Commit Graph

9368 Commits

Author SHA1 Message Date
dependabot[bot]
b137f5f245
.github: bump github/codeql-action from 3.29.3 to 3.29.5
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.3 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](d6bbdef45e...51f77329af)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-08-04 14:07:30 +00:00
Will Norris
834630fedf cmd/tailscale: add systray subcommand on Linux builds
This will start including the sytray app in unstable builds for Linux,
unless the `ts_omit_systray` build flag is specified.

If we decide not to include it in the v1.88 release, we can pull it
back out or restrict it to unstable builds.

Updates #1708

Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d
Signed-off-by: Will Norris <will@tailscale.com>
2025-08-01 17:57:06 -07:00
Will Norris
0f15e44196 Makefile: sort make commands and fix printing newlines
Updates #cleanup

Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d
Signed-off-by: Will Norris <will@tailscale.com>
2025-08-01 15:41:56 -07:00
kari-ts
d897d809d6
feature/taildrop: do not use m.opts.Dir for Android (#16316)
In Android, we are prompting the user to select a Taildrop directory when they first receive a Taildrop: we block writes on Taildrop dir selection. This means that we cannot use Dir inside managerOptions, since the http request would not get the new Taildrop extension. This PR removes, in the Android case, the reliance on m.opts.Dir, and instead has FileOps hold the correct directory.

This expands FileOps to be the Taildrop interface for all file system operations.

Updates tailscale/corp#29211

Signed-off-by: kari-ts <kari@tailscale.com>

restore tstest
2025-08-01 15:10:00 -07:00
mzbenami
5865d0a61a
Makefile: 'generate' target (#16746)
Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>
2025-08-01 13:30:42 -04:00
Lee Briggs
f2fd7a0514
cmd/k8s-operator,k8s-operator: allow setting a priorityClassName (#16685)
* cmd/k8s-operator,k8s-operator: allow setting a `priorityClassName`

Fixes #16682

Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>

* Update k8s-operator/apis/v1alpha1/types_proxyclass.go

Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Signed-off-by: Lee Briggs <jaxxstorm@users.noreply.github.com>

* run make kube-generate-all

Change-Id: I5f8f16694fdc181b048217b9f05ec2ee2aa04def
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>

---------

Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>
Signed-off-by: Lee Briggs <jaxxstorm@users.noreply.github.com>
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-31 23:35:48 -07:00
jishudashu
23a0398136
ipn/ipnlocal, net/dns: use slices.Equal to simplify code (#16641)
Signed-off-by: jishudashu <979260390@qq.com>
2025-07-31 11:36:51 -07:00
Mike O'Driscoll
47b5f10165
cmd/tsidp,tsnet: update tsidp oidc-key store path (#16735)
The tsidp oidc-key.json ended up in the root directory
or home dir of the user process running it.

Update this to store it in a known location respecting
the TS_STATE_DIR and flagDir options.

Fixes #16734

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-07-31 12:13:36 -04:00
Joe Tsai
1cc842b389
util/set: add more functionality to IntSet (#16640) 2025-07-30 13:08:53 -07:00
Tom Proctor
eed3e5dc61
ipn/store/kubestore,kube: fix cert error in admin UI (#16717)
Also adds a test to kube/kubeclient to defend against the error type
returned by the client changing in future.

Fixes tailscale/corp#30855

Change-Id: Id11d4295003e66ad5c29a687f1239333c21226a4

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-30 13:39:59 +01:00
Percy Wegmann
aa6a2d1e56 drive/driveimpl: use sudo or su to run file server
Some systems have `sudo`, some have `su`. This tries both, increasing
the chance that we can run the file server as an unprivileged user.

Updates #14629

Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-07-29 17:06:20 -05:00
Jordan Whited
3d1e4f147a
tstest/natlab: fix conn.Close race with conn.ReadFromUDPAddrPort (#16710)
If a conn.Close call raced conn.ReadFromUDPAddrPort before it could
"register" itself as an active read, the conn.ReadFromUDPAddrPort would
never return.

This commit replaces all the activeRead and breakActiveReads machinery
with a channel. These constructs were only depended upon by
SetReadDeadline, and SetReadDeadline was unused.

