Repository navigation
Replies: 18 comments
|
Text files open in preview, Filen reports its versioning storage, and Properties lets you edit read-only and hiddenPost-4.1.7 follow-up, fixed on Four items from the wishlist, merged as #585. Three of them had a cause behind the symptom that was worth more than the fix itself: the same decision was written down in more than one place, and the copies had drifted.
One trap is worth writing down, because the short version of the permissions fix is wrong in a way that reads as correct.
Verified green: |
Four assertions in the #347 thumbnail pin checked less than their names claimedLanded on A review of #544 arrived after that PR had merged and went unread at the time. It was right, and it was right about the part that matters most: not the fix, which shipped in v4.1.7 and works, but the pin cited as the evidence for it in row 94 of the 4.1.7 tracker. The common defect is worth naming, because it is the one that makes a green suite worthless. In each case the assertion's name stated a property and its body checked something weaker that happened to hold.
What that last one was worth in practice: with
Every review finding on the seven PRs of this battery is now answered, including the two on #543 that had been applied in Verified green: |
Blomp connect no longer fails with a bogus TempAuth 404Landed on Blomp Keystone (
Verified green on #584: Format, audit & unit tests, Linux / Windows / macOS (x64 and aarch64) |
WebDAV folder downloads run in parallel againLanded on A folder download over WebDAV stayed at one file at a time even with Settings set to 8. SFTP on the same SFTPGo server was already parallel, and
Live on Not in this change: multi-file selection (not a folder) for provider sessions is still a sequential Verified green: local |
|
cargo audit unblocked: h2 0.4.16 (RUSTSEC-2026-0258)Landed on Post-merge Checks on #595 failed
Verified green: local |
Zoho WorkDrive and rclone-crypt export to rclone.confPost-4.1.7 follow-up, fixed on Export to rclone.conf skipped Zoho because a test claimed rclone had no zoho backend. It has had one for years. Rclone Crypt imported, but never wrote the second
Live: Verified green: local fmt, clippy -D warnings, cargo test, cargo audit (after h2 0.4.16, already queued as #5), vitest 742, tsc, i18n 46 locales. PR #596 Checks all required jobs passed (Linux/Windows/macOS build, CLI smoke, coverage, Format/audit). |
rclone Zoho and crypt remotes stay listable after exportPost-4.1.7 follow-up, fixed on The first export path could still emit a Zoho remote rclone cannot list, or an S3 crypt overlay that looked for a bucket named after the overlay folder.
Verified green: local |
Compare no longer decrypts a named vault with the overlay cachePost-4.1.7 follow-up, fixed on
Requested 11 (b) (Filen multipart mtime logged when
Verified green: after rebase onto current |
|
Community triage: tables, scans, templates, credentials and progress UIPost-4.1.7 follow-up, fixed on This pass handled ten reports as one consistency audit. Eight needed code or regression coverage; two were reviewed and intentionally kept unchanged because changing them would weaken compatibility or overstate an external guarantee.
Verification on the rebased commit: |
Add Service form tabs can be dragged to reorderPost-4.1.7 follow-up, fixed on The chips that open from Add Service sat in creation order and could not be moved. Dropping one onto another now inherits the target slot, the same helper My Servers already uses, and the form state (host, credentials, protocol) stays attached to that tab's id rather than following the chip index.
The 0<->1 swap test was run against a helper that stored the header array as-is (ids and labels only) and failed there with Live (Linux 2, Verified green: DiscoverPanel / |
CatalogTable badges draw from the shared method glyph mapPost-4.1.7 follow-up, fixed on The Add Service table kept a private Blob cannot reuse S3's
Unification side-effect (the point of one map): CatalogTable S3 now draws Live (Linux 2, table view of Add Service): 51 catalog rows, 65 protocol badges, every badge had an Verified green: DiscoverPanel / |
|
Quick Connect now discovers targets and shows the configuration it actually usesPost-4.1.7 follow-up, fixed on Six July Quick Connect reports were real gaps. Target selection depended on copying opaque ids, OAuth displayed a redirect placeholder instead of its listener, manual quota accepted free-form text, and two layout hints described the wrong behavior. The UI and provider backends now share explicit, testable contracts.
