Arc 26.09.4

[xe-nvdk]

Arc v26.09.4

Arc is a high-performance time series database built on DuckDB, Parquet and Arrow.

A patch release on 26.09.3. Everything else on main ships in 27.01.1.

Compaction	Compaction no longer deletes rows that differ only in their field values.
Install	The Linux packages run on Debian 12, Ubuntu 22.04, RHEL 9 and Amazon Linux 2023 again.
Install	The RPMs are signed, so Fedora 45 accepts them.
Config	Continuous queries are enabled in the packaged configuration.
Security	A crafted zstd request can no longer crash Arc; Go 1.26.10 and dependency updates.

Before you upgrade

• A re-sent point no longer replaces the old one. Compaction now keeps
  every row that differs in any field. See the first section.
• Clusters: upgrade the compactor node. If cluster.failover_enabled is
  on, upgrade the writers too, because a writer can take over compaction.
• RPM installs: import the package key once:
  sudo rpm --import https://github.com/basekick-labs/arc/releases/download/v26.09.4/RPM-GPG-KEY-basekick.
• Continuous queries turn on after an upgrade, unless you set them off
  again (the packages replace /etc/arc/arc.toml).
• Linux now needs glibc 2.34 or newer. Ubuntu 20.04 and RHEL 8 are not
  supported. 26.09.3 needed 2.38, so no system that ran 26.09.3 loses support.

Fixed: compaction no longer deletes rows that differ only in their field values (#1232)

Compaction deduplicates data that carries tag metadata (line protocol) and
continuous-query output. Up to 26.09.3 it kept one row per (tags, time),
or one row per time for tagless continuous-query output, and deleted the rest
whatever their field values. Which row survived was arbitrary, and in
practice it was usually the oldest. So compaction silently deleted:

• Corrections: a point re-sent with the same tags and time and a new
  value. The old value usually survived.
• Partial writes: two writes of the same series and time carrying
  different fields (usage=1, then temp=5). One of them was dropped.
• Re-run continuous-query windows: the stale aggregate usually survived.

Compaction now removes a row only when another row is identical to it in
every column: time, every tag and every field.

Behaviour change: a re-sent point with a new value no longer replaces the
old one. Both rows are stored, and queries count both. Exact duplicates, such
as a client retrying the same write, are still collapsed.

Rows that 26.09.3 already deleted cannot be recovered by this release.

Clusters: only the node holding the compaction lease compacts, and every
other node pulls its output. Upgrading the compactor node therefore protects
the data, whatever version the writers and readers run. With
cluster.failover_enabled = true, a writer takes over compaction while the
compactor is down, so upgrade the writers too. Until then, a 26.09.3 writer
holding the lease still compacts the old way.

Continuous-query output without tag columns is now marked arc:dedup_exact.
The old key, arc:dedup_time, is still read but no longer written, because
26.09.3 deduplicates files carrying it on time alone. A file written by
26.09.4 is therefore never deduplicated by 26.09.3 after a rollback.

Cost: rows are compared in full only where their (tags, time) key
repeats, so compaction cost is close to before. A partition that is mostly
duplicates takes more memory to compact.

Fixed: the Linux packages run on Debian 12, Ubuntu 22.04, RHEL 9 and Amazon Linux 2023 (#1579)

The 26.09.3 Linux binary needed glibc 2.38, because it was built on the newest
GitHub runner:

• On Debian 12 and Ubuntu 22.04 the .deb installed and then failed to start
  (version `GLIBC_2.38' not found).
• On RHEL/Rocky/Alma 9 and Amazon Linux 2023 the RPM refused to install. On
  RHEL 9 it also needed a newer libstdc++ (GLIBCXX_3.4.30) than the system
  ships.
• The standalone arc-linux-amd64 and arc-linux-arm64 binaries had the
  same floor.

The binaries are now built on Ubuntu 22.04 with libstdc++ linked in, so they
need only glibc 2.34 or newer and the system's libgcc_s.

• Supported: Ubuntu 22.04+, Debian 12+, RHEL/Rocky/Alma 9+, Amazon Linux
  2023, Fedora 35+, on amd64 and arm64.
• Not supported: Ubuntu 20.04 and RHEL 8.

The .deb declares Depends: libc6 (>= 2.34), libgcc-s1, so dpkg refuses
an older system up front. The RPM declares Requires(pre): shadow-utils for
minimal images.

Every release now:

• fails if the binary needs glibc newer than 2.34;
• fails if it links libstdc++ dynamically;
• installs and starts its packages on Debian 12, Ubuntu 22.04, Rocky 9,
  Amazon Linux 2023 and Fedora before publishing.

Changed: the RPMs are signed

rpm 6.1, which Fedora 45 ships, refuses an unsigned package by default
(%_pkgverify_level all), and every Arc RPM up to 26.09.3 was unsigned:
package arc-26.09.3-1.x86_64 does not verify: no signature.

