aria2c 2.5.6: twelve-patch clients and corresponding source

Aria2 Next 2.5.6 with twelve IRIS patches. Patch 12 separates tracker control traffic from payload throttling.

Assets include static x86_64 and aarch64 clients, their SHA256 checksums, and the corresponding source archive with build recipes, dependency sources, patches and license texts. Both retained source rebuilds match the distributed clients exactly.

Verify the downloaded files with sha256sum -c aria2c.sha256 and sha256sum -c aria2c-2.5.6-p12-source.tar.gz.sha256. After extracting the source, run sha256sum -c SHA256SUMS in its directory. Rebuild instructions are included.

Required peer TLS is opt-in for standalone clients; the IRIS installer enables it. ARM validation uses emulation and does not establish device performance. Prior p7 and p10 releases remain unchanged.

aria2c 2.5.6 — ten-patch clients and corresponding source

aria2c 2.5.6 — ten-patch IRIS build

Precompiled static clients for both x86_64 and aarch64, matching the clients
committed in IRIS. This release includes all ten IRIS patches, including opt-in
required TLS 1.3 peer transport with mutual certificates and hybrid key exchange.
Required mode never falls back to plaintext. The default remains disabled.

Client	SHA-256
aria2c-x86_64	4442564f58cd3ba28953980b192d38fa45ee95fbca78ca6aa99da1c4052de8a7
aria2c-aarch64	c12d7a0d432bc5e9b80489d8f3981b0d802a4af9d4a547775e0c4306bf43a65a

Corresponding source

Download aria2c-2.5.6-p10-source.tar.gz and verify its adjacent .sha256 file.
Inside the archive, SHA256SUMS verifies every member. It includes:

• The exact Aria2 Next 2.5.6 upstream source at
  d4971f0e12322e2ffcdb1721911b7d5c6206d0e5, all ten original patches, and the
  downstream source with dated modification notices.
• Original and current build recipes plus an archive-based rebuild driver.
• Exact musl, zlib, c-ares, OpenSSL and GCC source archives, Alpine packaging
  recipes and patches, and preserved license notices.

The combined OpenSSL 3-linked executable is distributed under GPLv3 using
the aria2 source's GPL-2.0-or-later grants. Original source grants and dependency
licenses are retained; IRIS itself remains Apache-2.0. See the archive's
LICENSE-DISTRIBUTION.md and COPYING3.

Use the explicit client source asset above, not GitHub's automatically generated
IRIS repository “Source code” archives, for the complete packaged client inputs.
Users can continue installing the compiled clients without a local compiler.

Fresh builds from the extracted source archive reproduced both shipped clients
byte-for-byte: x86-64 and ARM64. The source archive was also independently
packaged twice with an identical SHA-256 checksum.

IRIS stages and verifies images only; it does not install or activate device
software, change boot variables, or reload devices.

Owner: @gthermaenius

aria2c 2.5.6, 7 patches

The patched static aria2c that IRIS redistributes, for both architectures it
ships to: x86_64 for the server seeder and the Catalyst 9300 IOx package,
aarch64 for the IE-3400 and other IE-3x00 IOx packages.

tools/get-aria2c.sh fetches these assets and refuses anything that does not
match tools/aria2c.sha256 in the checkout doing the fetching.

Asset	sha256
aria2c-x86_64	f6af5c2d90050436f736864476d7b4f062df30122fd8a510eec4794abbf6c38c
aria2c-aarch64	4d507ccd6a7f5ee297644097d070c1afeedb64d76b202f2a23294f6432180f20

Corresponding source (GPLv2 section 3)

Aria2 Next is licensed under the GNU General Public License version 2, which
requires that a recipient of these binaries can obtain the source they were
built from and the scripts controlling their compilation. All four are in this
repository at commit e45db80e1eef284f33cb0f33f169a970b733b422:

• Upstream fork and exact commit: named in tools/aria2c-patches/README.md —
  Aria2 Next 2.5.6, source pin d4971f0e12322e2ffcdb1721911b7d5c6206d0e5
• The seven patches: tools/aria2c-patches/*.patch
• The build container definition: tools/aria2c-build/Dockerfile
• The build driver: tools/aria2c-build/build.sh

Rebuilding from those inputs will not reproduce these bytes unless the
toolchain matches; tools/aria2c-build/README.md explains why and what to do
about it.

Build

Alpine 3.24.1 pinned by digest, every package pinned by exact version, OpenSSL
3.5.8, LTO enabled and asserted rather than allowed to downgrade silently.
Execution: native x86_64; aarch64 under QEMU. Validated with wire and RPC
regressions, real BitTorrent transfers, and the loopback grace check described
in tools/aria2c-build/README.md.