Live verification (Linux, Verified green after rebase onto current |
EC for error correction, ECC only for Elliptic Curve CryptographyPost-4.1.7 follow-up, fixed on The report was that
One process note worth keeping, because it is the kind of thing that passes quietly: the rename was scripted with the identifiers masked out and the count asserted per file before writing, and the mask still missed Verified green: docs only, no code or build surface touched. |
CUSTOM / GENERIC SERVERS gets the shared badge order and its own method glyphsPost-4.1.7 follow-up, fixed on v4.1.7 unified the Add Service badges with the Quick Connect tabs on one presentation order,
The test was run against the unsorted array before the fix and fails there with exactly the order reported, which is what makes it a pin rather than a restatement of the fix: | Method glyphs | The strip drew one Still open in the same thread and not touched here: the rest of 17859082, which is the choice of symbol itself (the OAuth mark and its CC BY-SA 3.0 attribution, a bucket for S3, and the same concept drawn differently between the My Servers table and the MEGA and FileLu Quick Connect pages). Verified green: |
|
Three "Requested / under consideration" items closed on
|
| Area | Description | Status | Ref |
|---|---|---|---|
| i18n (fi) | Item 11. Restored protocol.discoverGitHub and vault.placementEmbeddedDesc, still ASCII after the diacritics pass, and corrected settings.autoStartTransfersHelp from "vedos-ja-pudota" (a proof or print run) to "vedä-ja-pudota". The ETag caveat (en.json plus all locales) and the French upload verbs from the same #538 re-review were already correct on main, so only the Finnish residual remained. |
🟢 fixed | b703616c |
| Transfer / checkpoint store | Item 10. Bounded the durable multipart checkpoint store, which previously only shrank when you reconnected to the exact same endpoint, so orphans were immortal. Adds a hard cap (256) that evicts terminal residue first, then the oldest resumable records, and never the record being opened, plus forget_endpoint(provider, protocol, host, account) as the explicit escape for a decommissioned server. Owner-chosen policy: hard cap plus forget-endpoint. |
🟢 fixed | e5c24bbc |
| CLI inventory / parity | Item 9. Made CLI/GUI/MCP parity measurable, which it was not: aeroftp-cli inventory had no view of the 847 registered Tauri commands. build.rs now generates TAURI_COMMANDS from the single generate_handler! block (always in sync, drift-guarded), and inventory gains a tauri section plus a name-based parity diff (name_matched a lower bound on coverage, name_unmatched an upper bound for manual triage, dominated by GUI/OS/internal commands). counts.tauri_commands is added so the CI drift gate covers the surface. No remote-exec was added to the CLI or MCP. |
🟢 fixed | a71a2504 |
Two small follow-ups intentionally left out of scope, to keep the change sets tight: wiring forget_endpoint to a user-facing CLI/GUI action (the automatic cap already bounds the growth defect on its own), and curating the genuine parity gaps from name_unmatched (which stays manual by design).
Verified green: npm run i18n:validate (46 locales, 0 [NEEDS TRANSLATION]); the checkpoint module suite (12 passed); the inventory consistency test; cargo fmt and cargo clippy clean on each branch; and CI green on all platforms (Linux, Windows, macOS) before each merge.
