4.2.3 — The Sync That Went Nowhere, Very Efficiently

Tachyon is named after a particle that moves faster than light. It has spent its entire existence running a calendar sync that never arrived anywhere at all. This release fixes that, and the physics joke writes itself.

The bug

Calendar sync compared two lists to work out what changed. One was keyed on the event's UID, the other on the .ics filename. No CalDAV server names a file after the UID inside it, so essentially nothing ever matched, and every single run reached the same conclusion: every event has been deleted from the server, and also every event is brand new. So it dutifully deleted all of them and downloaded all of them again. Then it did it once more, forever, at roughly three events per second.

On the install that finally caught it, 8,189 of 8,220 rows were affected. It was not an edge case. It was not about imported data. It was every Nextcloud calendar Tachyon has ever synced, including the birthday list Nextcloud generates itself. It simply hid well, because on a small calendar deleting everything and refetching it still finishes in under a second, which looks identical to working.

The deletion side is now guarded too. If the server hands back a listing that cannot be corroborated, Tachyon keeps what it has rather than believing it.

A first sync of 5,605 events used to be 5,605 requests. It is now about 56.

Also new: your server is a hoarder

Every Tachyon update installs itself next to the previous one, and nothing has ever removed the old copy. Not once. An install upgraded ten times has been quietly carrying ten complete copies of the application, plus whatever it inherited from a RainLoop or SnappyMail past life, like sediment layers in a riverbank.

The admin About tab now shows you the lot and deletes the ones you pick. It will not let you delete the one you are running, which felt worth building in.

Please rotate some passwords

If you run the Nextcloud app alongside a still-enabled SnappyMail, logins have been failing, and the failure was writing user passwords to nextcloud.log in plaintext. Both halves are fixed. Treat those logs as exposed.

Thank you

This is the first release where the interesting work mostly came from other people.

@wojt-janowski sent six pull requests: DAV redirects, the additional config file, the stderr driver under php-fpm, contact edits actually reaching the server, a DAV discovery harness, and a whole plugin for configuring sync at login.

@andhimue filed the calendar bug with row counts per calendar, then tested the fix by polling the database every two seconds for forty-seven minutes and verifying the totals against what DAV actually serves rather than trusting the database. Then caught a regression in the fix. That report is why this release exists.

@corsch, @realsimix and @m0urs reported the updater, the zlib log noise and the S/MIME signing problem, and @realsimix tested a fix I could not reproduce locally.

@nullablenone overhauled the Indonesian translation, and Weblate now has Tachyon set up for anyone who wants to bring another language along.

Something is starting to grow around this project, and it is a good deal more fun than working on it alone. Keep the bug reports coming, especially the awkward ones.