LinkLake v1.1.2

LinkLake v1.1.2

中文

v1.1.2 汇总 LinkLake v1.1 功能线的完整实现，并作为 v1.0.0 之后的当前公开发行目标。它包含共享 PostgreSQL、高可用、Fleet、ACME、持久流量计量、显式迁移和维护命令，以及本次安全和发布质量修复；不改变 v1.1 的协议、配置、数据库 schema 或运行边界。

发布状态

v1.1 功能线从 v1.0.0（2026 年 8 月 6 日） 升级。v1.1.0 和 v1.1.1 保留为不可变源码标签，没有对应的 GitHub Release；完整发行包和镜像以 v1.1.2 Release 的资产与构建证明为准。

v1.1 功能

• 共享状态与高可用：PostgreSQL 共享管理员、会话、客户端、八类策略、Fleet、证书和 ACME 账户、审计、历史指标、告警及更新任务。共享读取失败不会回退到实例本地 SQLite。实例租约、Leader fencing、共享公网端口所有权和租约清理限制过期 Leader 的写入。
• Fleet 与多入口：Fleet Bundle v2 在同一事务中协调来源、归属、凭据引用、generation、策略交换和流量规则；支持多个独立 Server 入口、客户端健康探测、冲突预览及 Cloudflare DNS 故障切换。Secret、SOCKS5 和 HTTP Proxy 的凭据引用保持来源约束，敏感凭据不进入 Bundle。
• 协议与流量：提供 TCP、UDP、端口组和范围、HTTP/HTTPS、WebSocket、HTTP/2、原生 gRPC、TLS SNI、Secret、SOCKS5 及 HTTP 正向代理。七种转发协议接入持久流量计量、共享速率窗口、完整 u64 配额和 UUID 幂等去重；每个实例保留持久 spool，正常停机时排空账务。
• 证书与 ACME：Web UI 和 Flutter Manager 支持 HTTP-01、Cloudflare DNS-01、通配符证书、续期窗口、就绪状态和角色权限。共享签发、DNS 清理、失败恢复和任务重试遵循任务租约与策略版本；Cloudflare Token 只从环境变量或 Secret 文件读取。
• 维护与迁移：新增 PostgreSQL 初始化、SQLite → PostgreSQL 显式停机迁移、回滚资格检查和停机材料密钥轮换命令。Helm 使用共享 PostgreSQL 业务状态和每个副本独立持久卷；存储标记阻止将 PostgreSQL 误用于 SQLite 单机备份、恢复或更新流程。
• 管理与运维：Web UI 和 Manager 提供管理员、操作员、审计员、TOTP、会话撤销、限权 API Token、审计、指标、SLO、告警和服务端协调的远程客户端更新任务。Windows、Linux、容器和 Helm 的安装、升级、配置保护与恢复边界保持一致。

本次安全与质量修复

• 持久 SQLite 服务在强制终止后可立即重启：取得进程独占锁后回收旧运行租约，保留 fencing 序列、业务数据和任务完成记录。PostgreSQL 的共享租约保护保持不变。
• 修复 TCP 活动连接指标与并发许可释放顺序不一致的问题；观察到连接归零后，策略允许立即使用完整并发容量。
• 锁定 h2 0.4.16 和 chacha20 0.10.2 相关依赖路径，并同步第三方许可证清单，确保传输和加密依赖使用安全更新后的版本。
• 修复严格 Clippy 发布门禁反馈，保持生产代码没有全局 warning 抑制。
• 修复 Windows 与 Unix 测试夹具的临时路径规范化和边界处理，避免平台差异改变验证结果。
• 修复 Web UI 冒烟夹具在 ACME 联系邮箱为空时的请求归一化；空邮箱按可选字段发送空字符串，不再导致夹具与 API 合同不一致。
• 统一 Server、Client、Manager、Windows 文件资源、Helm Chart、许可证清单和仓库文档的 1.1.2 发行身份。