|
Pre-release audit for v4.1.8: four blocking defects, nineteen closed in totalPost-4.1.7 follow-up, fixed on Four independent adversarial audits ran over the 111 commits since the v4.1.7 tag, each writing to its own folder without seeing the others. 45 raw findings came back. Two independent merges of those four reports were then produced and reconciled against each other. The reconciliation is what decided severity and which patch to take, and it recorded three cases where one auditor reported a defect that another had explicitly declared clean. The most useful result is not the count. Only two of the defects were found by all four auditors, and thirteen were found by exactly one. Three auditors cleared kDrive discovery by reading the provider function; the defect was in its caller. A "nothing found" line means that auditor did not find it, and nothing more. Blocking, fixed before any tag
The rest
Accepted debt, one itemThe RejectedOne audit reported the version manifests still reading 4.1.7 as a High defect. The version bump is the step that follows this audit by design, so that is a later step not having run yet, rather than a defect of the audited range. The CI check it proposed, that every manifest and the CHANGELOG agree with Verified green: |
|
Pre-tag commit audit for v4.1.8: PASSRun hours before the tag, on The pre-release audit (queued 18) found and fixed nineteen defects. This pass audited those fixes, on the principle that fixes are where new defects come from. It was the right call: three of the five findings were introduced by the fixes themselves, and one of those was a panic. Scope was deliberately narrow. The range from the tag is 123 commits, but 111 had already been read by four independent auditors, so the two lanes went at the twelve that had not: the corrections, plus the release bump. Each lane reviewed the other's work rather than its own. Findings
The gate that was never invokedRemoving the orphan command made The snapshot being stale was not the real defect. The drift check existed in the CLI and no workflow ever called it, which is exactly the shape of the escape hatch nobody could invoke that this same release fixed elsewhere. It now runs in CLI Smoke Test, where the binary is already built. Wiring it exposed a second problem worth recording. Making the generated command list cfg-aware, itself an audit fix, made it profile dependent: a debug build registers one command a release build does not. Generating the snapshot from release would have made every developer's local check report a false drift, and a check that cries wolf where people work is a check that gets ignored, which is how unenforced gates start. The generator now also emits the debug-only commands and the inventory subtracts them, so both profiles produce a byte-identical snapshot and the committed file means one thing: the shipped surface. Accepted debt, one itemThe Verified green: |
v4.1.8 is out: closing this trackerv4.1.8 released, 21 tracked changes over 126 commits, 155 files, +11105 and -2384. The next tracker is #1417. Everything still open here has been carried over: the eight Requested rows, the pCloud trash known issue, and the follow-ups this cycle produced. What this release actually wasIt was meant to be a normal point release. Four independent adversarial audits ran over the 111 commits behind it, then two independent merges of those four reports were reconciled against each other, and what came back changed the shape of the release. They found a checkbox that handed a private key to every account on the machine: ticking read-only on a symbolic link read the mode without following the link and wrote it with a call that does follow, so a convenience link to a 0600 key wrote 0577 onto the key. They found a security guard removed for every OpenStack account, sending access tokens in the clear, while the provider it was meant for shipped as stable in the same release. They found a discovery feature that had never once reached the network. And a release script that executed the file it documents itself as only inspecting. Then the pre-tag pass audited the fixes, and three of its five findings were introduced by the fixes themselves, including a panic. Two of those were mine to begin with. The part worth keepingOnly two of the defects were found by all four auditors. Thirteen were found by exactly one. Three auditors cleared kDrive discovery by reading the provider function, correctly, while the defect sat in its caller. A "nothing found" line means that auditor did not find it, and nothing more. Three separate times the verification was competent and the question was too narrow. The dash sweep counted the character the rule names first and reported 88 against a real 187. The stripped-diacritics detector folded only combining marks and reported 36 against a real 179, because Turkish dotless i, Polish l-stroke and Icelandic thorn are not accents. And the kDrive case above. The lesson is to attack the question before the code: what would this check miss, and is the thing being counted the thing the rule covers. The other recurring shape was a mitigation nobody could invoke. A documented escape hatch for a decommissioned endpoint had no caller anywhere. A drift check for the committed command surface existed and no workflow ran it, which is why that snapshot had gone stale unnoticed. Both are fixed, and the class is worth looking for on purpose next time: not "does the mitigation exist" but "which file calls it". Carried forward179 locale strings with stripped diacritics across 17 locales, drifting in since January over eight commits, to be fixed by hand because the automated pass attempted previously changed meanings and was reverted the same day. About 55 keys shipping as raw English in 43 to 46 locales at once, which Thanks to @EhudKirsh and @roflhouse, whose reports drove a good part of what shipped here. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
AeroFTP 4.1.8, Rolling Tracker
Umbrella issue for the next AeroFTP point release (v4.1.8): known issues reported against v4.1.7 and the patches/updates landing on
mainafter the v4.1.7 tag.Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.
Found something that is not listed? Open a new issue and we will link it here.