Updates #16707

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-29 14:58:47 -07:00
KevinLiang10
e37432afb7
cmd/tailscale/cli: update message for disable service (#16705)
This commit update the message for recommanding clear command after running serve for service.
Instead of a flag, we pass the service name as a parameter.

Fixes tailscale/corp#30846

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-07-29 13:59:09 -04:00
M. J. Fromberger
b34cdc9710
ipn,net,tsnet,wgengine: make an eventbus mandatory where it is used (#16594)
In the components where an event bus is already plumbed through, remove the
exceptions that allow it to be omitted, and update all the tests that relied on
those workarounds execute properly.

This change applies only to the places where we're already using the bus; it
does not enforce the existence of a bus in other components (yet),

Updates #15160

Change-Id: Iebb92243caba82b5eb420c49fc3e089a77454f65
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-07-29 09:04:08 -07:00
dependabot[bot]
e5e4386f33
build(deps): bump @babel/runtime from 7.23.4 to 7.26.10 in /client/web (#15299)
Bumps [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) from 7.23.4 to 7.26.10.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime)

---
updated-dependencies:
- dependency-name: "@babel/runtime"
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-28 23:36:36 -06:00
Nick Khyl
4df02bbb48 util/syspolicy/setting: use a custom marshaler for time.Duration
jsonv2 now returns an error when you marshal or unmarshal a time.Duration
without an explicit format flag. This is an intentional, temporary choice until
the default [time.Duration] representation is decided (see golang/go#71631).

setting.Snapshot can hold time.Duration values inside a map[string]any,
so the jsonv2 update breaks marshaling. In this PR, we start using
a custom marshaler until that decision is made or golang/go#71664
lets us specify the format explicitly.

This fixes `tailscale syspolicy list` failing when KeyExpirationNotice
or any other time.Duration policy setting is configured.

Fixes #16683

Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-07-28 12:57:39 -05:00
Jordan Whited
a9f3fd1c67
wgengine/magicsock: fix magicsock deadlock around Conn.NoteRecvActivity (#16687)
Updates #16651
Updates tailscale/corp#30836

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-28 09:26:24 -07:00
M. J. Fromberger
5ce3845a02
net/portmapper: avert a panic when a mapping is not available (#16686)
Ideally when we attempt to create a new port mapping, we should not return
without error when no mapping is available. We already log these cases as
unexpected, so this change is just to avoiding panicking dispatch on the
invalid result in those cases. We still separately need to fix the underlying
control flow.

Updates #16662

Change-Id: I51e8a116b922b49eda45e31cd27f6b89dd51abc8

Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-07-28 09:01:41 -07:00
dependabot[bot]
c962fefa3e
build(deps): bump form-data from 4.0.0 to 4.0.4 in /client/web (#16623)
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.0 to 4.0.4.
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](https://github.com/form-data/form-data/compare/v4.0.0...v4.0.4)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-28 08:51:58 -06:00
dependabot[bot]
4a435aedcb
.github: Bump github/codeql-action from 3.29.2 to 3.29.3 (#16615)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.2 to 3.29.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](181d5eefc2...d6bbdef45e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-28 08:41:59 -06:00
Tom Proctor
61d42eb300
k8s-operator: fix test flake (#16680)
This occasionally panics waiting on a nil ctx, but was missed in the
previous PR because it's quite a rare flake as it needs to progress to a
specific point in the parser.

Updates #16678

Change-Id: Ifd36dfc915b153aede36b8ee39eff83750031f95

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-28 13:33:46 +01:00
Tom Proctor
02084629e2
k8s-operator: handle multiple WebSocket frames per read (#16678)
When kubectl starts an interactive attach session, it sends 2 resize
messages in quick succession. It seems that particularly in HTTP mode,
we often receive both of these WebSocket frames from the underlying
connection in a single read. However, our parser currently assumes 0-1
frames per read, and leaves the second frame in the read buffer until
the next read from the underlying connection. It doesn't take long after
that before we end up failing to skip a control message as we normally
should, and then we parse a control message as though it will have a
stream ID (part of the Kubernetes protocol) and error out.

Instead, we should keep parsing frames from the read buffer for as long
as we're able to parse complete frames, so this commit refactors the
messages parsing logic into a loop based on the contents of the read
buffer being non-empty.

k/k staging/src/k8s.io/kubectl/pkg/cmd/attach/attach.go for full
details of the resize messages.