从最新公开版本升级

用户应从公开的 v1.0.0 直接规划升级；v1.1.0 和 v1.1.1 没有公开 Release，不能作为已发布升级基线。

• 单机 SQLite：先备份完整数据目录、配置和实例身份，再按使用说明执行 Server、Client 和 Manager 更新。启动时的 schema 迁移必须完成并保留可验证的恢复副本；不要用旧二进制覆盖已经接受新数据库写入的目录。
• SQLite → PostgreSQL：这是显式停机迁移。停止源进程和所有目标副本，保留源备份，按迁移指南初始化目标、导入数据并检查回执。目标接受新写入后，切回旧 SQLite 不能视为无损回滚。
• PostgreSQL 高可用：每个副本需要独立持久目录来保存实例身份、未上传账务和暂存文件；所有副本必须使用同一份独立 32 字节材料密钥，并单独备份外部凭据。部署方负责数据库可用性、公网入口和负载均衡；接管不会迁移已有 TCP/QUIC 连接，客户端或应用可能需要重连。
• 数据库恢复与程序回退：候选 Server 启动后可能已经修改数据库，镜像回退或 helm rollback 不会撤销这些变化。PostgreSQL 使用备份/PITR、匹配的材料密钥和实例状态恢复；SQLite 快照不能恢复整个集群。执行维护前阅读集群升级与恢复。
• 资产验证：安装前核对版本、SHA-256、GitHub 构建证明和生产 Ed25519 更新清单；Linux 还需核对 OpenPGP 签名，OCI 镜像按摘要验证签名和 provenance。Windows 官方包按个人开源策略不使用 Authenticode 签名；macOS 保持源码和 CI 兼容，没有官方二进制或自动更新资产。

公开发布不代表现有生产节点已经升级。生产部署应根据每个环境的数据库状态、备份和维护窗口单独安排。

English

LinkLake v1.1.2 consolidates the complete v1.1 feature line and is the current public release target after v1.0.0. It includes shared PostgreSQL state, high availability, Fleet, ACME, durable traffic accounting, explicit migration and maintenance commands, plus the security and release-quality fixes described below. It does not change v1.1 protocols, configuration, database schemas or operational boundaries.

Publication status

The v1.1 feature line upgrades from v1.0.0 (August 6, 2026). v1.1.0 and v1.1.1 remain immutable source tags without corresponding GitHub Releases. Use the complete packages, images and build attestations attached to the v1.1.2 Release.

v1.1 feature line

• Shared state and high availability: PostgreSQL stores administrators, sessions, clients, all eight policy kinds, Fleet, certificates and ACME accounts, audit records, historical metrics, alerts and update tasks. Shared-read failures never fall back to instance-local SQLite. Instance leases, leader fencing, shared public-port ownership and bounded lease cleanup constrain stale leader writes.
• Fleet and multiple entry points: Fleet Bundle v2 atomically coordinates sources, ownership, credential references, generations, policy swaps and traffic rules. Multiple independent Server entries, client health probes, conflict previews and Cloudflare DNS failover are supported. Secret, SOCKS5 and HTTP Proxy credential references remain source-bound; sensitive credentials are not placed in Bundles.
• Protocols and traffic: TCP, UDP, port groups and ranges, HTTP/HTTPS, WebSocket, HTTP/2, native gRPC, TLS SNI, Secret, SOCKS5 and HTTP forward proxy are available. Seven forwarding protocols use durable accounting, shared rate windows, full-range u64 quotas and UUID idempotency; every instance retains a durable spool and drains accounting during orderly shutdown.
• Certificates and ACME: The Web UI and Flutter Manager support HTTP-01, Cloudflare DNS-01, wildcard certificates, renewal windows, readiness and role-based controls. Shared issuance, DNS cleanup, failure recovery and retries follow task leases and policy revisions; Cloudflare tokens are read only from environment variables or Secret files.
• Maintenance and migration: New commands initialize PostgreSQL, perform explicit offline SQLite-to-PostgreSQL migration, check rollback eligibility and rotate material keys while all instances are stopped. Helm uses shared PostgreSQL application state and independent persistent volumes per replica; storage markers prevent PostgreSQL from entering standalone SQLite backup, restore or update flows.
• Management and operations: The Web UI and Manager provide administrator, operator and auditor roles, TOTP, session revocation, scoped API tokens, audit, metrics, SLOs, alerts and server-coordinated remote client update tasks. Installation, upgrade, configuration-preservation and recovery boundaries are aligned across Windows, Linux, containers and Helm.

Security and quality fixes in v1.1.2

• Allow immediate restart after forced termination in persistent SQLite mode by recovering stale runtime leases under the exclusive process lock. Preserve the fencing sequence, business data and completed-job records. PostgreSQL retains shared lease protection.
• Release TCP connection permits before publishing a lower active count, allowing the full configured concurrency immediately after prior connections finish.
• Pin the h2 0.4.16 and chacha20 0.10.2 dependency paths and refresh the third-party license inventory so transport and encryption use the security-updated versions.
• Fix strict Clippy release-gate findings without introducing global warning suppression in production code.
• Normalize temporary paths and boundary handling in Windows and Unix test fixtures so platform differences do not change verification behavior.
• Normalize an empty optional ACME contact email in the Web smoke harness; an empty email is sent as an empty string and no longer violates the API contract.
• Align the 1.1.2 release identity across Server, Client, Manager, Windows file resources, the Helm chart, the license inventory and repository documentation.

