April 2026 - Freeradius-Users - lists.freeradius.org

v4 - linelog taking 1 second to write to local file
by James Wood 04 Apr '26

04 Apr '26

Hi, I have the following config in radiusd.conf: log { destination = file file = ${logdir}/radius.log } When configured with destination = file, it's taking 1 second to write to the file exactly for any linelog configured output. If I change it to syslog instead of file, it's instant. This results in a one-second delay in the reply back to the client. Here is the verbose log output: 2026-04-02T21:31:26.150850Z: (0) [4] unlang_module - linelog (log_auth_access_accept) 2026-04-02T21:31:26.150900Z: (0) ** [5] frame_eval << pushed-child (noop not-set) 2026-04-02T21:31:26.150942Z: (0) ** [5] unlang_interpret - frame action next 2026-04-02T21:31:26.151011Z: (0) ** [5] frame_eval >> function 2026-04-02T21:31:26.151055Z: (0) Calling function 0x7f65be0b9924 (call_env_expand_start) 2026-04-02T21:31:26.151154Z: (0) Calling repeat function 0x7f65be0ba182 (call_env_expand_repeat) 2026-04-02T21:31:26.151239Z: (0) ** [5] frame_eval << calculate-result (... not-set) 2026-04-02T21:31:26.151255Z: (0) ** [5] result_calculate - skipping frame, no result set 2026-04-02T21:31:26.151323Z: (0) ** [5] frame_eval - done current subsection with (noop not-set), will NOT set higher frame rcode (p_result) 2026-04-02T21:31:26.151379Z: (0) ** [5] unlang_interpret - frame action pop 2026-04-02T21:31:26.151393Z: (0) ** [5] unlang_interpret - frame popped 2026-04-02T21:31:26.151441Z: (0) ** [4] unlang_interpret - frame action next 2026-04-02T21:31:26.151486Z: (0) ** [4] frame_eval >> module 2026-04-02T21:31:26.151559Z: (0) [4] unlang_module - linelog (log_auth_access_accept) 2026-04-02T21:31:26.151581Z: (0) log_auth_access_accept - Using default message 2026-04-02T21:31:26.151656Z: (0) log_auth_access_accept - ** [5] frame_eval << pushed-child (noop not-set) 2026-04-02T21:31:26.151867Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame action next 2026-04-02T21:31:26.151915Z: (0) log_auth_access_accept - ** [5] frame_eval >> tmpl 2026-04-02T21:31:26.151964Z: (0) log_auth_access_accept - ** [5] frame_eval << calculate-result (ok not-set) 2026-04-02T21:31:26.152036Z: (0) log_auth_access_accept - ** [5] result_calculate - have (... not-set) frame or module returned (ok not-set) 2026-04-02T21:31:26.152082Z: (0) log_auth_access_accept - ** [5] result_calculate - using default instruction priority for ok, not-set 2026-04-02T21:31:26.152156Z: (0) log_auth_access_accept - ** [5] result_calculate - overwriting existing result (... not-set) with higher priority (ok not-set) 2026-04-02T21:31:26.152174Z: (0) log_auth_access_accept - ** [5] frame_eval - done current subsection with (ok not-set), will set higher frame rcode 2026-04-02T21:31:26.152271Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame action pop 2026-04-02T21:31:26.152289Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame popped 2026-04-02T21:31:26.152325Z: (0) log_auth_access_accept - ** [4] result_pop - using instruction priority for higher frame (ok, 3) 2026-04-02T21:31:26.152399Z: (0) log_auth_access_accept - ** [4] result_calculate - have (ok 3) frame or module returned (ok 3) 2026-04-02T21:31:26.152444Z: (0) log_auth_access_accept - Setting request->rcode to 'ok' 2026-04-02T21:31:26.152459Z: (0) log_auth_access_accept - ** [4] result_calculate - overwriting existing result (ok 3) with higher priority (ok 3) 2026-04-02T21:31:26.152534Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action next 2026-04-02T21:31:26.152553Z: (0) log_auth_access_accept - ** [4] frame_eval >> module 2026-04-02T21:31:26.152711Z: (0) log_auth_access_accept - ** [4] frame_eval << yield (noop not-set) 2026-04-02T21:31:26.152851Z: (0) log_auth_access_accept - ** [4] frame_eval - yielding with current (noop not-set) 2026-04-02T21:31:26.152983Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action yield 2026-04-02T21:31:26.153089Z: (0) log_auth_access_accept - ** [4] unlang_interpret - interpret yielding 2026-04-02T21:31:26.153136Z: (0) log_auth_access_accept - _worker_request_yield - Request yielded 2026-04-02T21:31:27.155378Z: (0) log_auth_access_accept - Interpreter - Request marked as runnable 2026-04-02T21:31:27.155422Z: (0) log_auth_access_accept - _worker_request_runnable - Request marked as runnable 2026-04-02T21:31:27.155484Z: (0) log_auth_access_accept - ** [4] unlang_interpret - interpret entered 2026-04-02T21:31:27.155494Z: (0) log_auth_access_accept - _worker_request_resume - Request resuming 2026-04-02T21:31:27.155503Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action next 2026-04-02T21:31:27.155514Z: (0) log_auth_access_accept - log_auth_access_accept - Resuming execution 2026-04-02T21:31:27.155523Z: (0) log_auth_access_accept - ** [4] frame_eval >> module 2026-04-02T21:31:27.155536Z: (0) log_auth_access_accept - log_auth_access_accept (noop) 2026-04-02T21:31:27.155544Z: (0) ** [4] frame_eval << next (noop not-set) 2026-04-02T21:31:27.155556Z: (0) ** [4] frame_eval - done current subsection with (ok 3), will set higher frame rcode 2026-04-02T21:31:27.155564Z: (0) ** [4] unlang_interpret - frame action pop 2026-04-02T21:31:27.155571Z: (0) ** [4] unlang_interpret - frame popped 2026-04-02T21:31:27.155580Z: (0) ** [3] result_pop - using instruction priority for higher frame (ok, not-set) 2026-04-02T21:31:27.155589Z: (0) ** [3] result_calculate - have (noop not-set) frame or module returned (ok not-set) 2026-04-02T21:31:27.155597Z: (0) ** [3] result_calculate - using default instruction priority for ok, not-set 2026-04-02T21:31:27.155606Z: (0) ** [3] result_calculate - overwriting existing result (noop not-set) with higher priority (ok not-set) 2026-04-02T21:31:27.155621Z: (0) } # send Access-Accept ((ok)) 2026-04-02T21:31:27.155629Z: (0) ** [3] unlang_interpret - done current subsection with (... not-set) 2026-04-02T21:31:27.155636Z: (0) ** [3] unlang_interpret - frame action pop 2026-04-02T21:31:27.155643Z: (0) ** [3] unlang_interpret - frame popped 2026-04-02T21:31:27.155650Z: (0) ** [2] unlang_interpret - frame action next 2026-04-02T21:31:27.155658Z: (0) ** [2] frame_eval >> module 2026-04-02T21:31:27.155674Z: (0) Entered state resume_access_accept 2026-04-02T21:31:27.155685Z: (0) request_data_reference: No request data found at 0x5608d64308d0:0 2026-04-02T21:31:27.155693Z: (0) Adding Proxy-State attributes from request 2026-04-02T21:31:27.155703Z: (0) default (noop) 2026-04-02T21:31:27.155710Z: (0) ** [2] frame_eval << calculate-result (noop not-set) 2026-04-02T21:31:27.155718Z: (0) ** [2] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155727Z: (0) Setting request->rcode to 'noop' 2026-04-02T21:31:27.155734Z: (0) ** [2] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155742Z: (0) ** [2] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155751Z: (0) ** [2] frame_eval - done current subsection with (noop not-set), will set higher frame rcode 2026-04-02T21:31:27.155759Z: (0) ** [2] unlang_interpret - frame action pop 2026-04-02T21:31:27.155766Z: (0) ** [2] unlang_interpret - frame popped 2026-04-02T21:31:27.155774Z: (0) ** [1] result_pop - using instruction priority for higher frame (noop, not-set) 2026-04-02T21:31:27.155782Z: (0) ** [1] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155790Z: (0) ** [1] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155798Z: (0) ** [1] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155806Z: (0) ** [1] unlang_interpret - frame action next 2026-04-02T21:31:27.155815Z: (0) ** [1] frame_eval >> call 2026-04-02T21:31:27.155822Z: (0) ** [1] frame_eval << calculate-result (... not-set) 2026-04-02T21:31:27.155830Z: (0) ** [1] result_calculate - skipping frame, no result set 2026-04-02T21:31:27.155837Z: (0) } # default (noop) 2026-04-02T21:31:27.155844Z: (0) ** [1] frame_eval - done current subsection with (noop not-set), will set higher frame rcode 2026-04-02T21:31:27.155852Z: (0) ** [1] unlang_interpret - frame action pop 2026-04-02T21:31:27.155859Z: (0) ** [1] unlang_interpret - frame popped 2026-04-02T21:31:27.155866Z: (0) ** [0] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155874Z: (0) ** [0] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155882Z: (0) ** [0] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155891Z: (0) ** [0] unlang_interpret - interpret exiting, returning (noop) 2026-04-02T21:31:27.155914Z: (0) Done request 2026-04-02T21:31:27.155920Z: (0) Time tracking ended 2026-04-02T21:31:27.155974Z: stk: Currently in fr_radius_encode_pair 2026-04-02T21:31:27.156041Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156050Z: stk: 2026-04-02T21:31:27.156056Z: stk: Currently in encode_rfc 2026-04-02T21:31:27.156061Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156069Z: stk: 2026-04-02T21:31:27.156074Z: stk: Currently in encode_child 2026-04-02T21:31:27.156079Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156086Z: stk: 2026-04-02T21:31:27.156091Z: stk: Currently in encode_value 2026-04-02T21:31:27.156096Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156104Z: stk: 2026-04-02T21:31:27.156115Z: hex: -- value uint32 -- 2026-04-02T21:31:27.156123Z: hex: 0000: 00 00 00 f0 2026-04-02T21:31:27.156131Z: hex: -- header rfc -- 2026-04-02T21:31:27.156137Z: hex: 0000: 55 06 2026-04-02T21:31:27.156143Z: stk: Currently in fr_radius_encode_pair 2026-04-02T21:31:27.156148Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156155Z: stk: 2026-04-02T21:31:27.156160Z: stk: Currently in encode_rfc 2026-04-02T21:31:27.156166Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156172Z: stk: 2026-04-02T21:31:27.156177Z: stk: Currently in encode_child 2026-04-02T21:31:27.156182Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156189Z: stk: 2026-04-02T21:31:27.156200Z: stk: Currently in encode_value 2026-04-02T21:31:27.156205Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156212Z: stk: 2026-04-02T21:31:27.156217Z: hex: -- value string -- 2026-04-02T21:31:27.156224Z: hex: 0000: 6d 61 63 61 75 74 68 40 34 41 2d 39 42 2d 44 42 2026-04-02T21:31:27.156231Z: hex: 0010: 2d 37 36 2d 