What shipped in 4.1.7
See the v4.1.7 tracker (#458) and the release notes for the full 4.1.7 change set, 108 tracked changes over 237 non-merge commits: AeroRsync preserving
user.*extended attributes end to end against stock rsync with-Xon by default on Unix and the wire paths that carry them bounded against a hostile peer, a rebuilt Find Duplicates that gives the choice of which copy to keep and shows real hashes, real distances (the fuzzy distance had been a hash value, so any sort by similarity was meaningless), live scan progress and thumbnails, seventeen provider trash views folded into one sortable table, and Blomp promoted to production over OpenStack Swift. On the defect side: a filename with an ampersand next to a space was mangled in every listing, so a fetch of the displayed name failed andsync --deleteoffered to remove the real local file; a hostile-name sweep across every writable provider profile found six more defects, four of which could delete real local files, and 36 providers now pass end to end; on Linux six destructive actions had been asking a confirmation nobody ever saw, because WebKitGTK does not implement the script dialogs, so an account could go with nothing asked. The Snap stopped shipping a payload its own base cannot load, a break that had gone out for roughly thirty releases, and both that invariant and the GUI are now proven in CI before publishing. Two independent adversarial audits ran before the tag, the second covering all 333 code candidates since v4.1.6, with both verdicts and the accepted debt recorded in the repository. 47 languages, with about 5,400 strings restored word by word after a mechanical pass had stripped their diacritics.Patches & updates queued for 4.1.8
Landed on
mainafter the v4.1.7 tag; shipping in v4.1.8.63a150d6f,f7621e637,9de32f208,23ed98b9b,e609463e3,58eec32f176a3872d4,41ecdafb6,795378b23http://swiftproxy.acs.ai.net:8080/...(no TLS on that port). A post-4.1.7 check rejected HTTPS-auth to HTTP-storage, and the TempAuth 404 hid the real error. Catalog-issued HTTP origins are accepted; Blomp hosts force Keystone. Details.5b6f3ea86,7b5b13083,78cf89e18LockedSingleexcept for Nextcloud multipart clones. CLIget -rstill opened N connections on the legacy fallback, which is why the reporter saw CLI working. Vanilla WebDAV is nowHttpClonePool(ceiling 8), Digestncis shared across clones, and the Settings knob is passed through for HTTP providers. Live on the lab nginx DAV profile:file_parallelwent from unsupported/1 to supported/8; GUIprovider_download_folderloggedrequested_concurrency=8, effective_concurrency=8and pulled 8x2 MiB in 12.5 s. Details.f4da5e351195b51969type = zohowith the region TLD map, BYO client and token (Zoho-oauthtoken, not Bearer), and the live-discovered privatespace asroot_folder_id. A crypt overlay emits a siblingtype = cryptremote whoseremote = <base>:<path>is the Overlays Path. Import keeps that id on options, not asinitialPath. Native AeroCrypt is not emitted. Details.2c33020c4,f7cfae416,205d2b0e7initialPathlike/fmip…was dropped because of the slash, so export fell through to a team id (F6016). Team ids are never copied asroot_folder_id; discovery is bounded at 45s on the shared CLI/GUI helper. Regions rclone interpolates asaccounts.zoho.{tld}are emitted (uk/sa/ae); Canada (zohocloud.ca) and unknown slugs are skipped. S3 crypt wraps the bucket alias. Details.179aa558cresolve_compare_overlay_keysused the cache whenever the kind matched, so a standalone vault UUID of the same kind would normalize with the wrong keys, drop every row, and read as "no differences". The cache now answers only the sentinelprovider-overlay:<kind>:<owner>. A real UUID always goes to the vault maps. Pin:compare_real_vault_uuid_outranks_same_kind_overlay_cache. Requested 11 (b) already shipped in queued #1 (e609463e3). Details.c9081d2d1password2; the Argon2 salt and Filen API-key suggestions were reviewed and intentionally kept compatible rather than changed without a valid contract. Details.f5f84b42e6a78daa20methodIcon; shipped #567 shapes (OAuth Cloud, S3 Database, FTP Server, SFTP KeyRound) stay put. Details.bb5a53c88f480abd61eccwire-format field keep their spelling, and the notes now say why. Details.d9900d0f4,a062e2dfcServericon for all four entries. It sorts byprotocolBadgeRanknow and reuses the shared glyph map. Details.fea55779b,b5218d29fprotocol.discoverGitHubandvault.placementEmbeddedDescwere