_BLOBS = 32 → 64) and one semantic (§6.6.3 LRPROOF MTU clamp citation pointed at the wrong location — corrected to point at the transit-relay clamp at Transport.py:1539-1556). - Update §10.4 decompression-bomb hazard to note upstream's 1.1.9 cap adoption, with citations to Resource.py:686-691 and Buffer.py:95-97 plus a "do not use one-shot bz2.decompress()" warning. - Re-anchor 11 flows/ files (version pins + ~30 line citations). - Bump version labels in tools/README.md, test-vectors/README.md, and 4 verifier docstrings + 2 hardcoded print strings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
15 lines
659 B
Text
15 lines
659 B
Text
# Pinned versions the verifier scripts have been run against.
|
|
#
|
|
# Update only after the corresponding verifier scripts have been
|
|
# re-run cleanly against the new upstream version. The README
|
|
# "Spec corrections" section exists to cover the case where the
|
|
# spec ships text that turns out to be wrong against a new pin.
|
|
#
|
|
# Why pin: upstream is migrating distribution off GitHub onto
|
|
# Reticulum-native channels (rngit / rnpkg). PyPI continues
|
|
# "at least until rnpkg is complete" per the RNS 1.2.4 release
|
|
# notes (2026-05-07). A pin keeps the verifier reproducible if
|
|
# upstream stops mirroring to PyPI before our migration is ready.
|
|
|
|
rns==1.2.4
|
|
lxmf==0.9.7
|