dash-docs/_releases/v0.10.3.md
David A. Harding 7d98f798ab
Upgrade to Jekyll 3.0
Gemfile:

  - Upgrade to Jekyll 3.x (3.0.1 tested).  This brings several new
    features I want to use, most notably *collections* which allows us
    to add blog-like collections. I've converted the `_releases` and
    `_alerts` pages into collections, although their plugins are
    maintained to handle the Download and Active Alert features.

  - Upgrade to latest Kramdown.

  - Lock Less at 2.4.0.  This prevents breaking our Less plugin.  Jekyll
    3.x provides native support for SCSS, so we may want to switch to
    that in time.

  - Lock HTML Proofer at 2.1.0.  The most recent version was taking
    forever to check our pages (I never actually got it to complete).
    I'll look into it when I get more time.

Makefile:

  - New `make clean` command.  Jekyll 3.x by default attempts to do
    incremental rebuilds.  The new `jekyll clean` command cleans up the
    metadata necessary for than so that a full build is performed, and
    this new `make clean` command is a wrapper around it so that we
    automatically do full rebuilds in the relevant cases.  Note: our
    plugins aren't fully compatible with the incremental rebuilds, but
    I'd like to fix that in the future.

  - Remove WEBrick hack to enable previewing with default URL paths (/
    instead of /index.html).

  - Filter out compliants from Rouge

README.md:

  - Now that Alerts (_alerts) are part of a collection, the file names
    are no longer parsed for dates, so instructions on adding the date
    to the YAML metadata have been added.

_alerts/*:

  - Now that alerts are part of a collection, the file names are no
    longer parsed to provide dates, so a `date:` field has been added to
    the YAML metadata.

_config.yml:

  - Some variables renamed per upgrade instructions.

  - Switched from old default syntax highlighter Pygments to new default
    Rouge.  I tried to use Rouge options to keep new output as similar
    to old output as possible to making diffing easy, but Rouge adds
    extra CSS class info.

  - Move `_alerts` and `_releases` into Jekyll 3.x "collections", which
    provide the organizational features we were using plugins to
    manange.  I haven't removed the old plugins because we still use
    some of their features (alerts.rb provides active issue and banner
    features; releases.rb provides info to Download page)

  - _layouts/* can no longer provide default global metadata; that is now
    provided in the new `defaults:` section in _config.yml.

_layouts/*:

  - Default metadata can no longer be provided in the layout files for
    collections, so I've removed it and left a message to see
    _config.yml.

_plugins/*:

  - Remove filter_for.rb. It's completely broken on Jekyll 3.x because
    of changes to Liquid which prevent adding new arguments to the
    inherited Liquid::For class. Existing uses of filter_for have been
    migrated to built-in for loops prefaced by sorts.

  - Remove remove-html-extension.rb: at it said in the comments, this
    was a temporary hack to get us to Jekyll 3.0.

_releases/*:

  - Rename all the files: prefix a v to the file name so the output html
    (e.g. v10.0.0.html) is the same as the source filename (e.g.
    v10.0.0.md).  This is necessary to migrate them to a Jekyll collection.

  - Remove %v from titles: we have to explicitly set the title, like we
    used to.  Again required for migration to collections.

_templates/events.html & en/rss/events.rss:

  - Sort events by date and then loop with regular for loop rather than
    filter_for

en/alerts.html & en/rss/alerts.rss:

  - Sort alerts by date and then loop with regular for loop rather than
    filter_for

en/bitcoin-core/index.md & en/version-history.html & en/rss/releases.rss:

  - Sort alerts by date and then loop with regular for loop rather than
    filter_for
2016-01-06 23:09:56 -05:00