still ASCII after the diacritics pass, andautoStartTransfersHelpread "vedos-ja-pudota" (a proof or print run) instead of "vedä-ja-pudota". The ETag caveat and the French upload verbs from the same #538 re-review were already correct onmain. Details.b703616cforget_endpointremoves every record for a decommissioned server. Details.e5c24bbcbuild.rsgeneratesTAURI_COMMANDSfrom thegenerate_handler!block (drift-guarded), and inventory gains ataurisection plus a name-basedparitydiff (matched a lower bound, unmatched an upper bound for triage).counts.tauri_commandsgates it in CI; no remote-exec added. The structural-diff-only step. Details.a71a250451c6db6d,7e021abb,6f664ba1,3884eaa5,b1d76250,4262b694,cb86979a,ae0dc255,d98ab6b3002915dc,df809bb41234b954,5519dd4edocs/COMMAND-INVENTORY.jsonclaimed 93 CLI subcommands against a binary with 94, because adding a subcommand had not regenerated it. The check existed in the CLI and no CI job called it, which is the same shape as the escape hatch nobody could invoke that this release also fixed. It now runs in CLI Smoke Test, where the binary is already built. Making the generated list cfg-aware had also made it profile dependent, so the generator now emits the debug-only commands separately and the inventory subtracts them: a debug and a release build produce a byte-identical snapshot, and the committed file means one thing, the shipped surface. Details.6481a51c,8d3d230fRequested / under consideration
Community requests and internal follow-ups being evaluated for this or a later release.
Effort: 🟩 quick win · 🟧 medium · 🟥 large / epic. Ordered by effort (quick wins first).
-iselectors (prioritised by the reporter ahead ofEdit(E)and the 2-letter semantics; exact behaviour to be pinned).jpgto.jxltranscode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl.icnsmulti-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-testparticipants/addcontactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note typemalloc(): unaligned fastbin chunk detectedwhile deserializing a D-Bus message, the classic GLib heap-corruption signature (that worker is the victim tripping over an already-poisoned fastbin, not the corruptor). Two marshalling fixes already shipped and are safe: tray badge (31db84f8b) andapp_ready+ splash-timeout (cae95ee91), present since v4.0.5. But the SIGABRT STILL recurs (v4.0.9 on 2026-06-25, and the v4.1.2-era build on 2026-07-05, identical signature): the marshalling is INCOMPLETE, a still-uncovered off-main-thread GTK path remains. Sync Tauri commands are provably main-thread (safe), so the suspects are the event/plugin callbacks whose thread context is unconfirmed: trayon_menu_event/on_tray_icon_event, the single-instance plugin callback, andon_window_eventCloseRequested. Pre-existing across versions, intermittent, triggered by D-Bus storms on suspend/resume or monitor standby; it can corrupt the whole app until restart. Definitive path (owner-approved): adopt self-hosted crash reporting with native minidumps to capture the real corruptor, plus an ASan/valgrind repro, then finish the marshalling on the remaining callbacksHKCU\Software\AeroFTP\Settingsand re-read byNSIS_HOOK_POSTINSTALLso an in-app update cannot silently restore it (POSTINSTALL runs on every install, and an update is an install), plus a/NOASSOCsetup switch. A visible components-page checkbox is out of reach without forking the Tauri NSIS template, which is why it is parked rather than half built. Raised in #454; deferred because AeroFTP never claims the default handler for the general formats, it only adds itself to "Open with" plus its own context-menu entries, so with the uninstall residue fixed (queued #59) what remains is menu visibilityKnown issues found after release
Reported against v4.1.7. Carried over from the #1415 tracker where still open.
access_tokenquery param (pCloud rejects the Bearer header on trash) and refreshes viaget_valid_token(both since v3.1.4), with the crypt fix ind1e0bef90, so no code defect remains. The residual is a stale-token / re-auth condition, pending a live re-auth re-test. Carried over from #1414 known issue #4, then #1415 known issue #1Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released
Affected platforms
Maintained by the AeroFTP team. Current release v4.1.7 (#458), next v4.1.8. Patches accumulated here; each release line still gets its own tracker.
All reactions