Skip to content

v0.7.0 — Tailscale baseline migration and relay runtime health

Choose a tag to compare

View all tags
@abruption abruption released this 28 Oct 02:13
· 60 commits to main since this release
v0.7.0
37a6589

v0.7.0 — 2026-10-28

This release includes #56 and #58: a newer Tailscale installation baseline, explicitly guarded source migration, and improved recovery-relay runtime diagnostics.

Existing users: migrate explicitly

Ordinary dots-ts update apply refuses the 1.102.4-to-1.104.4 declaration change. This safeguard is retained. Downloading the new CLI alone into an old installation is not a supported migration.

  1. Verify an independent cloud recovery terminal and pause external recovery jobs. Use the installed v0.6.0 runtime updater to upgrade the CLI/daemon to exactly 1.104.4, if needed. Skip same-version apply when already there.
  2. Confirm the runtime transaction and fresh external SSH/ping. Stage the complete reviewed v0.7.0 source bundle outside the installation, keeping its original manifest and all four source files together.
  3. From that complete source checkout, use the explicit migration. DOTS_TS_DIR identifies the existing installation; --bundle identifies the reviewed source bundle. Replace the installation path if you use a custom location:
DOTS_TS_DIR=/workspace/.dots-tailscale \
  python3 /workspace/reviewed-v0.7.0/dots-ts update migrate-baseline \
  --bundle /workspace/reviewed-v0.7.0 --confirm-recovery-terminal --json
DOTS_TS_DIR=/workspace/.dots-tailscale \
  python3 /workspace/reviewed-v0.7.0/dots-ts update status \
  --id PACKAGE_TRANSACTION_ID --json
  1. Check installed package integrity, the runtime and fresh external SSH/ping again before resuming external recovery jobs.

The migration supports only declared 1.102.4 → 1.104.4, and requires the installed CLI, daemon binary and identified running backend to already be 1.104.4. Caller and frozen worker verify source hashes, ownership, userspace arguments, socket, proxy configuration, prior transactions and fences. The transaction changes sources/manifest and restarts the shim; it does not replace binaries, state or SSH keys. Code rollback leaves the upgraded runtime in place. See the baseline migration guide and runtime update guide for the full procedure and recovery limits. Once candidate daemon execution is attempted, automatic state downgrade is not assumed safe.

New installations

The installer defaults to Tailscale 1.104.4. It validates bounded downloads, checksums, archive structure, executable format and both version outputs before placing the pair. Partial, symlinked or unsafe existing files are refused; below-baseline or mismatched existing pairs require explicit operator action. The installer does not silently replace existing binaries.

The package contains the usual four executable sources and original source-manifest.json. The eight release assets are source ZIP/tar.gz, those four individual sources, the manifest, and SHA256SUMS. Checksums establish artifact consistency, not independent publisher-signature authentication.

Relay diagnostics

The separately deployed external recovery relay remembers its interpreter and prefix paths resolved at startup. Removed runtime files are detected even when an installation alias points to a replacement. Health output adds runtime_executable_present; transitions expose booleans and numeric versions, not paths or raw exceptions. Service guidance recommends retaining a dedicated interpreter for the lifetime of the job; a venv alone does not preserve a removed base interpreter. The standard installer does not deploy this relay.

Security scope and validation

1.104.4 is the stable version selected during the 2026-10-28 review and meets TS-2026-013's stated 1.104.2+ floor. At review time, upstream had not yet published a complete 1.104.4 SSH fix range in the linked detailed guidance. This release does not claim complete Tailworm or SSH remediation. The Python/OpenSSL shim verifier, OS trust and saved CA bundle remain separate from Tailscale's Go verifier; no trust policy, CA or key regeneration is performed.

The source candidate passed 355 core tests on each Linux Python 3.11/3.13, including compiled version-probe fixtures, malformed/unsafe installer cases and guarded source-migration success/failure fixtures. The final release commit's core/research workflows and isolated official-artifact probes are linked in the GitHub Release. The dated validation record distinguishes the existing runtime's separately authorized live update from the new install/source-migration paths, which had not been tested live at publication.

Before #58 was opened, independent Claude Code and Codex CLI reviews of the same frozen inputs completed with no required corrections after fixes. GitHub's automated security review completed without findings. Its automated code review remained running when the maintainer explicitly authorized merging and publishing; it is not counted as a completed review.

Automatic updates, watchdog/external recovery integration and reproducible recovery setup remain in v0.8.0 (#31, #44, #45). Research issues #16, #20 and #43 remain open. Publishing this release does not deploy it to an existing Dots or KR environment or enable scheduled updates/recovery.

Final release verification

Release commit: 37a65891b87a4a09d9df40075a0599485b65e762.

  • Core checks: Linux Python 3.11/3.13 tests, manifest, Bash and ShellCheck.
  • Research checks: recovery and lifecycle tests on Python 3.12/3.13.
  • Official artifact probes: 1.102.4 and 1.104.4 archives, checksums and isolated real CLI/daemon version outputs.

Eight release assets were built from the exact commit; both source archives were compared with every tracked file, and the individual source hashes match the original manifest. The full archives include research sources; the ordinary installer does not deploy the recovery infrastructure.

Post-publication deployment — 2026-10-28

An operator-authorized source-only migration applied package 0.6.0 → 0.7.0 at 02:20:11 UTC with an explicit installed target. Tailscale 1.104.4 binary hashes, node/SSH identity and private-key file metadata were preserved. Fresh strict SSH/ping and the resumed recovery subscription were verified. This is one normal-path source migration, not fresh-install, failure-injection or VM-replacement validation. The original release executable sources/assets are unchanged.

Documentation correction and dated deployment evidence tracks the required DOTS_TS_DIR prefix for staged-source commands and the new observation record.

Assets 10
Loading