Skip to content

v1.16.0

Choose a tag to compare

View all tags
@polius polius released this 25 Oct 00:14
· 10 commits to main since this release
v1.16.0
90c8976
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Breaking: protocol v3 — update both ends

fsend 1.16 uses a new wire protocol. Both sender and receiver need 1.16 or later. An older client gets a clear "please update" error instead of a crash: E034 from a peer, E060 from the server. If you self-host, update the server along with your clients.

Security

  • New pairing handshake. SPAKE2 has been replaced by CPace (CPACE-X25519-SHA512), the IRTF CFRG's recommended balanced PAKE. The implementation is checked against every test vector in the draft. This also removes an unmaintained library that a malformed message from any LAN peer could crash.
  • Post-quantum key exchange is now required between peers (X25519MLKEM768 hybrid).
  • --password is now verified by both sides in-session. Before, a fake sender could collect a verifier and try to crack it offline.
  • Taking over a dropped transfer needs more than the code. A resume uses a key derived from the original session. Someone who only saw the code gets E003.
  • Codes are salted with the UTC day, so a precomputed code table stops working after one day.
  • Relay registration uses a cookie check that blocks spoofing and reflection, and failed handshakes are capped at 10 per session (E046).

Connectivity

  • Works on networks that block UDP. fsend now falls back to a relay over TCP 443 automatically. If nothing gets through, E042 tells you why instead of a generic timeout after 55 s.
  • Survives network changes, sleep and server restarts and reconnects on its own.
  • Faster, clearer failures:
    • The sender pressing Ctrl-C reaches the receiver in about 0.06 s (was ~22 s).
    • A late second receiver gets E003 in about 2 s.
    • A wrong code gets E002 in about 6 s.
  • More reliable LAN discovery. VPN and container addresses are no longer tried as candidates.

Transfers

  • Much faster:
    • Up to ~4× throughput on loopback (~255 → 1,100+ MB/s).
    • 2,000 small files: 12.1 s → 1.1 s.
    • Resume checks: 3.7 s → 0.5 s.
  • No silent data loss:
    • Filenames that collide on the receiver's filesystem (case or Unicode) are detected.
    • --overwrite never deletes folders.
    • An unreadable file is skipped with E050 instead of aborting the whole transfer.
  • Safer resume. The full received prefix is verified. Partial files live in <out>/.fsend/, and free space is checked before the transfer starts.
  • One prompt for existing files, with a new "keep both" option. Use --rename to always).
  • --out - now streams folders as a tar to stdout.

Command line

  • Keep the code out of your shell history. Set FSEND_CODE, or run fsend and type it lso parsed more forgivingly.
  • --server / FSEND_SERVER apply to a single run.
  • New: short flags, "did you mean" suggestions, and --as to name a piped stream on the rec
  • Display:
    • Colours meet WCAG AA on light and dark terminals.
    • New plain/ASCII mode (FSEND_PLAIN).
    • The progress line drops less important details on narrow terminals.
    • The sender sees who connected.
  • Fixes:
    • Shell completion works again.
    • </dev/null no longer hangs.
    • Choosing not to overwrite now exits with code 0.
    • Notifications can be turned off (FSEND_NO_NOTIFY).
  • Shorter --help. The rest is in fsend help advanced.

Self-hosting

  • Privacy by default. Logs no longer record client IPs or codes.
  • Monitoring.
    • Prometheus metrics on a private listener (FSEND_METRICS_ADDR). /metrics has moved th
    • JSON logs (FSEND_LOG_FORMAT).
  • Restarts. FSEND_STATE_FILE keeps pending codes across a restart.
  • Version control. FSEND_MIN_CLIENT_VERSION turns away outdated clients with HTTP 426.
  • Container. Hardened image and compose file: runs as non-root and is pinned by digest.

Release integrity

  • Releases come with keyless cosign signatures, build attestations and SBOMs, and builds are reproducible.
  • fsend --update and the installers verify checksums, plus the signature when cosign is installed.
  • install.sh leaves a Homebrew-managed fsend alone.

Under the hood

  • Built with Go 1.27.3. Building from source now needs Go 1.27 (GOTOOLCHAIN=auto fetches it).
  • Updated dependencies: quic-go 0.64.0 (better congestion control on reordering paths), pion/ice 4.4.8, pion/transport 5.1.1.

Docs and video

  • The comparison page is rewritten and much shorter, and now covers croc, magic-wormhole, sendme and LocalSend.
  • New one-minute explainer video.
  • The README demo is re-rendered in fsend's own colours and follows your GitHub light/dark theme.
  • The README is tightened.

Full changelog: v1.15.1...v1.16.0

Assets 36
Loading