Orbit v2.5.2

Full Changelog: v2.5.1...v2.5.2

Orbit v2.5.1

Orbit 2.5.1 is a reliability release. It fixes two bugs found by reviewing Orbit against Syncthing; there are no new features.

Fixes

• Devices with slightly different clocks are served again. Every expiry check had zero tolerance. A device whose clock ran 1 s ahead of the connection service had every announcement refused. One 1 s behind refused the service's challenges, relay tickets and peer offers, so even relay fallback failed. LAN discovery, invitation mailboxes and joining had the same problem between two devices. Expiry checks now allow 30 s of clock difference (protocol.MaxClockSkew), and devices request 30 s shorter lifetimes so existing services also accept them. Expired items are still always refused. This was also the cause of the intermittent CI failures listed under 2.5.0's known issues.
• Edits that keep the same size and modification time are no longer missed. Quick scans skipped a file whose size, modification time and inode were unchanged. An in-place edit that restored the timestamp (cp -p, touch -r, or two equal-size saves within one timestamp tick) was only picked up by the daily full-content scan. Quick scans now also compare ctime, which only the kernel sets, and rehash a file once when its last observation was within 2 s of the change.

Compatibility

• No protocol, state or configuration changes; upgrade in place.
• orbit-net is unchanged: keep running orbit-net 1.3.0 (tarballs on the v2.5.0 release). 2.5.1 devices work with it without a redeploy.

Verification

• Stress run of the formerly intermittent tests (24 concurrent race-instrumented processes): 6 failures in 96 runs before, 0 in 96 after.
• New regression tests fail on 2.5.0 and pass on 2.5.1: a service clock 10 s ahead and 10 s behind, and the restored-timestamp edit.
• Full CI suite on the tag, plus a live check on three devices served by an orbit-net 1.3.0 service.

Known issues

• A device whose clock is off by more than a record's lifetime (30 s for relay tickets, 60 s for challenges) still cannot connect; keep NTP enabled.
• Linux only. No TURN, UPnP or port mapping: when no direct path exists, traffic uses the service's budgeted relay.

Orbit 2.5.0 (orbit-net 1.3.0)

Orbit 2.5.0 and orbit-net 1.3.0 close out Orbit as a distributed-systems project. This is the first published 2.x release. It includes everything since 2.0: native WAN pairing and sync, the keyboard TUI and the onboarding work.

Highlights

• No default service (since 2.4). A fresh install uses the local network. To sync across networks, run your own service with one command:
  orbit-net init --dir ~/orbit-service --origin https://HOST:8443 --stun HOST:3478
• Member sponsorship (orbit-net 1.3.0). An allowlisted service now admits the devices in its devices' Orbits automatically. You list your first device once. Every device that later joins one of its Orbits gets the relay with no server step. orbit-net devices remove revokes a device. orbit-net init turns this on by default.
• Admission allowlist (orbit-net 1.2.0). A service can serve only its operator's devices. Unlisted devices can still pair toward a listed device.
• Route accounting. orbit network status --routes shows how much of each peer's traffic went over the LAN, direct WAN (TCP/QUIC) or the relay, for 24 hours and 30 days.
• Measurements. NAT/firewall cells, transfer rates and known limitations are in the case study.

Downloads

• orbit packages: .deb, .rpm and tarballs for amd64 and arm64 (see SHA256SUMS and release-manifest.json).
• orbit-net-v1.3.0-linux-{amd64,arm64}.tar.gz: the connection service, with systemd units and the operator guide.
  sha256: amd64 9d8f8e913231d6b091a6c962a203a7889609991dbb331f2a045b8887f36aacf6, arm64 cb0b86ede9705756d5fbce0cc9c30c6222206dd37848dce3146abdc34f4b8dbe

Known issues

• A few timing-sensitive runtime tests (TestFinalR00*, TestSponsorshipRuntimeJoinNeedsNoOperator) fail intermittently, about 1 run in 6, in the CI race-detector job, which runs all packages concurrently. They pass locally, including with the race detector at GOMAXPROCS=1. Under that load a fresh relay runtime is sometimes slow to announce. The cause is under investigation.
• Linux only. No TURN, UPnP or port mapping: when no direct path exists, traffic uses the service's budgeted relay.