The RPMs (arc and arc-fips) are now signed with the Basekick Labs package
key:

• Fingerprint: 3E39 9CF8 F5D2 EF9A A9A5 36EF 7629 7AF0 8CBA B6FE.
• Where to get it: it is published with this release as
  RPM-GPG-KEY-basekick, and in the repository at
  deploy/packaging/RPM-GPG-KEY-basekick.

Import it once, then install:

sudo rpm --import https://github.com/basekick-labs/arc/releases/download/v26.09.4/RPM-GPG-KEY-basekick
sudo dnf install -y ./arc-26.09.4-1.x86_64.rpm

dnf install ./file.rpm also installs the older unsigned RPMs, with a
warning. arcli's RPMs are signed with the same key from its next release.

Changed: continuous queries are enabled in the packaged configuration

The arc.toml shipped in the .deb, the RPM, the Arch package and the Docker
image set [continuous_query] enabled = false, unlike the code default and
the documentation. On a fresh package install, every continuous-query API call
answered 404 and every arcli cq command failed with "continuous queries are
disabled on this server".

It is now enabled = true. No continuous query runs until one is created.

The 26.09.x packages replace /etc/arc/arc.toml on upgrade, so an upgrade to
26.09.4 enables continuous queries unless the file is edited back. To keep them
off, set [continuous_query] enabled = false or
ARC_CONTINUOUS_QUERY_ENABLED=false.

Security: a crafted zstd request can no longer crash Arc; Go 1.26.10 and dependency updates

• A crafted zstd request body no longer crashes Arc.
  klauspost/compress up to 1.20.1 panics on a crafted ~27 KB zstd frame
  (GHSA-fpmh-frq8-7rj8,
  GO-2026-6865). Arc decoded zstd write bodies on a goroutine of its own,
  where the panic cannot be recovered. So any client allowed to write, or
  anyone when auth is off, could stop the process with one POST to a write
  endpoint. Fixed by klauspost/compress 1.20.4.
• Go 1.26.10 fixes vulnerabilities in net/http, net/textproto,
  crypto/tls, crypto/x509 and html/template.
• golang.org/x/net 0.60.0 fixes HTTP/2 server issues.
• andybalholm/brotli 1.2.7 fixes excessive allocation on crafted
  streams (GO-2026-6888).

govulncheck reports no reachable vulnerabilities in this release.

Performance note (arm64): klauspost/compress 1.20 encodes snappy on
arm64 with new assembly, and every Parquet file Arc writes is
snappy-compressed. On an Apple M3 Max with 1.20.3, line-protocol ingest was
3.2% slower and MessagePack+gzip unchanged, with files 2-4% larger
(klauspost/compress#1271).
1.20.2 is the first release with the security fix, so there is no version
without this cost. Recovering it with smaller Parquet pages is tracked in
#1582.

Quick Start

Docker

docker run -d \
  -p 8000:8000 \
  -v arc-data:/app/data \
  ghcr.io/basekick-labs/arc:26.09.4

Debian/Ubuntu (amd64, arm64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.09.4/arc_26.09.4_amd64.deb
sudo dpkg -i arc_26.09.4_amd64.deb

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

# Check status
curl http://localhost:8000/health

RHEL/Fedora/Rocky (x86_64, aarch64)

# Trust the Basekick Labs package key, then download and install
sudo rpm --import https://github.com/basekick-labs/arc/releases/download/v26.09.4/RPM-GPG-KEY-basekick
wget https://github.com/basekick-labs/arc/releases/download/v26.09.4/arc-26.09.4-1.x86_64.rpm
sudo dnf install -y ./arc-26.09.4-1.x86_64.rpm

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Arch Linux / Omarchy (x86_64, aarch64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.09.4/arc-26.09.4-1-x86_64.pkg.tar.zst
sudo pacman -U arc-26.09.4-1-x86_64.pkg.tar.zst

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Kubernetes (Helm)

helm install arc https://github.com/basekick-labs/arc/releases/download/v26.09.4/arc-26.09.4.tgz

Download Artifacts

Platform	Architecture	Package
Docker	amd64, arm64	ghcr.io/basekick-labs/arc:26.09.4
Debian/Ubuntu	amd64	arc_26.09.4_amd64.deb
Debian/Ubuntu	arm64	arc_26.09.4_arm64.deb
RHEL/Fedora	x86_64	arc-26.09.4-1.x86_64.rpm
RHEL/Fedora	aarch64	arc-26.09.4-1.aarch64.rpm
Arch Linux / Omarchy	x86_64	arc-26.09.4-1-x86_64.pkg.tar.zst
Arch Linux / Omarchy	aarch64	arc-26.09.4-1-aarch64.pkg.tar.zst
Kubernetes	-	arc-26.09.4.tgz (Helm)

Documentation

• Full Documentation

Community

• Discord: Join
• Issues: GitHub

---

This discussion was created from the release Arc 26.09.4.