Mirrorbits 0.6.2

Mirrorbits 0.6.2: staying in sync

Last year, we shipped Mirrorbits 0.6, and I wrote about taking over the maintainership of the project.

Mirrorbits is the geographical download redirector, written in Go, that distributes the binaries of VLC, and serves quite a few other open source projects and Linux distributions. Since then, the repository moved to the Videolabs organization, where the project was born: Ludovic Fauvet originally wrote it while working at Videolabs. All the old links redirect.

Today, almost exactly one year after 0.6.1, we are releasing Mirrorbits 0.6.2: a maintenance release of 33 commits from 6 contributors, most of them once again from Arnaud Rebillout. That makes it one release per year since I took over the project: a cadence I intend to keep.

New features

Three new features in this release:

• rsync over TLS: mirrors can now be scanned using rsyncs:// URLs. There is no official URL scheme for rsync-over-TLS, so we made one up: under the hood, mirrorbits calls the rsync-ssl wrapper that ships with rsync, which negotiates TLS on port 874 instead of the plain 873. Contributed by Christoph Reiter, of MSYS2 fame.
• GeographicalSort: by default, mirrorbits ranks the eligible mirrors by distance to the client. This new option lets you turn that ranking off: GeoIP is then only used to filter which mirrors are eligible, and the redirect is picked among them by score. Useful when you would rather spread the load than always favor the closest mirror. Contributed by Nicola Taddei.
• Down reasons in the CLI: mirrorbits list now shows why a mirror is down, not just since when: Unreachable, Got status code 429, and other classics of mirror operation. The daemon logs still hold the crunchy details, like “x509: certificate has expired or is not yet valid”, but the CLI now gives you the first hint for free.

Quality of life

Some smaller changes:

• The web pages now display file sizes with IEC prefixes (KiB, MiB, GiB). A file that mirrorbits reported as “3.5 GB” would show up as “3.8 GB” in file managers counting in SI units, and users were confused. Binary sizes now say what they mean.
• Removing a mirror deletes one Redis key per tracked file, which on a large instance takes longer than the old 10-second timeout; the Kali infrastructure was hitting it every single time. The operation now gets a full minute.
• The scan logs now tell you when a scan result is committed to the database and how many files were removed; the CLI tables got proper spacing and uppercase headers; and the OpenStreetMap tile URL was updated to follow the current OSM policy.

On the bugfix side, if a mirror name was a substring of another one (think fcix.net vs mirror.fcix.net), the CLI refused to address the shorter one, always answering “Multiple match”. An exact match now wins over substring matches. Amusingly, v0.3 fixed a very similar bug in August 2015; eleven years between episodes is a decent run for a sequel. A bogus error forwarding in the RPC layer was also fixed.

And since 0.6.1 never got a post here, a quick recap: it shipped in August 2025, quickly after 0.6.0, to fix the fallback mirrors, with a regression that returned “500 Internal Server Error” when the Redis database was not ready instead of redirecting users to the fallbacks, and malformed redirections when a fallback URL was missing its trailing slash.

Modern Go

The biggest cleanup of this release is invisible from the outside: the codebase caught up with a decade of Go evolution. Go 1.18 is now the minimum required version, and since Go modules are the norm, the vendor tree is gone: 607 files and 305,608 lines deleted in a single commit, the most satisfying diffstat of the year. The deprecated io/ioutil, github.com/pkg/errors and gopass gave way to the standard library and golang.org/x/term, and interface{} became any.

On the database side, Redis 4.0+ (June 2017) is now required, as the deprecated HMSET command was replaced with HSET. Valkey works too; that is what the Kali instance runs.

Conclusion

Last year, I wrote that the maintainer was probably the person contributing the least; I am happy to report that this is still the case.
Huge thanks to Arnaud Rebillout, who once again did most of the work, and to Amit Mishra, Christoph Reiter, Nicola Taddei and Sahil Dhiman for their contributions.

The full changelog and the release are on GitHub. No database upgrade this time: updating should be a drop-in.

Patches welcome.