195 lines
7.6 KiB
Markdown

---
# This file is licensed under the MIT License (MIT) available on
# http://opensource.org/licenses/MIT.
## Required value below populates the %v variable (note: % needs to be escaped in YAML if it starts a value)
required_version: 0.10.3
## Required title.
title: Bitcoin Core version 0.10.3 released
## Optional release date. May be filled in hours/days after a release
optional_date: 2015-10-14
## Optional magnet link. To get it, open the torrent in a good BitTorrent client
## and View Details, or install the transmission-cli Debian/Ubuntu package
## and run: transmission-show -m <torrent file>
#
## Link should be enclosed in quotes and start with: "magnet:?
optional_magnetlink:
## The --- below ends the YAML header. After that, paste the release notes.
## Warning: this site's Markdown parser commonly requires you make two
## changes to the release notes from the Bitcoin Core source tree:
##
## 1. Make sure both ordered and unordered lists are preceded by an empty
## (whitespace only) line, like the empty line before this list item.
##
## 2. Place URLs inside angle brackets, like <http://bitcoin.org/bin>
---
{% githubify https://github.com/bitcoin/bitcoin %}
Bitcoin Core version 0.10.3 is now available from:
<https://bitcoin.org/bin/bitcoin-core-0.10.3/>
This is a new minor version release, bringing security fixes and translation
updates. It is recommended to upgrade to this version as soon as possible.
Please report bugs using the issue tracker at github:
<https://github.com/bitcoin/bitcoin/issues>
Upgrading and downgrading
=========================
How to Upgrade
--------------
If you are running an older version, shut it down. Wait until it has completely
shut down (which might take a few minutes for older versions), then run the
installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or
bitcoind/bitcoin-qt (on Linux).
Downgrade warning
------------------
Because release 0.10.0 and later makes use of headers-first synchronization and
parallel block download (see further), the block files and databases are not
backwards-compatible with pre-0.10 versions of Bitcoin Core or other software:
* Blocks will be stored on disk out of order (in the order they are
received, really), which makes it incompatible with some tools or
other programs. Reindexing using earlier versions will also not work
anymore as a result of this.
* The block index database will now hold headers for which no block is
stored on disk, which earlier versions won't support.
If you want to be able to downgrade smoothly, make a backup of your entire data
directory. Without this your node will need start syncing (or importing from
bootstrap.dat) anew afterwards. It is possible that the data from a completely
synchronised 0.10 node may be usable in older versions as-is, but this is not
supported and may break as soon as the older version attempts to reindex.
This does not affect wallet forward or backward compatibility.
Notable changes
===============
Fix buffer overflow in bundled upnp
------------------------------------
Bundled miniupnpc was updated to 1.9.20151008. This fixes a buffer overflow in
the XML parser during initial network discovery.
Details can be found here: <http://talosintel.com/reports/TALOS-2015-0035/>
This applies to the distributed executables only, not when building from source or
using distribution provided packages.
Additionally, upnp has been disabled by default. This may result in a lower
number of reachable nodes on IPv4, however this prevents future libupnpc
vulnerabilities from being a structural risk to the network
(see <https://github.com/bitcoin/bitcoin/pull/6795>).
Test for LowS signatures before relaying
-----------------------------------------
Make the node require the canonical 'low-s' encoding for ECDSA signatures when
relaying or mining. This removes a nuisance malleability vector.
Consensus behavior is unchanged.
If widely deployed this change would eliminate the last remaining known vector
for nuisance malleability on SIGHASH_ALL P2PKH transactions. On the down-side
it will block most transactions made by sufficiently out of date software.
Unlike the other avenues to change txids on transactions this
one was randomly violated by all deployed bitcoin software prior to
its discovery. So, while other malleability vectors where made
non-standard as soon as they were discovered, this one has remained
permitted. Even BIP62 did not propose applying this rule to
old version transactions, but conforming implementations have become
much more common since BIP62 was initially written.
Bitcoin Core has produced compatible signatures since a28fb70e in
September 2013, but this didn't make it into a release until 0.9
in March 2014; Bitcoinj has done so for a similar span of time.
Bitcoinjs and electrum have been more recently updated.
This does not replace the need for BIP62 or similar, as miners can
still cooperate to break transactions. Nor does it replace the
need for wallet software to handle malleability sanely[1]. This
only eliminates the cheap and irritating DOS attack.
[1] On the Malleability of Bitcoin Transactions
Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, Łukasz Mazurek
<http://fc15.ifca.ai/preproceedings/bitcoin/paper_9.pdf>
Minimum relay fee default increase
-----------------------------------
The default for the `-minrelaytxfee` setting has been increased from `0.00001`
to `0.00005`.
This is necessitated by the current transaction flooding, causing
outrageous memory usage on nodes due to the mempool ballooning. This is a
temporary measure, bridging the time until a dynamic method for determining
this fee is merged (which will be in 0.12).
(see <https://github.com/bitcoin/bitcoin/pull/6793>, as well as the 0.11.0
release notes, in which this value was suggested)
0.10.3 Change log
=================
Detailed release notes follow. This overview includes changes that affect external
behavior, not code moves, refactors or string updates.
- #6186 `e4a7d51` Fix two problems in CSubnet parsing
- #6153 `ebd7d8d` Parameter interaction: disable upnp if -proxy set
- #6203 `ecc96f5` Remove P2SH coinbase flag, no longer interesting
- #6226 `181771b` json: fail read_string if string contains trailing garbage
- #6244 `09334e0` configure: Detect (and reject) LibreSSL
- #6276 `0fd8464` Fix getbalance * 0
- #6274 `be64204` Add option `-alerts` to opt out of alert system
- #6319 `3f55638` doc: update mailing list address
- #6438 `7e66e9c` openssl: avoid config file load/race
- #6439 `255eced` Updated URL location of netinstall for Debian
- #6412 `0739e6e` Test whether created sockets are select()able
- #6694 `f696ea1` [QT] fix thin space word wrap line brake issue
- #6704 `743cc9e` Backport bugfixes to 0.10
- #6769 `1cea6b0` Test LowS in standardness, removes nuisance malleability vector.
- #6789 `093d7b5` Update miniupnpc to 1.9.20151008
- #6795 `f2778e0` net: Disable upnp by default
- #6797 `91ef4d9` Do not store more than 200 timedata samples
- #6793 `842c48d` Bump minrelaytxfee default
Credits
=======
Thanks to everyone who directly contributed to this release:
- Adam Weiss
- Alex Morcos
- Casey Rodarmor
- Cory Fields
- fanquake
- Gregory Maxwell
- Jonas Schnelli
- J Ross Nicoll
- Luke Dashjr
- Pavel Vasin
- Pieter Wuille
- randy-waterhouse
- ฿tcDrak
- Tom Harding
- Veres Lajos
- Wladimir J. van der Laan
And all those who contributed additional code review and/or security research:
- timothy on IRC for reporting the issue
- Vulnerability in miniupnp discovered by Aleksandar Nikolic of Cisco Talos
As well as everyone that helped translating on [Transifex](https://www.transifex.com/projects/p/bitcoin/).
{% endgithubify %}