44 36 2d 35 33 2026-04-02T21:31:27.156238Z: hex: -- header rfc -- 2026-04-02T21:31:27.156243Z: hex: 0000: 01 1b 2026-04-02T21:31:27.156249Z: hex: -- fr_radius_encode encoded packet -- 2026-04-02T21:31:27.156256Z: hex: 0000: 02 94 00 47 19 d6 f5 64 9e 8d 68 bf d1 e9 f5 3b 2026-04-02T21:31:27.156264Z: hex: 0010: b5 ed df 2c 50 12 00 00 00 00 00 00 00 00 00 00 2026-04-02T21:31:27.156272Z: hex: 0020: 00 00 00 00 00 00 55 06 00 00 00 f0 01 1b 6d 61 2026-04-02T21:31:27.156280Z: hex: 0030: 63 61 75 74 68 40 34 41 2d 39 42 2d 44 42 2d 37 2026-04-02T21:31:27.156286Z: hex: 0040: 36 2d 44 36 2d 35 33 2026-04-02T21:31:27.156477Z: (0) Sending Access-Accept ID 148 from 0.0.0.0/0:1812 to 127.0.0.1:33797 length 71 via socket radius_udp server * port 1812 2026-04-02T21:31:27.156509Z: (0) Acct-Interim-Interval = 240 2026-04-02T21:31:27.156499Z: (0) Packet-Type = Access-Accept 2026-04-02T21:31:27.156531Z: (0) Finished request 2026-04-02T21:31:27.156547Z: (0) Request deinitialising (0x5608d7a25220) In particular, you can see the exact one-second gap: 2026-04-02T21:31:26.153136Z: (0) log_auth_access_accept - _worker_request_yield - Request yielded 2026-04-02T21:31:27.155378Z: (0) log_auth_access_accept - Interpreter - Request marked as runnable Any thoughts on why this would be the case? Thanks, James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 1

DHCPv6 - MySQL Reservations
by David Lake 02 Apr '26

02 Apr '26

Hi I’m setting up FreeRadius v4 and so far, all working very nicely with a MariaDB Galera datastore. I’d like to fix reservations in IPv6 to statically-assigned v6 prefixes in the same database. How do I do that please? I can’t find anything in the documentation on v6 lease allocation other than to exclude link-local. Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

Existing tags being modified on 2026-04-01
by Bjørn Mork 02 Apr '26

02 Apr '26

Stuff like this worries me with all the supply chain attacks going around. We are still expecting lots of fallout from the Trivy compromise. There's no reason to believe the LiteLLM was the only one. bjorn@canardo:/usr/local/src/git/freeradius$ git fetch --all --tags --prune Fetching origin remote: Enumerating objects: 265, done. remote: Counting objects: 100% (137/137), done. remote: Compressing objects: 100% (18/18), done. remote: Total 265 (delta 119), reused 137 (delta 119), pack-reused 128 (from 3) Receiving objects: 100% (265/265), 92.91 KiB | 2.02 MiB/s, done. Resolving deltas: 100% (129/129), completed with 14 local objects. >From https://github.com/FreeRADIUS/freeradius-server 0e6dc8c2bde7..fa8ca050f3d7 v3.2.x -> origin/v3.2.x ! [rejected] branch_3_1_x -> branch_3_1_x (would clobber existing tag) ! [rejected] branch_4_0_0 -> branch_4_0_0 (would clobber existing tag) ! [rejected] first-build -> first-build (would clobber existing tag) ! [rejected] release_0_1_0 -> release_0_1_0 (would clobber existing tag) ! [rejected] release_0_2_0 -> release_0_2_0 (would clobber existing tag) ! [rejected] release_0_3_0 -> release_0_3_0 (would clobber existing tag) ! [rejected] release_0_4_0 -> release_0_4_0 (would clobber existing tag) ! [rejected] release_0_5_0 -> release_0_5_0 (would clobber existing tag) ! [rejected] release_0_6_0 -> release_0_6_0 (would clobber existing tag) ! [rejected] release_0_7_0 -> release_0_7_0 (would clobber existing tag) ! [rejected] release_0_7_1 -> release_0_7_1 (would clobber existing tag) ! [rejected] release_0_8_1 -> release_0_8_1 (would clobber existing tag) ! [rejected] release_0_9_0 -> release_0_9_0 (would clobber existing tag) ! [rejected] release_0_9_0_final -> release_0_9_0_final (would clobber existing tag) ! [rejected] release_0_9_0_pre2 -> release_0_9_0_pre2 (would clobber existing tag) ! [rejected] release_0_9_0_pre3 -> release_0_9_0_pre3 (would clobber existing tag) ! [rejected] release_0_9_1 -> release_0_9_1 (would clobber existing tag) ! [rejected] release_0_9_2 -> release_0_9_2 (would clobber existing tag) ! [rejected] release_0_9_3 -> release_0_9_3 (would clobber existing tag) ! [rejected] release_1_0_0 -> release_1_0_0 (would clobber existing tag) ! [rejected] release_1_0_0_pre1 -> release_1_0_0_pre1 (would clobber existing tag) ! [rejected] release_1_0_0_pre2 -> release_1_0_0_pre2 (would clobber existing tag) ! [rejected] release_1_0_0_pre3 -> release_1_0_0_pre3 (would clobber existing tag) ! [rejected] release_1_0_1 -> release_1_0_1 (would clobber existing tag) ! [rejected] release_1_0_2 -> release_1_0_2 (would clobber existing tag) ! [rejected] release_1_0_3 -> release_1_0_3 (would clobber existing tag) ! [rejected] release_1_0_4 -> release_1_0_4 (would clobber existing tag) ! [rejected] release_1_0_5 -> release_1_0_5 (would clobber existing tag) ! [rejected] release_1_1_0 -> release_1_1_0 (would clobber existing tag) ! [rejected] release_1_1_0_pre0 -> release_1_1_0_pre0 (would clobber existing tag) ! [rejected] release_1_1_1 -> release_1_1_1 (would clobber existing tag) ! [rejected] release_1_1_2 -> release_1_1_2 (would clobber existing tag) ! [rejected] release_1_1_3 -> release_1_1_3 (would clobber existing tag) ! [rejected] release_1_1_4 -> release_1_1_4 (would clobber existing tag) ! [rejected] release_1_1_5 -> release_1_1_5 (would clobber existing tag) ! [rejected] release_1_1_6 -> release_1_1_6 (would clobber existing tag) ! [rejected] release_1_1_7 -> release_1_1_7 (would clobber existing tag) ! [rejected] release_1_1_8 -> release_1_1_8 (would clobber existing tag) ! [rejected] release_2_0_0 -> release_2_0_0 (would clobber existing tag) ! [rejected] release_2_0_0_pre1 -> release_2_0_0_pre1 (would clobber existing tag) ! [rejected] release_2_0_0_pre2 -> release_2_0_0_pre2 (would clobber existing tag) ! [rejected] release_2_0_1 -> release_2_0_1 (would clobber existing tag) ! [rejected] release_2_0_2 -> release_2_0_2 (would clobber existing tag) ! [rejected] release_2_0_3 -> release_2_0_3 (would clobber existing tag) ! [rejected] release_2_0_4 -> release_2_0_4 (would clobber existing tag) ! [rejected] release_2_0_5 -> release_2_0_5 (would clobber existing tag) ! [rejected] release_2_1_0 -> release_2_1_0 (would clobber existing tag) ! [rejected] release_2_1_1 -> release_2_1_1 (would clobber existing tag) ! [rejected] release_2_1_10 -> release_2_1_10 (would clobber existing tag) ! [rejected] release_2_1_11 -> release_2_1_11 (would clobber existing tag) ! [rejected] release_2_1_12 -> release_2_1_12 (would clobber existing tag) ! [rejected] release_2_1_2 -> release_2_1_2 (would clobber existing tag) ! [rejected] release_2_1_3 -> release_2_1_3 (would clobber existing tag) ! [rejected] release_2_1_4 -> release_2_1_4 (would clobber existing tag) ! [rejected] release_2_1_6 -> release_2_1_6 (would clobber existing tag) ! [rejected] release_2_1_7 -> release_2_1_7 (would clobber existing tag) ! [rejected] release_2_1_8 -> release_2_1_8 (would clobber existing tag) ! [rejected] release_2_1_9 -> release_2_1_9 (would clobber existing tag) ! [rejected] release_2_2_0 -> release_2_2_0 (would clobber existing tag) ! [rejected] release_2_2_1 -> release_2_2_1 (would clobber existing tag) ! [rejected] release_2_2_10 -> release_2_2_10 (would clobber existing tag) ! [rejected] release_2_2_2 -> release_2_2_2 (would clobber existing tag) ! [rejected] release_2_2_3 -> release_2_2_3 (would clobber existing tag) ! [rejected] release_2_2_4 -> release_2_2_4 (would clobber existing tag) ! [rejected] release_2_2_5 -> release_2_2_5 (would clobber existing tag) ! [rejected] release_2_2_6 -> release_2_2_6 (would clobber existing tag) ! [rejected] release_2_2_7 -> release_2_2_7 (would clobber existing tag) ! [rejected] release_2_2_8 -> release_2_2_8 (would clobber existing tag) ! [rejected] release_2_2_9 -> release_2_2_9 (would clobber existing tag) ! [rejected] release_3.0.8 -> release_3.0.8 (would clobber existing tag) ! [rejected] release_3_0_0 -> release_3_0_0 (would clobber existing tag) ! [rejected] release_3_0_0_beta0 -> release_3_0_0_beta0 (would clobber existing tag) ! [rejected] release_3_0_0_beta1 -> release_3_0_0_beta1 (would clobber existing tag) ! [rejected] release_3_0_0_rc0 -> release_3_0_0_rc0 (would clobber existing tag) ! [rejected] release_3_0_0_rc1 -> release_3_0_0_rc1 (would clobber existing tag) ! [rejected] release_3_0_1 -> release_3_0_1 (would clobber existing tag) ! [rejected] release_3_0_10 -> release_3_0_10 (would clobber existing tag) ! [rejected] release_3_0_11 -> release_3_0_11 (would clobber existing tag) ! [rejected] release_3_0_12 -> release_3_0_12 (would clobber existing tag) ! [rejected] release_3_0_13 -> release_3_0_13 (would clobber existing tag) ! [rejected] release_3_0_14 -> release_3_0_14 (would clobber existing tag) ! [rejected] release_3_0_15 -> release_3_0_15 (would clobber existing tag) ! [rejected] release_3_0_16 -> release_3_0_16 (would clobber existing tag) ! [rejected] release_3_0_17 -> release_3_0_17 (would clobber existing tag) ! [rejected] release_3_0_18 -> release_3_0_18 (would clobber existing tag) ! [rejected] release_3_0_19 -> release_3_0_19 (would clobber existing tag) ! [rejected] release_3_0_2 -> release_3_0_2 (would clobber existing tag) ! [rejected] release_3_0_20 -> release_3_0_20 (would clobber existing tag) ! [rejected] release_3_0_21 -> release_3_0_21 (would clobber existing tag) ! [rejected] release_3_0_22 -> release_3_0_22 (would clobber existing tag) ! [rejected] release_3_0_23 -> release_3_0_23 (would clobber existing tag) ! [rejected] release_3_0_24 -> release_3_0_24 (would clobber existing tag) ! [rejected] release_3_0_25 -> release_3_0_25 (would clobber existing tag) ! [rejected] release_3_0_26 -> release_3_0_26 (would clobber existing tag) ! [rejected] release_3_0_27 -> release_3_0_27 (would clobber existing tag) ! [rejected] release_3_0_3 -> release_3_0_3 (would clobber existing tag) ! [rejected] release_3_0_4 -> release_3_0_4 (would clobber existing tag) ! [rejected] release_3_0_4_rc0 -> release_3_0_4_rc0 (would clobber existing tag) ! [rejected] release_3_0_4_rc1 -> release_3_0_4_rc1 (would clobber existing tag) ! [rejected] release_3_0_4_rc2 -> release_3_0_4_rc2 (would clobber existing