index fixups for the prod DB

Reduce spans emitted per controller request without touching the head
sample rate. Removes 20 StartSpan sites (97 -> 77) that traced the same
logical op at multiple layers:

- DB.cpp: drop all db:: read-helper/leaf spans; the db_mirror_set::
  wrapper survives as the single span per read op (also removes the
  latent member_id-from-networkId attribute bug).
- CentralDB.cpp: drop inner write-op spans (save/+children, nodeIsOnline,
  eraseNetwork, eraseMember); keep getSSOAuthInfo (errors) and all
  background-thread spans (commitThread, onlineNotificationThread, init).
- EmbeddedNetworkController.cpp: drop per-rule parseRule span and the
  no-op _startThreads span; keep request/_request roots.

Sampler, trace-context propagation, commit/Bigtable-write spans, and all
business logic are unchanged.

.clang-format

@@ -4,72 +4,71 @@ BreakBeforeBraces: Stroustrup
 IndentWidth: 4
 TabWidth: 4
 AlignAfterOpenBracket: AlwaysBreak
-AlignConsecutiveMacros: 'true'
-AlignConsecutiveAssignments: 'false'
-AlignConsecutiveDeclarations: 'false'
+AlignConsecutiveMacros: "true"
+AlignConsecutiveAssignments: "false"
+AlignConsecutiveDeclarations: "false"
 AlignEscapedNewlines: Right
-AlignOperands: 'true'
-AlignTrailingComments: 'true'
-AllowAllArgumentsOnNextLine: 'false'
-AllowAllConstructorInitializersOnNextLine: 'false'
-AllowAllParametersOfDeclarationOnNextLine: 'false'
-AllowShortBlocksOnASingleLine: 'true'
-AllowShortCaseLabelsOnASingleLine: 'false'
+AlignOperands: "true"
+AlignTrailingComments: "true"
+AllowAllArgumentsOnNextLine: "false"
+AllowAllConstructorInitializersOnNextLine: "false"
+AllowAllParametersOfDeclarationOnNextLine: "false"
+AllowShortBlocksOnASingleLine: "true"
+AllowShortCaseLabelsOnASingleLine: "false"
 AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: Never
 AlwaysBreakAfterReturnType: None
-BinPackArguments: 'false'
-BinPackParameters: 'false'
+BinPackArguments: "true"
+BinPackParameters: OnePerLine
 BreakBeforeBinaryOperators: NonAssignment
-BreakBeforeTernaryOperators: 'true'
+BreakBeforeTernaryOperators: "true"
 BreakConstructorInitializers: BeforeComma
 BreakInheritanceList: BeforeComma
-CompactNamespaces: 'false'
-ConstructorInitializerAllOnOneLineOrOnePerLine: 'true'
-ConstructorInitializerIndentWidth: '4'
-ContinuationIndentWidth: '4'
-Cpp11BracedListStyle: 'false'
-FixNamespaceComments: 'true'
+CompactNamespaces: "false"
+ConstructorInitializerAllOnOneLineOrOnePerLine: "true"
+ConstructorInitializerIndentWidth: "4"
+ContinuationIndentWidth: "4"
+Cpp11BracedListStyle: "false"
+FixNamespaceComments: "true"
 IncludeBlocks: Regroup
-IndentCaseLabels: 'true'
+IndentCaseLabels: "true"
 IndentPPDirectives: None
-IndentWrappedFunctionNames: 'false'
-KeepEmptyLinesAtTheStartOfBlocks: 'false'
-MaxEmptyLinesToKeep: '1'
+IndentWrappedFunctionNames: "false"
+KeepEmptyLinesAtTheStartOfBlocks: "false"
+MaxEmptyLinesToKeep: "1"
 NamespaceIndentation: None
 PointerAlignment: Left
-ReflowComments: 'true'
-SortIncludes: 'true'
-SortUsingDeclarations: 'true'
-SpaceAfterCStyleCast: 'false'
-SpaceAfterLogicalNot: 'true'
-SpaceAfterTemplateKeyword: 'true'
-SpaceBeforeAssignmentOperators: 'true'
-SpaceBeforeCpp11BracedList: 'true'
-SpaceBeforeCtorInitializerColon: 'true'
-SpaceBeforeInheritanceColon: 'true'
+ReflowComments: "true"
+SortIncludes: "true"
+SortUsingDeclarations: "true"
+SpaceAfterCStyleCast: "false"
+SpaceAfterLogicalNot: "true"
+SpaceAfterTemplateKeyword: "true"
+SpaceBeforeAssignmentOperators: "true"
+SpaceBeforeCpp11BracedList: "true"
+SpaceBeforeCtorInitializerColon: "true"
+SpaceBeforeInheritanceColon: "true"
 SpaceBeforeParens: ControlStatements
-SpaceBeforeRangeBasedForLoopColon: 'true'
-SpaceInEmptyParentheses: 'false'
-SpacesBeforeTrailingComments: '3'
-SpacesInAngles: 'false'
-SpacesInCStyleCastParentheses: 'false'
-SpacesInContainerLiterals: 'true'
-SpacesInParentheses: 'false'
-SpacesInSquareBrackets: 'false'
-UseTab: 'Always'
+SpaceBeforeRangeBasedForLoopColon: "true"
+SpaceInEmptyParentheses: "false"
+SpacesBeforeTrailingComments: "3"
+SpacesInAngles: "false"
+SpacesInCStyleCastParentheses: "false"
+SpacesInContainerLiterals: "true"
+SpacesInParentheses: "false"
+SpacesInSquareBrackets: "false"
+UseTab: "Always"
 
 ---
 Language: Cpp
 Standard: Cpp03
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: ObjC
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: Java
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: CSharp
-ColumnLimit: '240'
-...
+ColumnLimit: "120"

.clangd

@@ -0,0 +1,11 @@
+CompileFlags:
+  Add:
+    - "-std=c++17"
+    - "-I../ext"
+    - "-I../ext/prometheus-cpp-lite-1.0/core/include"
+    - "-I../ext/prometheus-cpp-lite-1.0/simpleapi/include"
+    - "-I../ext/opentelemetry-cpp-1.21.0/api/include"
+    - "-I./ext"
+    - "-I./ext/prometheus-cpp-lite-1.0/core/include"
+    - "-I./ext/prometheus-cpp-lite-1.0/simpleapi/include"
+    - "-I./ext/opentelemetry-cpp-1.21.0/api/include"

.dockerignore

@@ -1,2 +1,12 @@
 .git/
 workspace/
+# Local from-source dependency builds (scripts/bootstrap-deps.sh) and CMake output;
+# never ship these into an image -- they are host-specific and large.
+.deps/
+.deps-build/
+build/
+build-*/
+out/
+# Dockerfiles are supplied via -f; keeping them out of the context means editing
+# them does not invalidate the COPY layers (and the heavy build cache).
+ext/central-controller-docker/Dockerfile*

