chore(release): 1.25.21

CHANGELOG.md

@@ -8,6 +8,12 @@
 - A new Policy/v3 registration records the share key its content source names (`share/<shareId>` on the owner's `default` network) in the registration's transaction, so publishing a share needs no `tinycloud.encryption/key.create` grant: the publisher encrypts to the key's public key and registers. A missing key is created at `keyVersion` 1 and counts toward the network's key limit; at the limit the registration answers 403 `key_limit_exceeded` and stores nothing. An existing key keeps its state. The registration now also requires the source's network to exist and be active. Docs: `docs/encryption-named-keys.md`. Details: TC-2525
 - Share-email issuer trust bundles can pin one next key for the same issuer DID during an explicit UTC overlap window. The legacy key stops at `issuerNotAfter`; malformed, duplicate, unbounded or expired overlaps fail startup and `--validate-config`. Existing single-key bundles remain unchanged. This is node-side trust support only: the OpenCredentials witness and js-sdk policy contract must also support key rotation before activation. Older node images reject overlap fields; restore the previous single-key bundle before rollback. See `deploy/share-email/production-trust-bundle-contract.md`.
 
+## [1.25.21] - 2026-11-10
+
+### Changes
+
+- Release binaries for Apple Silicon Macs (macOS arm64) are published again. Details: TC-2728
+
 ## [1.25.20] - 2026-11-10
 
 ### Changes

Cargo.toml

@@ -115,3 +115,6 @@ publish-jobs = ["homebrew"]
 cargo-dist-version = "0.32.0"
 # Path that installers should place binaries in
 install-path = "CARGO_HOME"
+
+[workspace.metadata.dist.github-custom-runners]
+aarch64-apple-darwin = "macos-15"

tinycloud-node-server/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.25.20"
+version = "1.25.21"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"