elliot/zen-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 3 tags
  • v4.0.2 7b5884ac9e

    zen-sync v4.0.2 Stable

    elliot released this 2026-09-01 12:16:23 -04:00 | 0 commits to main since this release

    zen-sync v4.0.2

    Bugfix + hardening release on the v4.0 baseline. Read the key rotation note first — this
    release is not a drop-in payload swap.

    Key rotation (important)

    Both signing keys were replaced in this release, and the fingerprint published over DNS has
    been replaced with it.

    • You need the new deployer. A deployer from v4.0 or v4.0.1 has the old public key built
      in and will refuse this payload. That is the substitution check working, not a fault.
    • Re-read the fingerprint from DNS (_zensync-fingerprint.evilarmy.com). A value you
      saved earlier will not match. Do not take the fingerprint from this page — the whole point
      of it is that it comes from a channel independent of the download host.
    • The v4.0 and v4.0.1 files on this site no longer verify against the current fingerprint.

    The keys were rotated because the old private keys were lost when the build machine was
    rebuilt, not because anything leaked. Nothing you already installed is suspect.
    See KEY-MANAGEMENT.md for why losing a key and leaking one are handled differently.

    Payload: payload.zsi — signed v24.
    SHA-256: f945b0d4f9eabbb16d5549cb0641c05ef9e580fe3a115af39dc74e7d31598aaf

    Fixes

    • Pins stop getting stuck "diverged". A pin with no stored title was recorded two
      different ways on two machines and the two never compared equal, so a pair of machines could
      sit reporting a divergence with nothing actually wrong — force-pull was the only way out.
    • The panel reports the real number. The divergence list only ever showed four items and
      gave no total, so fixing one made another appear and you could never tell how many there
      were.
    • Nothing fails silently. Apply operations now report what they could not do instead of
      returning success. Folder un-nesting used to do nothing at all, quietly; it works now.
    • A sync that changes something takes ~1.7s instead of ~66s. The time was going into a
      redundant network round trip in the push path.
    • Hardening. The keyring is written atomically, ids coming from other machines are
      scrubbed from log lines, a corrupt local repo no longer reads as "the server deleted
      everything", a failed state read no longer silently resets the anti-rollback high-water, and
      a startup failure is logged instead of leaving sync quietly unarmed.

    Install

    Download the deployer for your OS from this release (not an older one), verify it, then
    point it at this payload.zsi. Anti-rollback accepts v24 over v23. See INSTALL.md for the
    full path, including what the deployer prints if it rejects a payload.

    Integrity only: sha256sum -c SHA256SUMS.txt. That is not authenticity — verify each
    deployer's .sig against deployer-release.pub.hex, and check that key against the DNS
    fingerprint.

    Downloads
  • v4.0.1 37401695fd

    zen-sync v4.0.1 Stable

    elliot released this 2026-07-06 10:32:11 -04:00 | 1 commits to main since this release

    zen-sync v4.0.1

    Bugfix + resiliency patch on the v4.0 baseline. Payload-only — the native deployers
    are unchanged from v4.0; keep using the deployer you already have (verify its signature
    against the OOB fingerprint f1dcd890199e2d7abca2eaa1c0d653ac661cc8f13b4e88954eb1428a0fd4648d
    before running).

    Payload: payload.zsi — signed v23.
    SHA-256: 4f174b455c5e8e0a7589a061d3bd42a4e123ec1cd69a72054dda3b9ea1df12d0
    Verifies against the same embedded payload key as v4.0 (no key rotation).

    Fixes

    • Pins now sync a URL change. Editing a pinned/essential site's URL propagates across
      machines instead of silently doing nothing. (The tab itself isn't force-navigated — the
      stored pin URL updates; use "Reset Pinned Tab" to jump to it.)
    • No more stuck "diverged" on favicons, page titles, or SPA sites (Notion etc.). Icon
      and title differences that used to freeze sync now ride along and converge.
    • Themes/mods install reliably on the receiving machine, and removing a theme removes it
      fleet-wide.
    • Fails gracefully. A record it can't understand is skipped (never read as a deletion) and
      a failed step is retried instead of freezing the whole sync; a corrupt local state can no
      longer poison the shared history for other machines.
    • Better diagnostics. Set zen.sync.logLevel (about:config: debug|info|warn) for
      per-action tracing; the Review panel now shows any held/tolerated items read-only.

    Install

    Re-run your existing deployer and point it at this payload.zsi (anti-rollback accepts v23
    over v22). See INSTALL.md. First verify SHA256SUMS.txt:
    sha256sum -c SHA256SUMS.txt

    Downloads
  • v4.0 b7fdb4f8a5

    zen-sync 4.0 Stable

    elliot released this 2026-06-29 13:58:16 -04:00 | 4 commits to main since this release

    Signed payload + native deployers (Windows self-contained / framework-dependent, macOS .app, Linux). Verify each deployer with its .sig against the deployer-release fingerprint published out-of-band (not on this page). SHA256SUMS.txt covers integrity only, not authenticity. Draft until verification completes.

    Downloads