.drone.jsonnet

@@ -1,68 +0,0 @@
-
-local targets = [
-      //
-      // Render these into .drone.yaml by running "make drone"
-      //      
-      { "os": "linux", "name": "el9", "isas": [ "amd64", "arm64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "el8", "isas": [ "amd64", "arm64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "el7", "isas": [ "amd64", "ppc64le"], "events": [ "tag" ] },
-      { "os": "linux", "name": "el6", "isas": [ "amd64" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "amzn2", "isas": [ "amd64", "arm64" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "fc37", "isas": [ "amd64", "arm64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "fc36", "isas": [ "amd64", "arm64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "fc35", "isas": [ "amd64", "arm64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "jammy", "isas": [ "amd64", "arm64", "armv7", "riscv64", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "focal", "isas": [ "amd64", "arm64", "armv7", "riscv64", "ppc64le"  ], "events": [ "tag" ] },
-      { "os": "linux", "name": "bionic", "isas": [ "amd64", "arm64", "386", "ppc64le", "s390x" ], "events": ["tag" ] },
-      { "os": "linux", "name": "xenial", "isas": [ "amd64", "arm64", "386" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "sid", "isas": [ "386", "amd64", "arm64", "armv7", "riscv64", "mips64le", "ppc64le", "s390x" ], "events": [ "push", "tag" ] },
-      { "os": "linux", "name": "bookworm", "isas": [ "amd64", "arm64", "armv7", "386", "mips64le", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "bullseye", "isas": [ "amd64", "arm64", "armv7", "386", "mips64le", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "buster", "isas": [ "amd64", "arm64", "armv7", "386", "mips64le", "ppc64le", "s390x" ], "events": [ "tag" ] },
-      { "os": "linux", "name": "stretch", "isas": [ "amd64", "arm64", "386" ], "events": [ "tag" ] },
-      // { "os": "windows", "name": "win2k19", "isas": [ "amd64" ], "events": ["push", "tag" ] }
-];
-
-local Build(platform, os, isa, events) = {
-  "kind": "pipeline",
-  "type": "docker",
-  "pull": "always",
-  "name": platform + " " + isa + " " + "build",
-  "clone": { "depth": 1 },
-  "steps": [
-    {
-      "name": "build",
-      "image": "registry.sean.farm/honda-builder",
-      "commands": [ "./ci/scripts/build.sh " + platform + " " + isa + " " + "100.0.0+${DRONE_COMMIT_SHA:0:8}" + " " + "${DRONE_BUILD_EVENT}" ]
-    },
-    {
-      "name": "list",
-      "image": "registry.sean.farm/honda-builder",
-      "commands": [ "ls -la " + platform ]
-    },
-    {
-      "name": "notify-mattermost",
-      "image": "registry.sean.farm/mattermost-notify",
-      "environment": {
-        "token": { "from_secret": "mattermost-token" },
-        "host": { "from_secret": "mattermost-host" },
-        "channel": { "from_secret": "mattermost-channel" },
-        "maxRetry": 3,
-      },
-      "when": { "status": [ "failure" ] }
-    }
-  ],  
-  "image_pull_secrets": [ "dockerconfigjson" ],
-  [ if isa == "arm64" || isa == "armv7" then "platform" ]: { os: os, arch: "arm64" },
-  "trigger": { "event": events }
-};
-
-// puttin on the bits
-
-std.flattenArrays([
-  [
-     Build(p.name, p.os, isa, p.events)
-      for isa in p.isas
-  ]
-  for p in targets
-])

.github/workflows/build.yml

@@ -0,0 +1,126 @@
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  build_ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-unknown-linux-gnu
+        components: rustfmt, clippy
+
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: make
+      run: make
+    - name: selftest
+      run: |
+        make selftest
+        ./zerotier-selftest
+    - name: 'Tar files' # keeps permissions (execute)
+      run: tar -cvf zerotier-one.tar zerotier-one
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-ubuntu-x64
+        path: zerotier-one.tar
+        retention-days: 7
+
+  build_macos:
+    runs-on: macos-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust aarch64
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        target: aarch64-apple-darwin
+        components: rustfmt, clippy
+    - name: Install Rust x86_64
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        target: x86_64-apple-darwin
+        components: rustfmt, clippy
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+    - name: make
+      run: make
+    - name: selftest
+      run: |
+        make selftest
+        ./zerotier-selftest
+    - name: 'Tar files' # keeps permissions (execute)
+      run: tar -cvf zerotier-one.tar zerotier-one
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-mac
+        path: zerotier-one.tar
+        retention-days: 7
+
+
+  build_windows:
+    runs-on: windows-2022
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf true
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-pc-windows-msvc
+        components: rustfmt, clippy
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: setup msbuild
+      uses: microsoft/setup-msbuild@v2
+    - name: msbuild
+      run: |
+        msbuild windows\ZeroTierOne.sln /m /p:Configuration=Release  /property:Platform=x64 /t:ZeroTierOne
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-windows
+        path: windows/Build
+        retention-days: 7

.github/workflows/central-controller.yaml

@@ -0,0 +1,104 @@
+# on:
+#     workflow_dispatch:
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  central_controller:
+    name: Central Controller Build
+    strategy:
+      matrix:
+        runner: [gha-runner-x64, gha-runner-arm64]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build & Push Docker Image
+        # Registry layer cache (mode=max) so the expensive builder stage -- which
+        # builds opentelemetry-cpp + google-cloud-cpp from source -- is reused across
+        # runs and fresh runners. The cache invalidates automatically when the
+        # bootstrap inputs change. Cache is per-arch (the deps layer is arch-specific).
+        run: |
+          CACHE=us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller-buildcache:${{ runner.arch }}
+          docker buildx build \
+            -t us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} \
+            -f ext/central-controller-docker/Dockerfile \
+            --cache-from type=registry,ref=$CACHE \
+            --cache-to type=registry,ref=$CACHE,mode=max \
+            --provenance false \
+            --push .
+
+  multi-arch-docker:
+    runs-on: gha-runner-x64
+    needs: central_controller
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Create and push multi-arch manifest
+        run: |
+          docker manifest create us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
+          docker manifest push us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}

