netatalk.io

search netatalk.io

powered by DuckDuckGo

Netatalk 4.5.0 is available!

The Netatalk team is proud to announce the first stable version in the Netatalk 4.5 release series – one of the most feature-packed releases in the history of this project!

This release focuses on three large areas: making Finder search usable out of the box, rebuilding the AFP directory cache for much larger and faster workloads, and tightening security across authentication, filesystem handling, parsers, and build defaults. It also brings a new SRP authentication UAM, a pluggable Spotlight backend architecture, a modernized afpstats interface, and many portability improvements for Unix-like platforms.

All users of previous Netatalk versions are encouraged to upgrade to 4.5.0.

Highlights

Spotlight and Search

Netatalk 4.5.0 introduces a pluggable Spotlight search architecture. The AFP Spotlight RPC layer is shared, while each volume can choose a backend through spotlight backend.

The default backend is now cnid. It uses Netatalk’s CNID database for fast filename-oriented Finder search, with no external indexing service beyond the normal CNID backend and the Spotlight parser dependencies. This makes Finder search useful on typical file servers without requiring LocalSearch/Tracker.

The localsearch backend remains available for richer metadata and content search. It now uses dconf keyfiles for indexer configuration; dconf is a mandatory dependency for this backend, and the LocalSearch indexer is started only when a volume is configured to use it.

The new xapian backend is experimental. It maintains a Netatalk-managed per-volume Xapian index for filename, plain-text content, and MIME type search. It is useful for testing and feedback, but is not recommended for production deployments yet.

Spotlight query behavior has also been improved. CNID, SQLite, and MySQL backed searches can return up to 10000 results per query, or as many as fit within a 10-second wall-clock budget. Wildcard queries, timestamps, additional attributes, and macOS Tahoe search paths in nested arrays are handled more robustly. Finder Spotlight filename queries shorter than 3 characters are ignored by the Spotlight backend.

Directory Cache

The directory cache is now a multi-layer cache for directory entries, file metadata, AppleDouble metadata, and optionally resource fork data. The goal is to reduce filesystem I/O during directory enumeration and metadata-heavy AFP workloads, especially on shares with many small files.

The new dircache mode = arc option enables an Adaptive Replacement Cache that learns from both recent and frequent access patterns. ARC is more memory hungry than the default LRU mode, but it is better at resisting sequential scans and backup jobs that would otherwise flush useful cache entries.

Netatalk also gained enumerate caching, AppleDouble support in cache, inter-process cache synchronization between afpd children, a tier-2 resource fork cache, and an idle worker for background cache maintenance. Cache entries are still updated for AFP operations, while dircache validation freq lets administrators tune how aggressively Netatalk validates cached entries against changes made outside AFP.

Security and Compatibility

This release includes fixes and hardening for authentication, Unicode and charset handling, LDAP filter construction, VFS metadata parsing, DSI session handling, Spotlight unmarshalling, CatSearch request parsing, CNID database operations, and papd print job handling.

Notable security-facing changes include:

The libatalk ABI changed in this release. cnid_find() gained a bool *more_available out-parameter and now requires a 400-byte minimum result buffer. The libatalk soversion is bumped to v20, so out-of-tree consumers must be rebuilt against the 4.5 headers. The internal server_child_t ABI also changed because the afpstats handler now runs in the parent’s main event loop.

Authentication

Netatalk now includes an SRP (“Secure Remote Password”) UAM as uams_srp.so. SRP uses separate salts and verifiers rather than system passwords, and provides strong password authentication without sending the password over the network.

afppasswd now operates in SRP mode by default and writes the SRP verifier file afppasswd.srp, or the path set with srp passwd file. To manage legacy Randnum credentials, pass afppasswd -r. In Randnum mode, afppasswd -r -c creates or validates the required companion key file.

Randnum and Two-Way Randnum remain available for very old AFP clients, but are discouraged. They require the legacy passwd file and companion key file, and authentication fails until both are present and valid.

CNID and Volume Management

The new global cnid scheme setting lets administrators define the default CNID backend once in [Global], while still allowing per-volume overrides. The sqlite backend continues to mature, MySQL CNID handling has improved charset and TCP behavior, and both MySQL and SQLite now support cnid dev = no.

Volumes can now set a stable UUID explicitly with volume uuid. This is useful when running afpd without permission to write the shared state directory, or when administrators need a fixed volume identity across deployments.

The obsolete last CNID backend has been removed.

