Stoffel Release 0.1.2

Stoffel 0.1.2 is a focused reliability and release-path update.

This release exact-pins project and workspace dependencies, expands generated-project validation, and adds keyless Sigstore signing to release artifacts.

What changed

Generated Rust projects use exact Stoffel versions

Projects created with the stoffel CLI now exact-pin the 0.1.2 Rust SDK and binding generator:

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }
stoffel-bindgen = "=0.1.2"

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }
stoffel-bindgen = "=0.1.2"

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }
stoffel-bindgen = "=0.1.2"

A generated Rust project has its own Cargo dependency graph. Exact requirements keep a project on the Stoffel versions it was generated and validated against.

Release-scoped dependencies are exact-pinned

The release-scoped Stoffel crates now use exact 0.1.2 requirements for their internal dependencies.

Independently released networking, cryptography, and coordinator crates remain on their existing published versions. Their versions are not changed solely to match the 0.1.2 release number.

Dependency compatibility fixes

0.1.2 pins two dependencies that caused failures in fresh dependency resolution:

• num-bigint is pinned to 0.4.6 because 0.4.7 was yanked.

• tinyvec is pinned to 1.11.0 because 1.13.0 failed in the alloc-only path selected through quinn-proto for newly generated projects.

These failures could be missed by the workspace lockfile while still affecting a new project with its own resolver context.

Generated projects are validated directly

Release validation now builds generated Rust projects against the validated dependency set. These tests cover the project output developers receive, rather than only the workspace that produces it.

Generated-project builds are also isolated from local MPC integration tests to reduce resource contention during validation.

Release artifacts include Sigstore verification

The release workflows now create checksums and keyless Sigstore bundles for:

• .crate packages attached to GitHub Releases

• stoffel CLI archives

• standalone stoffel-run archives

Each signature is verified in GitHub Actions before the artifact and its verification files are uploaded. Crate workflows complete this verification before publishing to crates.io.

Signing uses GitHub Actions OIDC. No long-lived private signing key is stored as a repository secret.

Install

Install the stoffel CLI:

curl -fsSL https://get.stoffelmpc.com | sh

curl -fsSL https://get.stoffelmpc.com | sh

curl -fsSL https://get.stoffelmpc.com | sh

Create and check a project:

stoffel init hello-mpc
cd hello-mpc
stoffel check
stoffel build

stoffel init hello-mpc
cd hello-mpc
stoffel check
stoffel build

stoffel init hello-mpc
cd hello-mpc
stoffel check
stoffel build

For an existing Rust application:

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }

stoffel = { package = "stoffel-rust-sdk", version = "=0.1.2" }

0.1.2 makes generated projects more reproducible and release artifacts independently verifiable.

Try Stoffel for yourself. Start with the quickstart.