.github/workflows/validate-linux.sh

@@ -0,0 +1,497 @@
+#!/bin/bash
+
+# This test script joins Earth and pokes some stuff
+
+TEST_NETWORK=8056c2e21c000001
+RUN_LENGTH=30
+TEST_FINISHED=false
+ZTO_VER=$(git describe --tags $(git rev-list --tags --max-count=1))
+ZTO_COMMIT=$(git rev-parse HEAD)
+ZTO_COMMIT_SHORT=$(git rev-parse --short HEAD)
+TEST_DIR_PREFIX="$ZTO_VER-$ZTO_COMMIT_SHORT-test-results"
+
+TEST_OK=0
+TEST_FAIL=1
+
+echo "Performing test on: $ZTO_VER-$ZTO_COMMIT_SHORT"
+TEST_FILEPATH_PREFIX="$TEST_DIR_PREFIX/$ZTO_COMMIT_SHORT"
+mkdir $TEST_DIR_PREFIX
+
+# How long we will wait for ZT to come online before considering it a failure
+MAX_WAIT_SECS=30
+
+ZT_PORT_NODE_1=9996
+ZT_PORT_NODE_2=9997
+
+################################################################################
+# Multi-node connectivity and performance test                                 #
+################################################################################
+
+test() {
+
+	echo -e "\nPerforming pre-flight checks"
+
+	check_exit_on_invalid_identity
+
+	echo -e "\nRunning test for $RUN_LENGTH seconds"
+
+	export NS1="ip netns exec ns1"
+	export NS2="ip netns exec ns2"
+
+	export ZT1="$NS1 ./zerotier-cli -p9996 -D$(pwd)/node1"
+	# Specify custom port on one node to ensure that feature works
+	export ZT2="$NS2 ./zerotier-cli -p9997 -D$(pwd)/node2"
+
+	echo -e "\nSetting up network namespaces..."
+	echo "Setting up ns1"
+
+	ip netns add ns1
+	$NS1 ip link set dev lo up
+	ip link add veth0 type veth peer name veth1
+	ip link set veth1 netns ns1
+	ip addr add 192.168.0.1/24 dev veth0
+	ip link set dev veth0 up
+
+	$NS1 ip addr add 192.168.0.2/24 dev veth1
+	$NS1 ip link set dev veth1 up
+
+	# Add default route
+	$NS1 ip route add default via 192.168.0.1
+
+	iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.255.0 \
+		-o eth0 -j MASQUERADE
+	iptables -A FORWARD -i eth0 -o veth0 -j ACCEPT
+	iptables -A FORWARD -o eth0 -i veth0 -j ACCEPT
+
+	echo "Setting up ns2"
+	ip netns add ns2
+	$NS2 ip link set dev lo up
+	ip link add veth2 type veth peer name veth3
+	ip link set veth3 netns ns2
+	ip addr add 192.168.1.1/24 dev veth2
+	ip link set dev veth2 up
+
+	$NS2 ip addr add 192.168.1.2/24 dev veth3
+	$NS2 ip link set dev veth3 up
+	$NS2 ip route add default via 192.168.1.1
+
+	iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 \
+		-o eth0 -j MASQUERADE
+	iptables -A FORWARD -i eth0 -o veth2 -j ACCEPT
+	iptables -A FORWARD -o eth0 -i veth2 -j ACCEPT
+
+	# Allow forwarding
+	sysctl -w net.ipv4.ip_forward=1
+
+	################################################################################
+	# Memory Leak Check                                                            #
+	################################################################################
+
+	export FILENAME_MEMORY_LOG="$TEST_FILEPATH_PREFIX-memory.log"
+
+	echo -e "\nStarting a ZeroTier instance in each namespace..."
+
+	export time_test_start=$(date +%s)
+
+	# Spam the CLI as ZeroTier is starting
+	spam_cli 100
+
+	echo "Starting memory leak check"
+	$NS1 sudo valgrind --demangle=yes --exit-on-first-error=yes \
+		--error-exitcode=1 \
+		--xml=yes \
+		--xml-file=$FILENAME_MEMORY_LOG \
+		--leak-check=full \
+		./zerotier-one node1 -p$ZT_PORT_NODE_1 -U >>node_1.log 2>&1 &
+
+	# Second instance, not run in memory profiler
+	# Don't set up internet access until _after_ zerotier is running
+	# This has been a source of stuckness in the past.
+	$NS2 ip addr del 192.168.1.2/24 dev veth3
+	$NS2 sudo ./zerotier-one node2 -U -p$ZT_PORT_NODE_2 >>node_2.log 2>&1 &
+
+	sleep 10; # New HTTP control plane is a bit sluggish, so we delay here
+
+	check_bind_to_correct_ports $ZT_PORT_NODE_1
+	check_bind_to_correct_ports $ZT_PORT_NODE_2
+
+	$NS2 ip addr add 192.168.1.2/24 dev veth3
+	$NS2 ip route add default via 192.168.1.1
+
+	echo -e "\nPing from host to namespaces"
+
+	ping -c 3 192.168.0.1
+	ping -c 3 192.168.1.1
+
+	echo -e "\nPing from namespace to host"
+
+	$NS1 ping -c 3 192.168.0.1
+	$NS1 ping -c 3 192.168.0.1
+	$NS2 ping -c 3 192.168.0.2
+	$NS2 ping -c 3 192.168.0.2
+
+	echo -e "\nPing from ns1 to ns2"
+
+	$NS1 ping -c 3 192.168.0.1
+
+	echo -e "\nPing from ns2 to ns1"
+
+	$NS2 ping -c 3 192.168.0.1
+
+	################################################################################
+	# Online Check                                                                 #
+	################################################################################
+
+	echo "Waiting for ZeroTier to come online before attempting test..."
+	node1_online=false
+	node2_online=false
+	both_instances_online=false
+	time_zt_node1_start=$(date +%s)
+	time_zt_node2_start=$(date +%s)
+
+	for ((s = 0; s <= $MAX_WAIT_SECS; s++)); do
+		node1_online="$($ZT1 -j info | jq '.online' 2>/dev/null)"
+		node2_online="$($ZT2 -j info | jq '.online' 2>/dev/null)"
+		echo "Checking for online status: try #$s, node1:$node1_online, node2:$node2_online"
+		if [[ "$node2_online" == "true" && "$node1_online" == "true" ]]; then
+			export both_instances_online=true
+			export time_to_both_nodes_online=$(date +%s)
+			break
+		fi
+		sleep 1
+	done
+
+	echo -e "\n\nContents of ZeroTier home paths:"
+
+	ls -lga node1
+	tree node1
+	ls -lga node2
+	tree node2
+
+	echo -e "\n\nRunning ZeroTier processes:"
+	echo -e "\nNode 1:\n"
+	$NS1 ps aux | grep zerotier-one
+	echo -e "\nNode 2:\n"
+	$NS2 ps aux | grep zerotier-one
+
+	echo -e "\n\nStatus of each instance:"
+
+	echo -e "\n\nNode 1:\n"
+	$ZT1 status
+	echo -e "\n\nNode 2:\n"
+	$ZT2 status
+
+	if [[ "$both_instances_online" != "true" ]]; then
+		exit_test_and_generate_report $TEST_FAIL "one or more nodes failed to come online"
+	fi
+
+	echo -e "\nJoining networks"
+
+	$ZT1 join $TEST_NETWORK
+	$ZT2 join $TEST_NETWORK
+
+	sleep 10
+
+	node1_ip4=$($ZT1 get $TEST_NETWORK ip4)
+	node2_ip4=$($ZT2 get $TEST_NETWORK ip4)
+
+	echo "node1_ip4=$node1_ip4"
+	echo "node2_ip4=$node2_ip4"
+
+	echo -e "\nPinging each node"
+
+	PING12_FILENAME="$TEST_FILEPATH_PREFIX-ping-1-to-2.txt"
+	PING21_FILENAME="$TEST_FILEPATH_PREFIX-ping-2-to-1.txt"
+
+	$NS1 ping -c 16 $node2_ip4 >$PING12_FILENAME
+	$NS2 ping -c 16 $node1_ip4 >$PING21_FILENAME
+
+	ping_loss_percent_1_to_2=$(cat $PING12_FILENAME |
+		grep "packet loss" | awk '{print $6}' | sed 's/%//')
+	ping_loss_percent_2_to_1=$(cat $PING21_FILENAME |
+		grep "packet loss" | awk '{print $6}' | sed 's/%//')
+
+	# Normalize loss value
+	export ping_loss_percent_1_to_2=$(echo "scale=2; $ping_loss_percent_1_to_2/100.0" | bc)
+	export ping_loss_percent_2_to_1=$(echo "scale=2; $ping_loss_percent_2_to_1/100.0" | bc)
+
+	################################################################################
+	# CLI Check                                                                    #
+	################################################################################
+
+	echo "Testing basic CLI functionality..."
+
+	spam_cli 10
+
+	$ZT1 join $TEST_NETWORK
+
+	$ZT1 -h
+	$ZT1 -v
+	$ZT1 status
+	$ZT1 info
+	$ZT1 listnetworks
+	$ZT1 peers
+	$ZT1 listpeers
+
+	$ZT1 -j status
+	$ZT1 -j info
+	$ZT1 -j listnetworks
+	$ZT1 -j peers
+	$ZT1 -j listpeers
+
+	$ZT1 dump
+
+	$ZT1 get $TEST_NETWORK allowDNS
+	$ZT1 get $TEST_NETWORK allowDefault
