OwnTransit 1.0.4 hotfix

OwnTransit 1.0.4 hotfix

Recovers an existing pairing when a pending credential renewal expires before the Target commits it, or when delivery and commit status are ambiguous. Version 1.0.3 recovered only a committed renewal with an expired acknowledgement; it could still leave the Client retrying an uncommitted expired request indefinitely.

The Client now obtains a signed, encrypted snapshot of the Target's renewal generation before preparing a replacement. A timeout or Relay error is never evidence that a request did not commit. The snapshot grants no credentials: a fresh ordinary renewal and current end-to-end authentication are still required before SSH. Recovery preserves pairing identity, pinned trust, the Relay URL and operator-owned SSH settings.

Upgrade Target and Client

Both endpoints need 1.0.4 for the new recovery. Upgrade the Target first when practical. The Relay does not require an upgrade for this fix.

On the Linux Target, using your existing maintenance connection or console:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for the affected existing tunnel so its service runs the upgraded Target. Select each affected named tunnel as appropriate. A Target restart can interrupt its active SSH streams.

On an Apple-silicon Mac Client, run as your ordinary user, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-macos.sh | sh -s -- client

On a Linux amd64 or arm64 Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-linux.sh | sudo sh -s -- client

Then retry your existing SSH command, or choose Continue tunnel for the existing Client tunnel. Do not delete pairing state or choose New to recover this condition. Existing broken SSH streams need a new SSH command; application bytes are never replayed.

Recovery and compatibility

• Repeated request/response expiry does not accumulate or exhaust a list of fallback requests. A fresh authenticated query can reconcile again on the next opening.
• New request material and operational keys are saved together atomically. Interrupted exchanges and lost Target acknowledgements resume the retained request.
• A delayed old request can win a race after a snapshot. The existing generation check rejects the competing request; the next opening reconciles again.
• Queries have a distinct versioned profile, schemas and signature domains. Ordinary renewal messages, carrier framing, TLS profiles and private-state schemas are unchanged. Existing relays carry opaque bounded blobs.
• Older Targets still support ordinary renewal and 1.0.3 committed-receipt recovery. They reject the new query; no weaker authentication, trust reset or automatic re-pairing is selected. Transient dialing failures retain ordinary retries for those peers.
• Rollback preserves readable ordinary pending/active state, but may restore the old recovery limitation. It never rolls back Target authority, clears alarms, or authorizes restoring an old state backup. Older installers may refuse newer managed aliases; binary/service rollback requires explicit local operator control.
• Initial pairing-code expiry, expired issuer roots, deliberately removed/alarmed/revoked pairings, and cloned or rolled-back authority are separate conditions. This hotfix does not bypass them.

Validation and signed assets

The release uses the existing distribution signer and nine-asset format for Linux amd64, Linux arm64 and the Apple-silicon Mac Client. Source regression coverage includes repeated committed/uncommitted expiry, delayed competing commits, restart boundaries, lost or unsupported status replies, cancellation, alarms/revocation, malformed/forged/crossed/stale replies, generation bounds and legacy renewal behavior. Installers recognize exact 1.0.3 predecessors while preserving pairing and SSH state.

Native Linux amd64 passed both race profiles, both vet profiles, and the security/publication gates using Go 1.26.7. Native Linux arm64 hardware passed both ordinary test profiles, both vet profiles and the same gates; its 39-bit kernel cannot execute Go's race detector, so native arm64 CI supplies race coverage. The required platform CI also exercises installer/service boundaries and the Mac Client.

The exact signed Linux capsules were independently verified and their Client, Target and Relay version commands executed on matching amd64 and arm64 hosts. Each reports 1.0.4 from source commit 5519f367b2f8ef04ed428a4d4249297f24817c3d; the Target retains fixed tcp4 127.0.0.1:22. These were isolated artifact checks, not live installation or tunnel recovery.

The initial installer download trusts GitHub HTTPS. Each installer then verifies the pinned distribution key, signed inventory and selected archive. Release files are built from the tagged source, signed with the existing key, and downloaded and verified before publication. No live deployment or recovery of a particular operator tunnel is claimed.

Change and CI evidence (#38) · Protocol and rollback · Recovery guide · Full comparison