Skip to main content

Release Notes 2.0.2

Skulk 2.0.2 encrypts and authenticates the traffic that carries model output and media between the nodes of a cluster. Before this release that traffic was not encrypted, and Skulk nodes of different clusters on the same network shared one channel for it. Update every node: this is a network protocol change, so a 2.0.2 node and a 2.0.1 node do not connect.

Security​

  • The data plane is encrypted and authenticated with the cluster's key. Generated output, uploaded images and audio, generated media, and traces now travel over mutual TLS 1.3 rooted in the cluster's shared key, the same key that already protects the control plane, where prompts and commands travel. A device without that key can neither join the data plane nor read it.
  • Clusters with different names stay apart. Each cluster name discovers its data plane on its own port, and in the rare case that two names share a port, the handshake still refuses the other cluster.
  • Choose a private cluster name to restrict who can join. On the default cluster name the key is public, as it always has been for the control plane: traffic is encrypted against eavesdroppers, but any Skulk node on the network can join. Set the same private name on every node (SKULK_LIBP2P_NAMESPACE, or Cluster Settings in the Mac app). A blank name is as public as the default, and Skulk warns about both at startup.
  • Diagnostics no longer show the cluster name. Node diagnostics report whether a private name is configured and a fingerprint that lets you confirm two nodes share a cluster without revealing the name.

Upgrade notes​

  • Update every node of a cluster to 2.0.2 together; 2.0.1 and 2.0.2 nodes do not connect.
  • tcp/ endpoints in SKULK_ZENOH_LISTEN and SKULK_ZENOH_CONNECT keep working and are used as tls/. An IPv6 address literal there is refused at startup; use an IPv4 address or a DNS name.
  • Data-plane discovery now uses a UDP port derived from the cluster name, logged at startup. A host firewall that allowed UDP 7446 for Skulk must allow that port instead.