+	$ZT1 get $TEST_NETWORK allowGlobal
+	$ZT1 get $TEST_NETWORK allowManaged
+	$ZT1 get $TEST_NETWORK bridge
+	$ZT1 get $TEST_NETWORK broadcastEnabled
+	$ZT1 get $TEST_NETWORK dhcp
+	$ZT1 get $TEST_NETWORK id
+	$ZT1 get $TEST_NETWORK mac
+	$ZT1 get $TEST_NETWORK mtu
+	$ZT1 get $TEST_NETWORK name
+	$ZT1 get $TEST_NETWORK netconfRevision
+	$ZT1 get $TEST_NETWORK nwid
+	$ZT1 get $TEST_NETWORK portDeviceName
+	$ZT1 get $TEST_NETWORK portError
+	$ZT1 get $TEST_NETWORK status
+	$ZT1 get $TEST_NETWORK type
+
+	# Test an invalid command
+	$ZT1 get $TEST_NETWORK derpderp
+
+	# TODO: Validate JSON
+
+	# Performance Test
+
+	export FILENAME_PERF_JSON="$TEST_FILEPATH_PREFIX-iperf.json"
+
+	echo -e "\nBeginning performance test:"
+
+	echo -e "\nStarting server:"
+
+	echo "$NS1 iperf3 -s &"
+	sleep 1
+
+	echo -e "\nStarting client:"
+	sleep 1
+
+	echo "$NS2 iperf3 --json -c $node1_ip4 > $FILENAME_PERF_JSON"
+
+	cat $FILENAME_PERF_JSON
+
+	# Let ZeroTier idle long enough for various timers
+
+	echo -e "\nIdling ZeroTier for $RUN_LENGTH seconds..."
+	sleep $RUN_LENGTH
+
+	echo -e "\nLeaving networks"
+
+	$ZT1 leave $TEST_NETWORK
+	$ZT2 leave $TEST_NETWORK
+
+	sleep 5
+
+	exit_test_and_generate_report $TEST_OK "completed test"
+}
+
+################################################################################
+# Generate report                                                              #
+################################################################################
+
+exit_test_and_generate_report() {
+
+	echo -e "\nStopping memory check..."
+	sudo pkill -15 -f valgrind
+	sleep 10
+
+	time_test_end=$(date +%s)
+
+	echo "Exiting test with reason: $2 ($1)"
+
+	# Collect ZeroTier dump files
+
+	echo -e "\nCollecting ZeroTier dump files"
+
+	node1_id=$($ZT1 -j status | jq -r .address)
+	node2_id=$($ZT2 -j status | jq -r .address)
+
+	$ZT1 dump
+	mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node1_id.txt"
+
+	$ZT2 dump
+	mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node2_id.txt"
+
+	# Copy ZeroTier stdout/stderr logs
+
+	cp node_1.log "$TEST_FILEPATH_PREFIX-node-log-$node1_id.txt"
+	cp node_2.log "$TEST_FILEPATH_PREFIX-node-log-$node2_id.txt"
+
+	# Generate report
+
+	cat $FILENAME_MEMORY_LOG
+
+	DEFINITELY_LOST=$(xmlstarlet sel -t -v '/valgrindoutput/error/xwhat' \
+		$FILENAME_MEMORY_LOG | grep "definitely" | awk '{print $1;}')
+	POSSIBLY_LOST=$(xmlstarlet sel -t -v '/valgrindoutput/error/xwhat' \
+		$FILENAME_MEMORY_LOG | grep "possibly" | awk '{print $1;}')
+
+	# Generate coverage report artifact and summary
+
+	FILENAME_COVERAGE_JSON="$TEST_FILEPATH_PREFIX-coverage.json"
+	FILENAME_COVERAGE_HTML="$TEST_FILEPATH_PREFIX-coverage.html"
+
+	echo -e "\nGenerating coverage test report..."
+
+	gcovr -r . --exclude ext --json-summary $FILENAME_COVERAGE_JSON \
+		--html >$FILENAME_COVERAGE_HTML
+
+	cat $FILENAME_COVERAGE_JSON
+
+	COVERAGE_LINE_COVERED=$(cat $FILENAME_COVERAGE_JSON | jq .line_covered)
+	COVERAGE_LINE_TOTAL=$(cat $FILENAME_COVERAGE_JSON | jq .line_total)
+	COVERAGE_LINE_PERCENT=$(cat $FILENAME_COVERAGE_JSON | jq .line_percent)
+
+	COVERAGE_LINE_COVERED="${COVERAGE_LINE_COVERED:-0}"
+	COVERAGE_LINE_TOTAL="${COVERAGE_LINE_TOTAL:-0}"
+	COVERAGE_LINE_PERCENT="${COVERAGE_LINE_PERCENT:-0}"
+
+	# Default values
+
+	DEFINITELY_LOST="${DEFINITELY_LOST:-0}"
+	POSSIBLY_LOST="${POSSIBLY_LOST:-0}"
+	ping_loss_percent_1_to_2="${ping_loss_percent_1_to_2:-100.0}"
+	ping_loss_percent_2_to_1="${ping_loss_percent_2_to_1:-100.0}"
+	time_to_both_nodes_online="${time_to_both_nodes_online:--1}"
+
+	# Summarize and emit json for trend reporting
+
+	FILENAME_SUMMARY="$TEST_FILEPATH_PREFIX-summary.json"
+
+	time_length_test=$((time_test_end - time_test_start))
+	if [[ $time_to_both_nodes_online != -1 ]];
+	then
+		time_to_both_nodes_online=$((time_to_both_nodes_online - time_test_start))
+	fi
+	#time_length_zt_join=$((time_zt_join_end-time_zt_join_start))
+	#time_length_zt_leave=$((time_zt_leave_end-time_zt_leave_start))
+	#time_length_zt_can_still_ping=$((time_zt_can_still_ping-time_zt_leave_start))
+
+	summary=$(
+		cat <<EOF
+{
+  "version":"$ZTO_VER",
+  "commit":"$ZTO_COMMIT",
+  "arch_m":"$(uname -m)",
+  "arch_a":"$(uname -a)",
+  "binary_size":"$(stat -c %s zerotier-one)",
+  "time_length_test":$time_length_test,
+  "time_to_both_nodes_online":$time_to_both_nodes_online,
+  "num_possible_bytes_lost": $POSSIBLY_LOST,
+  "num_definite_bytes_lost": $DEFINITELY_LOST,
+  "num_bad_formattings": $POSSIBLY_LOST,
+  "coverage_lines_covered": $COVERAGE_LINE_COVERED,
+  "coverage_lines_total": $COVERAGE_LINE_TOTAL,
+  "coverage_lines_percent": $COVERAGE_LINE_PERCENT,
+  "ping_loss_percent_1_to_2": $ping_loss_percent_1_to_2,
+  "ping_loss_percent_2_to_1": $ping_loss_percent_2_to_1,
+  "test_exit_code": $1,
+  "test_exit_reason":"$2"
+}
+EOF
+	)
+
+	echo $summary >$FILENAME_SUMMARY
+	cat $FILENAME_SUMMARY
+
+	exit 0
+}
+
+################################################################################
+# CLI Check                                                                    #
+################################################################################
+
+spam_cli() {
+	echo "Spamming CLI..."
+	# Rapidly spam the CLI with joins/leaves
+
+	MAX_TRIES="${1:-10}"
+
+	for ((s = 0; s <= MAX_TRIES; s++)); do
+		$ZT1 status
+		$ZT2 status
+		sleep 0.1
+	done
+
+	SPAM_TRIES=128
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 join $TEST_NETWORK
+	done
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 leave $TEST_NETWORK
+	done
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 leave $TEST_NETWORK
+		$ZT1 join $TEST_NETWORK
+	done
+}
+
+################################################################################
+# Check for proper exit on load of invalid identity                            #
+################################################################################
+
+check_exit_on_invalid_identity() {
+	echo "Checking ZeroTier exits on invalid identity..."
+	mkdir -p $(pwd)/exit_test
+	ZT1="sudo ./zerotier-one -p9999 $(pwd)/exit_test"
+	echo "asdfasdfasdfasdf" > $(pwd)/exit_test/identity.secret
+	echo "asdfasdfasdfasdf" > $(pwd)/exit_test/authtoken.secret
+
+	echo "Launch ZeroTier with an invalid identity"
+	$ZT1 &
+	my_pid=$!
+
+	echo "Waiting 5 seconds"
+	sleep 5
+
+	# check if process is running
+	kill -0 $my_pid
+	if [ $? -eq 0 ]; then
+		exit_test_and_generate_report $TEST_FAIL "Exit test FAILED: Process still running after being fed an invalid identity"
+	fi
+}
+
+################################################################################
+# Check that we're binding to the primary port for TCP/TCP6/UDP                #
+################################################################################
+
+check_bind_to_correct_ports() {
+	PORT_NUMBER=$1
+	echo "Checking bound ports:"
+	sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier"
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp/$1"
+	fi
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp6") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp6/$1"
+	fi
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "udp") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to udp/$1"
+	fi
+}
+
+test "$@"

