Arc 26.09.4: Broader Linux Support, Signed RPMs, Exact Deduplication

Arc 26.09.4 is a patch release on 26.09.3. It focuses on installation and correctness:

• the Linux packages run on more systems;
• the RPMs are signed;
• compaction deduplicates only rows that are truly identical;
• continuous queries are available on a fresh package install.

It also brings security updates from Go and three dependencies.

Most of the installation work came from an outside report on how Arc's first install goes on the distributions people actually run. More on that below. Everything else in progress on main continues toward 27.01.1.

Linux packages for Debian 12, Ubuntu 22.04, RHEL 9 and Amazon Linux 2023

The 26.09.3 Linux binaries were built on the newest GitHub runner, so they required glibc 2.38:

• On Debian 12 and Ubuntu 22.04, the .deb installed but Arc failed to start.
• On RHEL 9, Rocky 9 and Amazon Linux 2023, the RPM refused to install. RHEL 9 also needed a newer C++ runtime than the system ships.

The 26.09.4 binaries are built on Ubuntu 22.04, with the C++ runtime linked into the binary. They need only glibc 2.34 or newer, which covers Ubuntu 22.04+, Debian 12+, RHEL/Rocky/Alma 9+, Amazon Linux 2023 and Fedora 35+, on amd64 and arm64. Nothing that ran 26.09.3 loses support.

We also changed how releases are checked, so this cannot regress quietly:

• The build fails if the binary needs anything newer than glibc 2.34.
• The .deb declares its minimum libc6 version, so dpkg refuses an unsupported system up front instead of installing a binary that cannot start.
• Each release installs and starts its packages on Debian 12, Ubuntu 22.04, Rocky 9, Amazon Linux 2023 and Fedora before it is published.

Signed RPMs

Fedora 45 ships rpm 6.1, which refuses unsigned packages by default, and Arc's RPMs had never been signed. From 26.09.4 the RPMs are signed with the Basekick Labs package key:

• Fingerprint: 3E39 9CF8 F5D2 EF9A A9A5 36EF 7629 7AF0 8CBA B6FE
• Where to get it: published with every release.

Import the key once, then install with dnf:

sudo rpm --import https://github.com/basekick-labs/arc/releases/download/v26.09.4/RPM-GPG-KEY-basekick
sudo dnf install -y ./arc-26.09.4-1.x86_64.rpm

arcli's RPMs are signed with the same key from its next release.

Compaction keeps every distinct row

Compaction deduplicates line-protocol data and continuous-query output. Until now it treated rows with the same tags and timestamp as duplicates of one another, and kept one of them. That is right for a client retrying the same write. But it also merged rows that only shared a key:

• a corrected value re-sent for the same point;
• two writes that set different fields for the same series and time;
• a continuous-query window that was re-run with late data.

26.09.4 removes a row only when another row is identical to it in every column: time, every tag and every field. Retried writes still collapse to one row. A corrected value is now stored alongside the original rather than replacing it, so queries see both rows. If your clients rely on re-sending a point to overwrite it, query for the latest value per series and time instead.

Full-row comparison runs only where a key repeats, so compaction cost stays close to what it was. In a cluster, compaction runs on the compactor node and the other nodes receive its output. Upgrading the compactor is what brings the new behaviour to the whole cluster. If you run with cluster.failover_enabled, upgrade the writers as well, since a writer can take over compaction.

Continuous queries are on by default

The arc.toml shipped in the packages and the Docker image had continuous queries disabled, unlike Arc's code default and its documentation. So on a fresh package install, arcli cq and the continuous-query API were unavailable until you found the setting. They are now enabled. Nothing runs until you create a continuous query.

On upgrade, the .deb replaces /etc/arc/arc.toml, so continuous queries turn on. The RPM and Arch packages keep a file you have edited (the new one lands next to it as .rpmnew or .pacnew) and replace it only if it was never touched. Set [continuous_query] enabled to true or false to choose explicitly.

Security updates

• zstd request bodies: klauspost/compress 1.20.4 fixes a decoder panic on a crafted zstd frame (GHSA-fpmh-frq8-7rj8). For Arc this meant that a single crafted, compressed write request could stop the server.
• Go 1.26.10: fixes in net/http, crypto/tls, crypto/x509, net/textproto and html/template.
• Other dependencies: golang.org/x/net 0.60.0 and andybalholm/brotli 1.2.7.

govulncheck reports no reachable vulnerabilities in 26.09.4.

The newer klauspost/compress uses new arm64 assembly for Snappy, which Arc uses for every Parquet file. In our measurements on Apple silicon, line-protocol ingest is about 3% slower and MessagePack ingest is unchanged. Smaller Parquet pages recover that, and that work is planned.

Before you upgrade

• Corrections: a re-sent point with a new value is now stored next to the original rather than replacing it.
• Clusters: upgrade the compactor node. If compactor failover is enabled, upgrade the writers too.
• RPM installs: import the package key once (see above).
• Continuous queries: on by default. A .deb upgrade turns them on; the RPM and Arch packages keep an edited arc.toml.
• Linux: glibc 2.34 or newer. Ubuntu 20.04 and RHEL 8 are not supported.

The most useful spam of the year

Most of this release started with an email I almost ignored. It came from Grump. Grump's report said our .deb installed cleanly on Debian 12 and Ubuntu 22.04 and then could not start. It gave the exact error, the two symbols responsible, and the fix. It was right.

The full report went further. Grump followed every page of our documentation on eight Linux distributions, the way a new user would, and wrote down exactly where each one stopped:

• the glibc floor;
• unsigned RPMs on Fedora 45;
• continuous queries switched off in the packaged configuration;
• a Python client example that failed on its first query;
• and more than a dozen smaller documentation fixes.

Every finding came with a reproduction and a fix that had already been run. It is the most useful spam I have received this year.

The lesson for us is wider than the patches in this release. We build and test on the latest and greatest: the newest runners, the newest distributions, the newest toolchains. Our users and customers often aren't there, and shouldn't have to be. Debian 12, Ubuntu 22.04 and RHEL 9 are where a lot of real systems run. The first install is where people decide whether a database is worth their time.

So this release changes how we work, not just what we ship:

• Every release now proves its packages install and start on the oldest systems we support.
• The build refuses a binary that quietly raises that floor.
• The documentation fixes from the report are tracked and in progress.

Thank you, Grump. If you maintain something people install, it is worth a look.

How to update

# Docker Hub
docker pull basekicklabs/arc:26.09.4
 
# or GitHub Container Registry
docker pull ghcr.io/basekick-labs/arc:26.09.4

On macOS, run brew upgrade basekick-labs/tap/arc. For binary and package installations, download 26.09.4 from the GitHub releases page. For Kubernetes:

helm upgrade --install arc \
  https://github.com/basekick-labs/arc/releases/download/v26.09.4/arc-26.09.4.tgz \
  -f your-values.yaml

The full 26.09.4 release notes have the complete details.

Get started:

• Arc documentation
• Star Arc on GitHub
• Join the Discord

For questions or help planning an upgrade, join us on Discord or open a GitHub issue.