Upgrading from the latest public release

Plan upgrades directly from the public v1.0.0; v1.1.0 and v1.1.1 have no public Releases and are not published upgrade baselines.

• Standalone SQLite: Back up the complete data directory, configuration and instance identity before updating Server, Client and Manager using the user guide. Startup schema migration must complete with a recoverable backup; do not overwrite a directory that has already accepted new database writes with an old binary.
• SQLite to PostgreSQL: This is an explicit offline migration. Stop the source process and every target replica, retain the source backup, initialize the target, import data and inspect receipts using the migration guide. After the target accepts new writes, switching back to the old SQLite database is not a lossless rollback.
• PostgreSQL high availability: Every replica needs an independent persistent directory for instance identity, unuploaded accounting and staging files. All replicas must use the same independent 32-byte material key, with external credentials backed up separately. The deployment provides database availability, public ingress and load balancing; takeover does not migrate existing TCP/QUIC connections, so clients or applications may need to reconnect.
• Database recovery and binary rollback: A candidate Server may modify the database during startup; an image rollback or helm rollback does not undo those changes. Restore PostgreSQL with backup/PITR, matching material keys and instance state; a SQLite snapshot cannot restore the cluster. Read cluster upgrades and recovery before maintenance.
• Asset verification: Before installation, verify the version, SHA-256, GitHub build attestation and production Ed25519 update manifest. Linux also requires OpenPGP signatures; verify OCI signatures and provenance against the image digest. Official Windows packages intentionally omit Authenticode under the personal open-source policy; macOS remains source- and CI-compatible without official binaries or automatic-update assets.

Publication does not imply that existing production nodes have been upgraded. Schedule production deployment separately around each environment's database state, backups and maintenance window.

LinkLake v1.0.0

Important

Windows packages are intentionally unsigned under the personal open-source release policy for LinkLake. Verify SHA-256, GitHub attestations, Linux OpenPGP where applicable, and the production Ed25519 updater manifest before installation.

根据 LinkLake 的个人开源发布策略，Windows 软件包有意未签名（不使用 Authenticode）。安装前请验证 SHA-256、GitHub Attestation、适用的 Linux OpenPGP 签名和生产 Ed25519 更新清单。

Full Changelog: v0.2.0...v1.0.0

LinkLake v1.0.0-rc.1

Warning

This release candidate is protected by SHA-256, Linux OpenPGP, GitHub attestations, GHCR Cosign, and the production Ed25519 updater manifest. Windows Authenticode and Apple Developer ID/notarization remain mandatory for v1.0.0 but are not yet attached to this RC.

此候选版已使用 SHA-256、Linux OpenPGP、GitHub Attestation、GHCR Cosign 与生产 Ed25519 更新清单保护。Windows Authenticode 与 Apple Developer ID/公证仍是 v1.0.0 的强制门禁，但本 RC 暂未附带。

Full Changelog: v0.7.0-rc.1...v1.0.0-rc.1

LinkLake v0.7.0-rc.1

Full Changelog: v0.6.0-rc.3...v0.7.0-rc.1

LinkLake v0.6.0-rc.3

Full Changelog: v0.6.0-rc.2...v0.6.0-rc.3

LinkLake v0.6.0-rc.2

Full Changelog: v0.5.0-rc.1...v0.6.0-rc.2

LinkLake v0.5.0-rc.1

Full Changelog: v0.4.0-rc.2...v0.5.0-rc.1

LinkLake v0.4.0-rc.2

Full Changelog: v0.4.0-rc.1...v0.4.0-rc.2

LinkLake v0.4.0-rc.1

Full Changelog: v0.2.0...v0.4.0-rc.1

LinkLake v0.2.0

LinkLake v0.2.0 completes UDP tunnel productionization.

Highlights:

• QUIC DATAGRAM UDP relay with Retry address validation and one-time attachment tickets
• Persistent UDP policies, Web UI management, metrics, rate limits, session limits, and bandwidth limits
• Datagram fragmentation/reassembly with client and server memory protections
• Windows/Linux clients and servers with automated local and independent public-network acceptance
• TCP and UDP may use the same numeric public port

UDP remains a best-effort transport. See README.md or README.en.md for Internet MTU and large-datagram guidance.