.github/workflows/validate-report.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+################################################################################
+# Set exit code depending on tool reports                                      #
+################################################################################
+
+DEFINITELY_LOST=$(cat *test-results/*summary.json | jq .num_definite_bytes_lost)
+EXIT_CODE=$(cat *test-results/*summary.json | jq .exit_code)
+EXIT_REASON=$(cat *test-results/*summary.json | jq .exit_reason)
+
+cat *test-results/*summary.json
+
+echo -e "\nBytes of memory definitely lost: $DEFINITELY_LOST"
+
+if [[ "$DEFINITELY_LOST" -gt 0 ]]; then
+      exit 1
+fi
+
+# Catch-all for other non-zero exit codes
+
+if [[ "$EXIT_CODE" -gt 0 ]]; then
+      echo "Test failed: $EXIT_REASON"
+      exit 1
+fi

.github/workflows/validate.yml

@@ -0,0 +1,56 @@
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  build_ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+
+    - name: checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-unknown-linux-gnu
+        components: rustfmt, clippy
+
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: validate-1m-linux
+      env:
+        CC: 'gcc'
+        CXX: 'g++'
+        BRANCH: ${{  github.ref_name }}
+      run: |
+        sudo apt update && sudo apt install -y valgrind xmlstarlet gcovr iperf3 tree
+        make one ZT_COVERAGE=1 ZT_TRACE=1
+        sudo chmod +x ./.github/workflows/validate-linux.sh
+        sudo ./.github/workflows/validate-linux.sh
+
+    - name: Archive test results
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{github.sha}}-test-results
+        path: "*test-results*"
+
+    - name: final-report
+      run: |
+        sudo chmod +x ./.github/workflows/validate-report.sh
+        sudo ./.github/workflows/validate-report.sh
+

.gitignore

@@ -6,16 +6,19 @@
 /zerotier
 /nltest
 
-# IDE stuff
+# IDE and dev tool stuff
 /.idea
 /.nova
 /compile_commands.json
+/.claude
+/.aider
 
 # OS-created garbage files from various platforms
 .DS_Store
 .Apple*
 Thumbs.db
 @eaDir
+lost+found
 ._*
 
 # Windows build droppings
@@ -58,6 +61,9 @@ zt1-src.tar.gz
 /MacEthernetTapAgent
 
 # Miscellaneous temporaries, build files, etc.
+ext/installfiles/windows/*.back*.aip
+tcp-proxy/tcp-proxy
+rustybits/target
 *.log
 *.opensdf
 *.user
@@ -85,6 +91,7 @@ debian/zerotier-one*.debhelper
 debian/*.log
 debian/zerotier-one.substvars
 root-watcher/config.json
+build/
 
 # Java/Android/JNI build droppings
 java/obj/
@@ -100,8 +107,8 @@ windows/WinUI/bin/
 windows/ZeroTierOne/Debug/
 /ext/installfiles/windows/chocolatey/zerotier-one/*.nupkg
 
+
 # Miscellaneous mac/Xcode droppings
-.DS_Store
 .Trashes
 *.swp
 *~.nib
@@ -124,16 +131,23 @@ attic/world/mkworld
 workspace/
 workspace2/
 zeroidc/target/
+tcp-proxy/target
 
-#snapcraft specifics
+# Snapcraft Linux build stuff
 /parts/
 /stage/
 /prime/
-
 *.snap
-
 .snapcraft
 __pycache__
 *.pyc
 *_source.tar.bz2
-snap/.snapcraft
+snap/.snapcraft
+build/
+
+# Local dependency bootstrap output (scripts/bootstrap-deps.sh): the install
+# prefix and the build/clone scratch dir. Large + host-specific; never commit.
+.deps/
+.deps-build/
+
+.claude/*.local.*

AUTHORS.md

@@ -1,75 +0,0 @@
-# Authors and Third Party Code Licensing Information
-
-## Primary Authors
-
- * ZeroTier Core and ZeroTier One virtual networking service<br>
-   Adam Ierymenko / adam.ierymenko@zerotier.com
-   Joseph Henry / joseph.henry@zerotier.com (QoS and multipath)
-
- * Java JNI Interface to enable Android application development, and Android app itself (code for that is elsewhere)<br>
-   Grant Limberg / glimberg@gmail.com
-
- * ZeroTier SDK (formerly known as Network Containers)<br>
-   Joseph Henry / joseph.henry@zerotier.com
-
-## Third Party Contributors
-
- * A number of fixes and improvements to the new controller, other stuff.<br>
-   Kees Bos / https://github.com/keesbos/
-
- * Debugging and testing, OpenWRT support fixes.<br>
-   Moritz Warning / moritzwarning@web.de
-
- * Debian GNU/Linux packaging, manual pages, and license compliance edits.<br>
-   Ben Finney <ben+zerotier@benfinney.id.au>
-
- * Several others made smaller contributions, which GitHub tracks here:<br>
-   https://github.com/zerotier/ZeroTierOne/graphs/contributors/
-
-## Third-Party Code
-
-ZeroTier includes the following third party code, either in ext/ or incorporated into the ZeroTier core. This third party code remains licensed under its original license and is not subject to ZeroTier's BSL license.
-
- * LZ4 compression algorithm by Yann Collet
-
-   * Files: node/Packet.cpp (bundled within anonymous namespace)
-   * Home page: http://code.google.com/p/lz4/
-   * License grant: BSD 2-clause
-
- * http-parser by Joyent, Inc. (many authors)
-
-   * Files: ext/http-parser/*
-   * Home page: https://github.com/joyent/http-parser/
-   * License grant: MIT/Expat
-
- * C++11 json (nlohmann/json) by Niels Lohmann
-
-   * Files: ext/json/*
-   * Home page: https://github.com/nlohmann/json
-   * License grant: MIT
-
- * tap-windows6 by the OpenVPN project
-
-   * Files: windows/TapDriver6/*
-   * Home page: https://github.com/OpenVPN/tap-windows6/
-   * License grant: GNU GPL v2
-   * ZeroTier Modifications: change name of driver to ZeroTier, add ioctl() to get L2 multicast memberships (source is in ext/ and modifications inherit GPL)
-
- * Salsa20 stream cipher, Curve25519 elliptic curve cipher, Ed25519 digital signature algorithm, and Poly1305 MAC algorithm, all by Daniel J. Bernstein
-
-   * Files: node/Salsa20.* node/C25519.* node/Poly1305.*
-   * Home page: http://cr.yp.to/
-   * License grant: public domain
-   * ZeroTier Modifications: slight cryptographically-irrelevant modifications for inclusion into ZeroTier core
-
- * MiniUPNPC and libnatpmp by Thomas Bernard
-
-   * Files: ext/libnatpmp/* ext/miniupnpc/*
-   * Home page: http://miniupnp.free.fr/
-   * License grant: BSD attribution no-endorsement
-
- * cpp-httplib by yhirose
-
-   * Files: ext/cpp-httplib/*
-   * Home page: https://github.com/yhirose/cpp-httplib
-   * License grant: MIT

Brewfile

@@ -0,0 +1,28 @@
+# Central Controller build dependencies for macOS development.
+#
+#   brew bundle            # install the deps below
+#   ZT_CONTROLLER_DEPS=1 scripts/bootstrap-deps.sh   # build the two pinned controller deps (full OTel + google-cloud-cpp)
+#
+# The two version-sensitive C++ libraries (opentelemetry-cpp, google-cloud-cpp)
+# are NOT taken from Homebrew -- they are pinned and built from source by
+# scripts/bootstrap-deps.sh so every dev/CI machine uses the same versions
+# (the role conda previously filled). Everything below is stable enough to take
+# from Homebrew.
+
+brew "cmake"
+brew "ninja"
+brew "pkg-config"
+brew "rustup-init"      # then: rustup-init -y && rustup default stable
+
+brew "libpqxx"
+brew "libpq"           # keg-only; add $(brew --prefix libpq) to CMAKE_PREFIX_PATH so find_package(PostgreSQL) resolves
+brew "hiredis"
+brew "jemalloc"
+brew "nlohmann-json"
+brew "openssl@3"
+brew "abseil"
+brew "protobuf"
+brew "grpc"
+brew "googletest"      # google-cloud-cpp requires GTest/GMock at configure (builds its *_mocks libs)
+brew "curl"
+brew "inja"

