Electrum 4.1.3 released

[NeuroticFish]

New Electrum was released. Bug fixes and reproducible builds for Android seem to be the only news.
https://mobile.twitter.com/ElectrumWallet/status/1405235789311660033

It may worth also mentioning that SomberNight has started using a new GPG key:
https://mobile.twitter.com/ElectrumWallet/status/1405171848447414277

[ABCbits]

According to release notes on their GitHub, it's more than reproducible build on Android.

# Release 4.1.3 - (June 16, 2021)
 * Builds/binaries:
   - Android: the binaries (APKs) should now be reproducible (#7263)
   - AppImage: fix some startup issues by including libxcb deps (#7198)
 * Lightning:
   - smarter LN pathfinding (if trampoline is disabled):
     - estimate liquidity in channels using previous attempts (#7152)
     - consider inflight HTLCs and try to route around them (#7292)
   - bugfix: add more safety checks to avoid "batch RBF" feature
     merging LN funding txs (#7298)
   - remove HTLC value upper limit of ~42 mBTC (#7328)
   - Kivy GUI: implement freezing LN channels (11bb39ee)
 * imported wallets: when enabling the "Use change addresses" option,
   change will now be sent to a random unused imported address. (#7330)
   As before, by default, change is sent back to the "from address".
 * seed generation: make sure newly created electrum seeds don't have
   correct bip39 checksum by chance (#6001)
 * other minor fixes

One thing i find interesting is making sure Electrum seed can't be valid BIP39 seed.

[dkbit98]

They already released new Electrum version 4.1.4  with few fixes just one day later:

# Release 4.1.4 - (June 17, 2021)
 * Kivy/Android: fix a regression where a non-LN wallet
   could not open the settings (c49d6995)
 * CLI/RPC: fix "close_wallet" command (#7348)

[The Sceptical Chymist]

They already released new Electrum version 4.1.4  with few fixes just one day later:

Yep, just noticed that myself.  I had to verify that I wasn't seeing things by checking which version I had just downloaded and installed vs. the one the notification said was the new update.  I don't think I've ever seen Electrum crank out two updates like that in such a short period of time. 

Do we need threads about these updates?  It's easy enough to set up your Electrum wallet to notify you when they come out, and I don't think there's an issue with the reliability of those notifications.  Threads like this don't bother me, but I'm questioning whether they add any value to the forum or provide useful information to any Electrum users.

[pooya87]

I don't think I've ever seen Electrum crank out two updates like that in such a short period of time. 

Revisions (ie. vx.x.1 -> x.x.2) sometimes come out quite fast since they usually involve some small bug fix or an improvement. for example 4.0.9 was also released a day after 4.0.8 (we had 4 new versions in December, almost once a week).

Do we need threads about these updates?

I second this. We only need topics about new versions if we are going to discuss their changes not just to inform about the existence of it.

[hugeblack]

I'm still sticky with 4.0.9 version so I don't think I need to upgrade unless there is a real change or a problem that requires the update.
The bad thing is that searching by versions (google Electrum 4.1.3) often leads to scam sites that appear first, other than using Electrum.

New Electrum was released. Bug fixes and reproducible builds for Android seem to be the only news.

Android version really needs a lot of work.

[NeuroticFish]

Android version really needs a lot of work.

Indeed. I still hope that someday it'll work with hardware wallet too.
And reproducible builds is a nice step forward too, especially as at some point Electrum was criticized that this is missing.

[DireWolfM14]

New Electrum was released. Bug fixes and reproducible builds for Android seem to be the only news.
https://mobile.twitter.com/ElectrumWallet/status/1405235789311660033

It may worth also mentioning that SomberNight has started using a new GPG key:
https://mobile.twitter.com/ElectrumWallet/status/1405171848447414277

Thanks for the heads-up, but I'm not feeling the warm fuzees getting my PGP updates from Twitter.  Here's a link to SomberNight's GPG key page on GitHub:

https://github.com/SomberNight.gpg

[DireWolfM14]

~
From now on, new Electrum releases will be signed with this new key:
~

Thanks for the link.  Are the releases also signed by ThomasV as has been the case in the past?  Sorry, I'm traveling for business, and don't have the opportunity or time to check.

[khaled0111]

Sorry, removed my previous reply by mistake. Re-posting it for reference:

Thanks for the heads-up, but I'm not feeling the warm fuzees getting my PGP updates from Twitter.  Here's a link to SomberNight's GPG key page on GitHub:

https://github.com/SomberNight.gpg

https://github.com/SomberNight.gpg is SomberNight's old PGP key.
From now on, new Electrum releases will be signed with this new key:
https://github.com/spesmilo/electrum/blob/master/pubkeys/sombernight_releasekey.asc

Thanks for the link.  Are the releases also signed by ThomasV as has been the case in the past?  Sorry, I'm traveling for business, and don't have the opportunity or time to check.

Didn't verify it myself but according to electrum.org, the latest release 4.1.4 was signed by both ThomasV and SomberNight.

[pooya87]

Recently the Electrum team started providing 2 sets of signatures from 2 of their developers, I suppose to make things safer and more decentralized. Now you can verify each binary against the same old ThomasV pubkey but also can verify the same binary against SomberNight pubkey both found on github.

[Pmalek]

The bad thing is that searching by versions (google Electrum 4.1.3) often leads to scam sites that appear first, other than using Electrum.

I don't get such results on my end, it seems all right. I am not sure if the app on MajorGeeks is legit or not, and I don't care to find out. 

Recently the Electrum team started providing 2 sets of signatures from 2 of their developers, I suppose to make things safer and more decentralized. Now you can verify each binary against the same old ThomasV pubkey but also can verify the same binary against SomberNight pubkey both found on github.

According to the download site, only the MacOS version is not signed by SomberNight, everything else is signed by both him and ThomasV.

[Lucius]

I don't get such results on my end, it seems all right. I am not sure if the app on MajorGeeks is legit or not, and I don't care to find out. 

I remember that site back when I had dial up internet, and I know I downloaded a lot of software without any problems. What I can confirm is that the size of the Windows file is identical to the one on the official Electrum site, but there is really no point in looking for an alternative when there is an original website publicly available to everyone.

[Pmalek]

Me either, but the website contains shady ads which is good enough to make me avoid that website (unless there's no other reliable source i could found).

Major Geeks is a popular download site for pirated software. I remember it from the days of Rapidshare and warez software in the 2000s. I have never had any issues with apps downloaded from there when I was younger, but I also see no reason in using it for free software like Electrum and things related to your personal finances.

[DireWolfM14]

Recently the Electrum team started providing 2 sets of signatures from 2 of their developers, I suppose to make things safer and more decentralized.

I suspect you're correct.  That would make things more decentralized, and it's a good plan going forward to keep things transparent.  If (god forbid) anything happened to ThomasV and suddenly the team had to use someone else's key to sign releases it would raise a lot of questions.  Especially if that someone (like Ghost43/SomberNight) was an anonymous figure.

Anyway, I browed to the Electrum download page today and noticed the following, for some reason the MacOS releases are still signed only by ThomasV:



I also noticed that two sets of signatures are available now.  I don't believe that was the case when I downloaded version 4.1.2.

[pooya87]

To be fair the more important characteristic of Electrum releases is the reproducibility of them (that is when anyone builds from the same source code they all should get the same binary with the same hash that can be verified with the original release). Although such feature doesn't seem to be popular and I still don't think that many people who build from source perform the check afterwards considering the replies I got when I started this topic.