tag) ! [rejected] release_3_0_5 -> release_3_0_5 (would clobber existing tag) ! [rejected] release_3_0_6 -> release_3_0_6 (would clobber existing tag) ! [rejected] release_3_0_7 -> release_3_0_7 (would clobber existing tag) ! [rejected] release_3_0_8 -> release_3_0_8 (would clobber existing tag) ! [rejected] release_3_0_9 -> release_3_0_9 (would clobber existing tag) ! [rejected] release_3_2_0 -> release_3_2_0 (would clobber existing tag) ! [rejected] release_3_2_1 -> release_3_2_1 (would clobber existing tag) ! [rejected] release_3_2_2 -> release_3_2_2 (would clobber existing tag) ! [rejected] release_3_2_3 -> release_3_2_3 (would clobber existing tag) ! [rejected] release_3_2_4 -> release_3_2_4 (would clobber existing tag) ! [rejected] release_3_2_5 -> release_3_2_5 (would clobber existing tag) ! [rejected] release_3_2_6 -> release_3_2_6 (would clobber existing tag) ! [rejected] release_3_2_7 -> release_3_2_7 (would clobber existing tag) ! [rejected] release_3_2_8 -> release_3_2_8 (would clobber existing tag) error: could not fetch origin Fetching bmork@github Comparing a small subset of the tags on github with my local copies, I see this on github: bjorn@canardo:/usr/local/src/git/freeradius$ git ls-remote --tags origin refs/tags/release_3_2_* 69c4b9c4e6e40a69db27049cb6ea65568c1f8c50 refs/tags/release_3_2_0 87528a85decda00b86cf00ad640dc14558e1ca88 refs/tags/release_3_2_0^{} 795def425e5902a714567a14cbaf36717a199765 refs/tags/release_3_2_1 3b86b8fab3574bc860688a55b4c8f70ebc054f15 refs/tags/release_3_2_1^{} 723efbe8846e32852e4a0552400db932ed119913 refs/tags/release_3_2_2 b9ed73ef2d2628fa6e2a6d15a7782f8217966be0 refs/tags/release_3_2_2^{} 902152f616f6c67f91152707663258edaf3dae75 refs/tags/release_3_2_3 db3d1924d9a2e8d37c43872932621f69cfdbb099 refs/tags/release_3_2_3^{} 4f0566bed21fd88c4c93a18094a666cd04573049 refs/tags/release_3_2_4 7e8f34ec57ca854709672f7f3e4a341ff2f0b550 refs/tags/release_3_2_4^{} 64440a14ca3c666883aeb5e0a47ae226448b4a30 refs/tags/release_3_2_5 a7acce80f5ba2271d9aeb737a4a91a5bf8317f31 refs/tags/release_3_2_5^{} e23d0f459b893f8e09eb4423e947f64a2caf6cf0 refs/tags/release_3_2_6 a696279897f9e87c2fb2b1b8388da5a4aa09835f refs/tags/release_3_2_6^{} daf925decd4873c252839de116778c90c2e5d97c refs/tags/release_3_2_7 694a97dddbdd26423504afe7c530e8e1502b7354 refs/tags/release_3_2_7^{} 004dafca9f3601453cd3cc08f36493b708ce55cf refs/tags/release_3_2_8 032be31bb52646171099617928ec1703335bcf73 refs/tags/release_3_2_8^{} While I've got: bjorn@canardo:/usr/local/src/git/freeradius$ git tag --list --format='%(objectname) %(refname)' release_3_2_* 87528a85decda00b86cf00ad640dc14558e1ca88 refs/tags/release_3_2_0 3b86b8fab3574bc860688a55b4c8f70ebc054f15 refs/tags/release_3_2_1 b9ed73ef2d2628fa6e2a6d15a7782f8217966be0 refs/tags/release_3_2_2 db3d1924d9a2e8d37c43872932621f69cfdbb099 refs/tags/release_3_2_3 7e8f34ec57ca854709672f7f3e4a341ff2f0b550 refs/tags/release_3_2_4 a7acce80f5ba2271d9aeb737a4a91a5bf8317f31 refs/tags/release_3_2_5 a696279897f9e87c2fb2b1b8388da5a4aa09835f refs/tags/release_3_2_6 694a97dddbdd26423504afe7c530e8e1502b7354 refs/tags/release_3_2_7 032be31bb52646171099617928ec1703335bcf73 refs/tags/release_3_2_8 So my tags match the odd tag names with a '^{}' suffix. The new tags seem to all be gpg signed objects referencing the same object as the old tag. For example: bjorn@canardo:/usr/local/src/git/freeradius$ git show 004dafca9f3601453cd3cc08f36493b708ce55cf tag release_3_2_8 Tagger: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 1 18:35:01 2026 -0400 release_3_2_8 -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEE8n1lTTL4FC4LtEWpfQ55zXdiHs0FAmnNnZUACgkQfQ55zXdi Hs0VJQf/fcukNADXI9Nc1iP2xEWok0T9yKD/IsXNp27kKzvdItXDT4WSAJRV454f FObLabOcMAfvomBiBGZfVLoNoCFrnG0hOF+cBGCRMYFqRDFTt65UXxb9NWAF0Dw+ kJznNS02Ds/bWxgMA1r7GYkoLqs+Klwg79DuBhmwnXNcj4sr6ifx9NVxOugab+YC c7X+aunFfDonj6UGJYfAITjlkvdHgvenK15e1UDzYtDzPRsw41Eesa7E0ea+ZlMo 44SNFWcyXuXyXukQhgr12tdtgOvBQ8GYGwDt/2DUAVz4wUrM7rcq+6y+8LJM77ef sCqvUF4RNdR2SiZAMbqy+gUe98DJYg== =7bE2 -----END PGP SIGNATURE----- commit 032be31bb52646171099617928ec1703335bcf73 (tag: release_3_2_8) gpg: Signature made Wed Aug 20 18:29:15 2025 CEST gpg: using RSA key A5C5E99DFB9B5C1F70A7A2FFD9B933C12AED74F0 gpg: issuer "matthew-git(a)newtoncomputing.co.uk" gpg: Good signature from "Matthew Newton (git signing key) <matthew-git(a)newtoncomputing.co.uk>" [full] gpg: matthew-git(a)newtoncomputing.co.uk: Verified 284 signatures in the past 2 months. Encrypted 0 messages. Primary key fingerprint: A5C5 E99D FB9B 5C1F 70A7 A2FF D9B9 33C1 2AED 74F0 Author: Matthew Newton <matthew-git(a)newtoncomputing.co.uk> Date: Wed Aug 20 17:29:15 2025 +0100 release 3.2.8 diff --git a/debian/changelog b/debian/changelog index a004b9adecca..d24614ea2720 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,7 +2,7 @@ freeradius (3.2.8+git) unstable; urgency=medium * New upstream version. - -- Alan DeKok <aland(a)freeradius.org> Fri, 31 Jan 2025 12:00:00 +0000 + -- Alan DeKok <aland(a)freeradius.org> Wed, 20 Aug 2025 12:00:00 +0000 freeradius (3.2.7+git) unstable; urgency=medium diff --git a/doc/ChangeLog b/doc/ChangeLog index c7e59bef42c8..b7ec777822c4 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,4 +1,4 @@ -FreeRADIUS 3.2.8 Fri 31 Jan 2025 12:00:00 UTC urgency=low +FreeRADIUS 3.2.8 Wed 20 Aug 2025 12:00:00 UTC urgency=low Configuration changes * Replace dictionary.infinera with the correct one. * Update dictionary.alteon @@ -25,11 +25,9 @@ FreeRADIUS 3.2.8 Fri 31 Jan 2025 12:00:00 UTC urgency=low * Added kafka module. See mods-available/kafka. * json module can now print dates as integers. See mods-available/json - * The debug output now points to the online documentation - in many cases, when there are syntax errors in the - configuration. - * Add support for 389ds password hashes. Patch from - Gerald Vogt. + * The debug output now points to the online documentation in + many cases, when there are syntax errors in the configuration. + * Add support for 389ds password hashes. Patch from Gerald Vogt. * reject_delay does not _add_ a delay, but instead ensures that the reject is delayed for _at least_ that time. This change means that reject_delay can be set in more situations, including So that looks fine. Except this sudden appearance of signatures on all the old tags, reusing the same names. That's very messy. Could anyone please confirm that this intentional and the everything is OK with the github repo? Yes, I can see that the tags are signed by an entity which normally would be trusted.. But these days I have to assume that *any* release credentials could be compromised. The only protection left is the sanity of local clones. And tag updates are as unexpected as any other object modifcations. Bjørn

2 2