CMakePresets.json

@@ -0,0 +1,167 @@
+{
+  "version": 3,
+  "cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "unix-base",
+      "hidden": true,
+      "generator": "Unix Makefiles",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps",
+        "CMAKE_BUILD_TYPE": "Release"
+      }
+    },
+    {
+      "name": "linux-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Linux" }
+    },
+    {
+      "name": "macos-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Darwin" },
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps;$env{HOMEBREW_PREFIX};$env{HOMEBREW_PREFIX}/opt/openssl@3;$env{HOMEBREW_PREFIX}/opt/libpq"
+      }
+    },
+
+    { "name": "linux-release",            "inherits": "linux-base", "displayName": "Linux daemon (Release)" },
+    { "name": "linux-debug",              "inherits": "linux-base", "displayName": "Linux daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-controller-release", "inherits": "linux-base", "displayName": "Linux Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "linux-controller-debug",   "inherits": "linux-base", "displayName": "Linux Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-free-release",       "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "linux-free-debug",         "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "macos-release",            "inherits": "macos-base", "displayName": "macOS daemon (Release)" },
+    { "name": "macos-debug",              "inherits": "macos-base", "displayName": "macOS daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-controller-release", "inherits": "macos-base", "displayName": "macOS Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "macos-controller-debug",   "inherits": "macos-base", "displayName": "macOS Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-free-release",       "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "macos-free-debug",         "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-universal-release",  "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Release)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64" } },
+    { "name": "macos-universal-debug",    "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Debug)",   "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "freebsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "FreeBSD" }
+    },
+    {
+      "name": "openbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "OpenBSD" }
+    },
+    {
+      "name": "netbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "NetBSD" }
+    },
+
+    { "name": "freebsd-release",          "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Release)" },
+    { "name": "freebsd-debug",            "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "freebsd-free-release",     "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "freebsd-free-debug",       "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "openbsd-release",          "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Release)" },
+    { "name": "openbsd-debug",            "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "openbsd-free-release",     "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "openbsd-free-debug",       "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "netbsd-release",           "inherits": "netbsd-base", "displayName": "NetBSD daemon (Release)" },
+    { "name": "netbsd-debug",             "inherits": "netbsd-base", "displayName": "NetBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "netbsd-free-release",      "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "netbsd-free-debug",        "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "windows-x64",
+      "displayName": "Windows x64 daemon (MSVC + vcpkg)",
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" },
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static",
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/x64"
+      }
+    },
+    {
+      "name": "windows-arm64",
+      "inherits": "windows-x64",
+      "displayName": "Windows ARM64 daemon (MSVC + vcpkg)",
+      "architecture": "ARM64",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "arm64-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/ARM64" }
+    },
+    {
+      "name": "windows-x86",
+      "inherits": "windows-x64",
+      "displayName": "Windows x86 daemon (MSVC + vcpkg)",
+      "architecture": "Win32",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "x86-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/Win32" }
+    },
+    {
+      "name": "windows-x64-free",
+      "inherits": "windows-x64",
+      "displayName": "Windows x64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-arm64-free",
+      "inherits": "windows-arm64",
+      "displayName": "Windows ARM64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-x86-free",
+      "inherits": "windows-x86",
+      "displayName": "Windows x86 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    }
+  ],
+  "buildPresets": [
+    { "name": "linux-release",            "configurePreset": "linux-release" },
+    { "name": "linux-debug",              "configurePreset": "linux-debug" },
+    { "name": "linux-controller-release", "configurePreset": "linux-controller-release" },
+    { "name": "linux-controller-debug",   "configurePreset": "linux-controller-debug" },
+    { "name": "linux-free-release",       "configurePreset": "linux-free-release" },
+    { "name": "linux-free-debug",         "configurePreset": "linux-free-debug" },
+    { "name": "macos-release",            "configurePreset": "macos-release" },
+    { "name": "macos-debug",              "configurePreset": "macos-debug" },
+    { "name": "macos-controller-release", "configurePreset": "macos-controller-release" },
+    { "name": "macos-controller-debug",   "configurePreset": "macos-controller-debug" },
+    { "name": "macos-free-release",       "configurePreset": "macos-free-release" },
+    { "name": "macos-free-debug",         "configurePreset": "macos-free-debug" },
+    { "name": "macos-universal-release",  "configurePreset": "macos-universal-release" },
+    { "name": "macos-universal-debug",    "configurePreset": "macos-universal-debug" },
+    { "name": "freebsd-release",          "configurePreset": "freebsd-release" },
+    { "name": "freebsd-debug",            "configurePreset": "freebsd-debug" },
+    { "name": "freebsd-free-release",     "configurePreset": "freebsd-free-release" },
+    { "name": "freebsd-free-debug",       "configurePreset": "freebsd-free-debug" },
+    { "name": "openbsd-release",          "configurePreset": "openbsd-release" },
+    { "name": "openbsd-debug",            "configurePreset": "openbsd-debug" },
+    { "name": "openbsd-free-release",     "configurePreset": "openbsd-free-release" },
+    { "name": "openbsd-free-debug",       "configurePreset": "openbsd-free-debug" },
+    { "name": "netbsd-release",           "configurePreset": "netbsd-release" },
+    { "name": "netbsd-debug",             "configurePreset": "netbsd-debug" },
+    { "name": "netbsd-free-release",      "configurePreset": "netbsd-free-release" },
+    { "name": "netbsd-free-debug",        "configurePreset": "netbsd-free-debug" },
+    { "name": "windows-x64-release",        "configurePreset": "windows-x64",        "configuration": "Release" },
+    { "name": "windows-x64-debug",          "configurePreset": "windows-x64",        "configuration": "Debug" },
+    { "name": "windows-arm64-release",      "configurePreset": "windows-arm64",      "configuration": "Release" },
+    { "name": "windows-arm64-debug",        "configurePreset": "windows-arm64",      "configuration": "Debug" },
+    { "name": "windows-x86-release",        "configurePreset": "windows-x86",        "configuration": "Release" },
+    { "name": "windows-x86-debug",          "configurePreset": "windows-x86",        "configuration": "Debug" },
+    { "name": "windows-x64-free-release",   "configurePreset": "windows-x64-free",   "configuration": "Release" },
+    { "name": "windows-x64-free-debug",     "configurePreset": "windows-x64-free",   "configuration": "Debug" },
+    { "name": "windows-arm64-free-release", "configurePreset": "windows-arm64-free", "configuration": "Release" },
+    { "name": "windows-arm64-free-debug",   "configurePreset": "windows-arm64-free", "configuration": "Debug" },
+    { "name": "windows-x86-free-release",   "configurePreset": "windows-x86-free",   "configuration": "Release" },
+    { "name": "windows-x86-free-debug",     "configurePreset": "windows-x86-free",   "configuration": "Debug" }
+  ]
+}

COPYING

@@ -1,12 +0,0 @@
-ZeroTier One, an endpoint server for the ZeroTier virtual network layer.
-Copyright © 2011–2019 ZeroTier, Inc.
-
-ZeroTier is released under the terms of the BSL version 1.1. See the
-file LICENSE.txt for details.
-
-..
-    Local variables:
-    coding: utf-8
-    mode: text
-    End:
-    vim: fileencoding=utf-8 filetype=text :

Dockerfile.release

@@ -1,22 +1,17 @@
 # vim: ft=dockerfile
 
-FROM debian:buster as stage
+FROM debian:bookworm
 
-ARG PACKAGE_BASEURL=https://download.zerotier.com/debian/buster/pool/main/z/zerotier-one/
-ARG ARCH=amd64
 ARG VERSION
 