Admin Tools

afpstats has been rewritten to use a Unix domain socket instead of D-Bus. This removes the GLib/D-Bus dependency for statistics collection and makes the tool simpler to use in minimal server environments. Runtime statistics are enabled with afpstats = yes; access can be delegated with afpstats group, and afpstats -s can query a non-default socket path. Sessions connected over both TCP/IP and AppleTalk are now reported.

The historical macusers script has been removed. Use afpstats instead.

The nad utility gained mkdir and rmdir, a -F option for reading a custom afp.conf, safer and cleaner ls output, support for ls -a, and improved behavior for operations crossing AFP volume boundaries.

dbd gained -i to invalidate AppleDouble CNID hints.

afp.conf Changes

The most important new and changed afp.conf options in 4.5.0 are:

Option Scope Default Status
spotlight G/V yes Changed default; enables Spotlight-compatible Finder search globally or per volume.
search db V yes Changed default; uses CNID database name search for Catalog Search.
spotlight backend G/V cnid New; selects cnid, localsearch, or xapian per volume.
spotlight attributes G empty Limits searchable attributes for the localsearch backend only.
sparql results limit G unlimited Also applies as the per-query cap for the xapian backend.
volume uuid V generated New; assigns a static UUID to a volume.
cnid scheme G/V build default New global default with per-volume override for dbd, mysql, or sqlite.
cnid dev V yes MySQL and SQLite now support cnid dev = no.
dircache size G 65536 Replaces dircachesize; accepts 1024 through 1048576 entries.
dircache validation freq G 1 New tuning control; validates every Nth cache access, range 1-100.
dircache mode G lru New; selects lru or arc eviction.
dircache rfork budget G 0 New; total KB budget for resource fork caching, disabled at 0.
dircache rfork maxsize G 1024 New; maximum KB size of a single cached resource fork.
convert appledouble V no Changed default; enable only for dynamic AppleDouble migration.
follow symlinks V no Stricter validation rejects unsafe and cross-device symlink targets.
uam list G uams_dhx2.so uams_srp.so is available; uams_dhx.so/DHCAST128 is no longer default.
srp passwd file G afppasswd.srp New; selects the SRP verifier file used by uams_srp.so.
passwd file G afppasswd Now specifically the legacy Randnum password file.
afpstats group G unset Sets group ownership for the afpstats socket.

Removed options:

Meson Build Options

Meson v0.62.0 and later is now required, previously v0.61.2.

The most important new and changed Meson options in 4.5.0 are:

Option Default Status
-Dwith-spotlight-backends=cnid,localsearch,xapian all three New; selects which Spotlight backends to build.
-Dwith-eventloop=libevent or libev auto New; prefers libevent, while libev is now supported as an alternative.
-Dwith-fce=true/false true New compile-time switch for Filesystem Change Event support; disable for slight performance gain.
-Dwith-subprojects=true/false false New; forces Meson subprojects to build even when a system dependency exists.

For the localsearch Spotlight backend, dconf is now required in addition to the LocalSearch/Tracker, TinySPARQL, GLib/GIO, D-Bus, flex, bison, and talloc dependencies. For the xapian backend, xapian-core, libmagic/libfile, and talloc are required.

CVEs

A list of CVEs fixed in this release.

CVE-2026-7835, CVE-2026-7836, CVE-2026-7837, CVE-2026-44053, CVE-2026-44056, CVE-2026-44058, CVE-2026-44059, CVE-2026-44061, CVE-2026-44063, CVE-2026-44065, CVE-2026-44067, CVE-2026-44069, CVE-2026-44070, CVE-2026-44071, CVE-2026-44072, CVE-2026-44073, CVE-2026-44074, CVE-2026-44075, CVE-2026-49387, CVE-2026-49388, CVE-2026-49389, CVE-2026-49390

Installation

netatalk-4.5.0.tar.xz is the Netatalk source distribution. See INSTALL for required dependencies, then build with:

# Extract the source
tar -xf netatalk-4.5.0.tar.xz
cd netatalk-4.5.0

# Configure and build
meson setup build
meson compile -C build

# Install
sudo meson install -C build

netatalk-4.5.0.wbm.gz is the Webmin module tarball. To install the module:

# Adjust the path to match your Webmin installation
/usr/share/webmin/install-module.pl netatalk-4.5.0.wbm.gz

What’s Changed

New Contributors

Full Changelog: https://github.com/Netatalk/netatalk/compare/netatalk-4-5-0beta…netatalk-4-5-0

Downloads

Footnotes

Release published on 2026-05-30

Generated from GitHub Release Notes

Valid HTML5 Valid CSS

The source code of this website is licensed under the GNU General Public License 2.0.