3 releases 3 tags

RSS feed

• v4.0.2 7b5884ac9e

  Compare

  zen-sync v4.0.2 Stable

  elliot released this 2026-09-01 12:16:23 -04:00 | 0 commits to main since this release

  zen-sync v4.0.2

  Bugfix + hardening release on the v4.0 baseline. Read the key rotation note first — this
  release is not a drop-in payload swap.

  Key rotation (important)

  Both signing keys were replaced in this release, and the fingerprint published over DNS has
  been replaced with it.

  • You need the new deployer. A deployer from v4.0 or v4.0.1 has the old public key built
    in and will refuse this payload. That is the substitution check working, not a fault.
  • Re-read the fingerprint from DNS (_zensync-fingerprint.evilarmy.com). A value you
    saved earlier will not match. Do not take the fingerprint from this page — the whole point
    of it is that it comes from a channel independent of the download host.
  • The v4.0 and v4.0.1 files on this site no longer verify against the current fingerprint.

  The keys were rotated because the old private keys were lost when the build machine was
  rebuilt, not because anything leaked. Nothing you already installed is suspect.
  See KEY-MANAGEMENT.md for why losing a key and leaking one are handled differently.

  Payload: payload.zsi — signed v24.
  SHA-256: f945b0d4f9eabbb16d5549cb0641c05ef9e580fe3a115af39dc74e7d31598aaf

  Fixes

  • Pins stop getting stuck "diverged". A pin with no stored title was recorded two
    different ways on two machines and the two never compared equal, so a pair of machines could
    sit reporting a divergence with nothing actually wrong — force-pull was the only way out.
  • The panel reports the real number. The divergence list only ever showed four items and
    gave no total, so fixing one made another appear and you could never tell how many there
    were.
  • Nothing fails silently. Apply operations now report what they could not do instead of
    returning success. Folder un-nesting used to do nothing at all, quietly; it works now.
  • A sync that changes something takes ~1.7s instead of ~66s. The time was going into a
    redundant network round trip in the push path.
  • Hardening. The keyring is written atomically, ids coming from other machines are
    scrubbed from log lines, a corrupt local repo no longer reads as "the server deleted
    everything", a failed state read no longer silently resets the anti-rollback high-water, and
    a startup failure is logged instead of leaving sync quietly unarmed.

  Install

  Download the deployer for your OS from this release (not an older one), verify it, then
  point it at this payload.zsi. Anti-rollback accepts v24 over v23. See INSTALL.md for the
  full path, including what the deployer prints if it rejects a payload.

  Integrity only: sha256sum -c SHA256SUMS.txt. That is not authenticity — verify each
  deployer's .sig against deployer-release.pub.hex, and check that key against the DNS
  fingerprint.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • SHA256SUMS.txt
    2 downloads · 2026-09-01 12:16:45 -04:00 · 457 B
  • ZenSyncDeployer-framework-dependent.exe
    3 downloads · 2026-09-01 12:16:56 -04:00 · 548 KiB
  • ZenSyncDeployer-framework-dependent.exe.sig
    2 downloads · 2026-09-01 12:16:56 -04:00 · 64 B
  • ZenSyncDeployer-self-contained.exe
    2 downloads · 2026-09-01 12:17:01 -04:00 · 68 MiB
  • ZenSyncDeployer-self-contained.exe.sig
    2 downloads · 2026-09-01 12:17:02 -04:00 · 64 B
  • ZenSyncDeployer.app.zip
    4 downloads · 2026-09-01 12:16:55 -04:00 · 168 KiB
  • ZenSyncDeployer.app.zip.sig
    2 downloads · 2026-09-01 12:16:55 -04:00 · 64 B
  • deployer-release.pub.hex
    4 downloads · 2026-09-01 12:16:44 -04:00 · 65 B
  • payload.zsi
    6 downloads · 2026-09-01 12:16:45 -04:00 · 651 KiB
  • zen-sync-deploy
    3 downloads · 2026-09-01 12:16:54 -04:00 · 122 MiB
  • zen-sync-deploy.sig
    2 downloads · 2026-09-01 12:17:02 -04:00 · 64 B