-RUN apt-get update -qq && apt-get install curl -y
-RUN curl -sSL -o zerotier-one.deb "${PACKAGE_BASEURL}/zerotier-one_${VERSION}_${ARCH}.deb"
+RUN apt-get update -qq && apt-get install curl gpg -y
+RUN mkdir -p /usr/share/zerotier && \
+    curl -o /usr/share/zerotier/tmp.asc "https://download.zerotier.com/contact%40zerotier.com.gpg" && \
+    gpg --no-default-keyring --keyring /usr/share/zerotier/zerotier.gpg --import /usr/share/zerotier/tmp.asc && \
+    rm -f /usr/share/zerotier/tmp.asc && \
+    echo "deb [signed-by=/usr/share/zerotier/zerotier.gpg] http://download.zerotier.com/debian/bookworm bookworm main" > /etc/apt/sources.list.d/zerotier.list
 
-FROM debian:buster
-
-RUN apt-get update -qq && apt-get install openssl libssl1.1 -y
-
-COPY --from=stage zerotier-one.deb .
-
-RUN dpkg -i zerotier-one.deb && rm -f zerotier-one.deb
-RUN echo "${VERSION}" >/etc/zerotier-version
+RUN apt-get update -qq && apt-get install zerotier-one=${VERSION} curl iproute2 net-tools iputils-ping openssl libssl3 -y
 RUN rm -rf /var/lib/zerotier-one
 
 COPY entrypoint.sh.release /entrypoint.sh

Jenkinsfile

@@ -1,365 +0,0 @@
-pipeline {
-    options {
-        disableConcurrentBuilds()
-        preserveStashes(buildCount: 10)
-        timestamps()
-    }
-    parameters {
-        booleanParam(name: "BUILD_ALL", defaultValue: false, description: "Build all supported platform/architecture combos.  Defaults to x86/x64 only")
-    }
-    
-    agent none
-    
-    stages {
-        stage ("Build") {
-            steps {
-                script {
-                    def tasks = [:]
-                    tasks << buildStaticBinaries()
-                    tasks << buildDebianNative()
-                    tasks << buildCentosNative()
-                    
-                    parallel tasks
-                }
-            }
-        }
-        stage ("Package Static") {
-            steps {
-                script {
-                    parallel packageStatic()
-                }
-            }
-        }
-    }
-}
-
-def buildStaticBinaries() {
-    def tasks = [:]
-    def dist = ["alpine"]
-    def archs = []
-    if (params.BUILD_ALL == true) {
-        archs = ["arm64", "amd64", "i386", "armhf", "armel", "ppc64le", "s390x"]
-    } else {
-        archs = ["amd64", "i386"]
-    }
-
-    tasks << getTasks(dist, archs, { distro, platform -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                sh "echo ${distro}-${platform}"
-                def runtime = docker.image("ztbuild/${distro}-${platform}:latest")
-                runtime.inside {
-                    dir("build") {
-                        sh 'make -j8 ZT_STATIC=1 all'
-                        sh "file ./zerotier-one"
-                        sh "mv zerotier-one zerotier-one-static-${platform}"
-                        stash includes: 'zerotier-one-static-*', name: "static-${platform}"
-                    }
-                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-                }
-            }
-        }
-        return myNode
-    })
-    
-    return tasks
-}
-
-def getTasks(axisDistro, axisPlatform, task) {
-    def tasks = [:]
-    for(int i=0; i< axisDistro.size(); i++) {
-        def axisDistroValue = axisDistro[i]
-        for(int j=0; j< axisPlatform.size(); j++) {
-            def axisPlatformValue = axisPlatform[j]
-            tasks["${axisDistroValue}/${axisPlatformValue}"] = task(axisDistroValue, axisPlatformValue)
-        }
-    }
-    return tasks
-}
-
-def packageStatic() {
-    def tasks = [:]
-    
-    def centos6 = ["centos6"]
-    def centos6Arch = ["i386", "amd64"]
-    tasks << getTasks(centos6, centos6Arch, { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    dir("build") {
-                        unstash "static-${arch}"
-                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
-                        sh "make redhat"
-                        sh "mkdir -p ${distro}"
-                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
-                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
-                    }
-                }
-                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-            }
-        }
-        return myNode
-    })
-    
-    def centos7 = ["centos7"]
-    def centos7Arch = ["i386"]
-    tasks << getTasks(centos7, centos7Arch, { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    dir("build") {
-                        unstash "static-${arch}"
-                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
-                        sh "make redhat"
-                        sh "mkdir -p ${distro}"
-                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
-                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
-                    }
-                }
-                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-            }
-        }
-        return myNode
-    })
-    
-    if (params.BUILD_ALL == true) {
-        def clefos7 = ["clefos"]
-        def clefos7Arch = ["s390x"]
-        tasks << getTasks(clefos7, clefos7Arch, { distro, arch -> 
-            def myNode = {
-                node ('linux-build') {
-                    dir ("build") {
-                        checkout scm
-                    }
-                    def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                    runtime.inside {
-                        dir("build/") {
-                            unstash "static-${arch}"
-                            sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
-                            sh "make redhat"
-                            sh "mkdir -p ${distro}"
-                            sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
-                            archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
-                        }
-                    }
-                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-                }
-            }
-            return myNode
-        })
-    }
-
-    def debianJessie = ["debian-jessie"]
-    def debianJessieArchs = []
-    if (params.BUILD_ALL == true) {
-        debianJessieArch = ["armhf", "armel", "amd64", "i386"]
-    } else {
-        debianJessieArch = ["amd64", "i386"]
-    }
-    tasks << getTasks(debianJessie, debianJessieArch, { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    sh "ls -la ."
-                    dir('build/') {
-                        sh "ls -la ."
-                        unstash "static-${arch}"
-                        sh "pwd"
-                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
-                        sh "mv -f debian/rules.static debian/rules"
-                        sh "make debian"
-                    }
-                    sh "mkdir -p ${distro}"
-                    sh "mv *.deb ${distro}"
-                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
-                }
-                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-            }
-        }
-        return myNode
-    })
-    
-    def ubuntuTrusty = ["ubuntu-trusty"]
-    def ubuntuTrustyArch = []
-    if (params.BUILD_ALL == true) {
-        ubuntuTrustyArch = ["i386", "amd64", "armhf", "arm64", "ppc64le"]
-    } else {
-        ubuntuTrustyArch = ["i386", "amd64"]
-    }
-    tasks << getTasks(ubuntuTrusty, ubuntuTrustyArch, { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    sh "ls -la ."
-                    dir('build/') {
-                        sh "ls -la ."
-                        unstash "static-${arch}"
-                        sh "pwd"
-                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
-                        sh "mv -f debian/rules.static debian/rules"
-                        sh "make debian"
-                    }
-                    sh "mkdir -p ${distro}"
-                    sh "mv *.deb ${distro}"
-                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
-                }
-                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-            }
-        }
-        return myNode
-    })
-    
-    def debianWheezy = ["debian-wheezy"]
-    def debianWheezyArchs = []
-    if (params.BUILD_ALL == true) {
-        debianWheezyArchs = ["armhf", "armel", "amd64", "i386"]
-    } else {
-        debianWheezyArchs = ["amd64", "i386"]
-    }
-    tasks << getTasks(debianJessie, debianJessieArch, { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    dir('build/') {
-                        unstash "static-${arch}"
-                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
-                        sh "mv -f debian/rules.wheezy.static debian/rules"
-                        sh "mv -f debian/control.wheezy debian/control"
-                        sh "make debian"
-                    }
-                    sh "mkdir -p ${distro}"
-                    sh "mv *.deb ${distro}"
-                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
-                }
-                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-            }
-        }
-        return myNode
-    })
-    
-    return tasks
-}
-
-def buildDebianNative() {
-    def tasks = [:]
-    def buster = ["debian-buster", "debian-stretch", "debian-bullseye", "debian-sid"]
-    def busterArchs = []
-    if (params.BUILD_ALL) {
-        busterArchs = ["s390x", "ppc64le", "i386", "armhf", "armel", "arm64", "amd64"]
-    } else {
-        busterArchs = ["amd64", "i386"]
-    }
-    
-    def build = { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    dir("build") {
-                        sh 'make debian'
-                    }
-                    sh "mkdir -p ${distro}"
-                    sh "mv *.deb ${distro}"
-                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
-                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-                }
-            }
-        }
-        return myNode
-    }
-    
-    tasks << getTasks(buster, busterArchs, build)
-    
-    // bash is broken when running under QEMU-s390x on Xenial
-    def xenial = ["ubuntu-xenial"]
-    def xenialArchs = []
-    if (params.BUILD_ALL == true) {
-        xenialArchs = ["i386", "amd64", "armhf", "arm64", "ppc64le"]
-    } else {
-        xenialArchs = ["i386", "amd64"]
-    }
-    tasks << getTasks(xenial, xenialArchs, build)
-    
-    def ubuntu = ["ubuntu-bionic", "ubuntu-eoan"]
-    def ubuntuArchs = []
-    if (params.BUILD_ALL == true) {
-        ubuntuArchs = ["i386", "amd64", "armhf", "arm64", "ppc64le", "s390x"]
-    } else {
-        ubuntuArchs = ["i386", "amd64"]
-    }
-    tasks << getTasks(ubuntu, ubuntuArchs, build)
-    
-    def kali = ["kali-rolling"]
-    def kaliArchs = ["amd64"]
-    tasks << getTasks(kali, kaliArchs, build)
-    
-    return tasks
-}
-
-def buildCentosNative() {
-    def tasks = [:]
-    
-    def build = { distro, arch -> 
-        def myNode = {
-            node ('linux-build') {
-                dir ("build") {
-                    checkout scm
-                }
-                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
-                runtime.inside {
-                    dir("build") {
-                        sh 'make -j4'
-                        sh 'make redhat'
-                        sh "mkdir -p ${distro}"
-                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
-                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
-                    }
-                    
-                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
-                }
-            }
-        }
-        return myNode
-    }
-    
-    def centos8 = ["centos8"]
-    def centos8Archs = []
-    if (params.BUILD_ALL == true) {
-        centos8Archs = ["amd64", "arm64", "ppc64le"]
-    } else {
-        centos8Archs = ["amd64"]
-    }
-    tasks << getTasks(centos8, centos8Archs, build)
-    
-    def centos7 = ["centos7"]
-    def centos7Archs = ["amd64"]
-    tasks << getTasks(centos7, centos7Archs, build)
-    
-    return tasks
-}

LICENSE.txt

@@ -1,149 +1,5 @@
------------------------------------------------------------------------------
+See LICENSE-MPL.txt for all code in node/, osdep/. service/, and everywhere else except ext/ and nonfree/.
 
-Business Source License 1.1
+See nonfree/LICENSE.md for all non-free ("source available") portions of this repository.
 
-License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
-"Business Source License" is a trademark of MariaDB Corporation Ab.
-
------------------------------------------------------------------------------
-
-Parameters
-
-Licensor:             ZeroTier, Inc.
-Licensed Work:        ZeroTier Network Virtualization Engine 1.4.4
-                      The Licensed Work is (c)2019 ZeroTier, Inc.
-Additional Use Grant: You may make use of the Licensed Work, provided you
-                      do not use it in any of the following ways:
-
-                      * Sell hosted ZeroTier services as a "SaaS" Product
-
-                      (1) Operate or sell access to ZeroTier root servers,
-                      network controllers, or authorization key or certificate
-                      generation components of the Licensed Work as a
-                      for-profit service, regardless of whether the use of
-                      these components is sold alone or is bundled with other
-                      services. Note that this does not apply to the use of
-                      ZeroTier behind the scenes to operate a service not
-                      related to ZeroTier network administration.
-
-                      * Create Non-Open-Source Commercial Derviative Works
-
-                      (2) Link or directly include the Licensed Work in a
-                      commercial or for-profit application or other product
-                      not distributed under an Open Source Initiative (OSI)
-                      compliant license. See: https://opensource.org/licenses
-
-                      (3) Remove the name, logo, copyright, or other branding
-                      material from the Licensed Work to create a "rebranded"
-                      or "white labeled" version to distribute as part of
-                      any commercial or for-profit product or service.
-
-                      * Certain Government Uses
-
-                      (4) Use or deploy the Licensed Work in a government
-                      setting in support of any active government function
-                      or operation with the exception of the following:
-                      physical or mental health care, family and social
-                      services, social welfare, senior care, child care, and
-                      the care of persons with disabilities.
-
-Change Date:          2025-01-01
-
-Change License:       Apache License version 2.0 as published by the Apache
-                      Software Foundation
-											https://www.apache.org/licenses/
-
-Alternative Licensing
-
-If you would like to use the Licensed Work in any way that conflicts with
-the stipulations of the Additional Use Grant, contact ZeroTier, Inc. to
-obtain an alternative commercial license.
-
-Visit us on the web at: https://www.zerotier.com/
-
-Notice
-
-The Business Source License (this document, or the "License") is not an Open
-Source license. However, the Licensed Work will eventually be made available
-under an Open Source License, as stated in this License.
-
-For more information on the use of the Business Source License for ZeroTier
-products, please visit our pricing page which contains license details and
-and license FAQ: https://zerotier.com/pricing
-
-For more information on the use of the Business Source License generally,
-please visit the Adopting and Developing Business Source License FAQ at
-https://mariadb.com/bsl-faq-adopting.
-
------------------------------------------------------------------------------
-
-Business Source License 1.1
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative
-works, redistribute, and make non-production use of the Licensed Work. The
-Licensor may make an Additional Use Grant, above, permitting limited
-production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly
-available distribution of a specific version of the Licensed Work under this
-License, whichever comes first, the Licensor hereby grants you rights under
-the terms of the Change License, and the rights granted in the paragraph
-above terminate.
-
-If your use of the Licensed Work does not comply with the requirements
-currently in effect as described in this License, you must purchase a
-commercial license from the Licensor, its affiliated entities, or authorized
-resellers, or you must refrain from using the Licensed Work.
-
-All copies of the original and modified Licensed Work, and derivative works
-of the Licensed Work, are subject to this License. This License applies
-separately for each version of the Licensed Work and the Change Date may vary
-for each version of the Licensed Work released by Licensor.
-
-You must conspicuously display this License on each original or modified copy
-of the Licensed Work. If you receive the Licensed Work in original or
-modified form from a third party, the terms and conditions set forth in this
-License apply to your use of that work.
-
-Any use of the Licensed Work in violation of this License will automatically
-terminate your rights under this License for the current and all other
-versions of the Licensed Work.
-
-This License does not grant you any right in any trademark or logo of
-Licensor or its affiliates (provided that you may use a trademark or logo of
-Licensor as expressly required by this License).
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
-AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
-EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
-TITLE.
-
------------------------------------------------------------------------------
-
-MariaDB hereby grants you permission to use this License’s text to license
-your works, and to refer to it using the trademark "Business Source License",
-as long as you comply with the Covenants of Licensor below.
-
-Covenants of Licensor
-
-In consideration of the right to use this License’s text and the "Business
-Source License" name and trademark, Licensor covenants to MariaDB, and to all
-other recipients of the licensed work to be provided by Licensor:
-
-1. To specify as the Change License the GPL Version 2.0 or any later version,
-   or a license that is compatible with GPL Version 2.0 or a later version,
-   where "compatible" means that software provided under the Change License can
-   be included in a program with software provided under GPL Version 2.0 or a
-   later version. Licensor may specify additional Change Licenses without
-   limitation.
-
-2. To either: (a) specify an additional grant of rights to use that does not
-   impose any additional restriction on the right granted in this License, as
-   the Additional Use Grant; or (b) insert the text "None".
-
-3. To specify a Change Date.
-
-4. Not to modify this License in any other way.
+Code in ext/ is external code included for build convenience or backward compatibility and retains its original license.