There are at least a couple more multiple-frame read edge cases we
should handle, but this commit is very conservatively fixing a single
observed issue to make it a low-risk candidate for cherry picking.

Updates #13358

Change-Id: Iafb91ad1cbeed9c5231a1525d4563164fc1f002f

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-28 12:03:08 +01:00
James Sanderson
5731869565 health: add an ETag to UnhealthyState for change detection
Updates tailscale/corp#30596

Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-07-28 11:50:18 +01:00
Tom Meadows
5154bbb0b3
k8s-operator: adding session type to cast header (#16660)
Updates #16490

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2025-07-28 11:15:14 +01:00
Raj Singh
e300a00058
cmd/k8s-operator: Enhance DNS record handling for ProxyGroup egress services (#16181)
This update introduces support for DNS records associated with ProxyGroup egress services, ensuring that the ClusterIP Service IP is used instead of Pod IPs.

Fixes #15945

Signed-off-by: Raj Singh <raj@tailscale.com>
2025-07-25 19:45:37 -05:00
Aaron Klotz
bfebf870ae cmd/tailscaled: update installSystemDaemonWindows to set the correct system service depndencies
Fixes #16658

Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2025-07-25 11:03:57 -06:00
Danni Popova
c572442548
cmd/tailscale: allow SSH to IPs or DNS names without MagicDNS (#16591)
fixes #16381

Signed-off-by: Danni Popova <danni@tailscale.com>
2025-07-25 10:21:41 +01:00
Aaron Klotz
2a5d9c7269 VERSION.txt: this is v1.87.0
Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2025-07-24 12:25:57 -06:00
Nick Khyl
c87f44b687 cmd/tailscale/cli: use DNS name instead of Location to hide Mullvad exit nodes from status output
Previously, we used a non-nil Location as an indicator that a peer is a Mullvad exit node.
However, this is not, or no longer, reliable, since regular exit nodes may also have a non-nil Location,
such as when traffic steering is enabled for a tailnet.

In this PR, we update the plaintext `tailscale status` output to omit only Mullvad exit nodes, rather than all
exit nodes with a non-nil Location. The JSON output remains unchanged and continues to include all peers.

Updates tailscale/corp#30614

Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-07-23 15:50:47 -05:00
Jordan Whited
179745b83e
wgengine/magicsock: update discoInfo docs (#16638)
discoInfo is also used for holding peer relay server disco keys.

Updates #cleanup

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-23 12:30:04 -07:00
Simon Law
1ef8fbf470
ipn/ipnlocal: send Hostinfo after resolveExitNode for "auto:any" (#16632)
In #16625, I introduced a mechanism for sending the selected exit node
to Control via tailcfg.Hostinfo.ExitNodeID as part of the MapRequest.
@nickkhyl pointed out that LocalBackend.doSetHostinfoFilterServices
needs to be triggered in order to actually send this update. This
patch adds that command. It also prevents the client from sending
"auto:any" in that field, because that’s not a real exit node ID.

This patch also fills in some missing checks in TestConfigureExitNode.

Updates tailscale/corp#30536

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2025-07-23 11:50:42 -07:00
Mike O'Driscoll
f1f334b23d
flake.lock/go.mod.sri: update flake version info (#16631)
Update nixpkgs-unstable to include newer golang
to satisfy go.mod requirement of 1.24.4

Update vendor hash to current.

Updates #15015

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-07-23 11:25:05 -04:00
KevinLiang10
1ae6a97a73
cmd/tailscale/cli: add advertise command to advertise a node as service proxy to tailnet (#16620)
This commit adds a advertise subcommand for tailscale serve, that would declare the node
as a service proxy for a service. This command only adds the service to node's list of
advertised service, but doesn't modify the list of services currently advertised.

Fixes tailscale/corp#28016

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-07-22 21:13:25 -04:00
Simon Law
729d6532ff
tailcfg: add Hostinfo.ExitNodeID to report the selected exit node (#16625)
When a client selects a particular exit node, Control may use that as
a signal for deciding other routes.

This patch causes the client to report whenever the current exit node
changes, through tailcfg.Hostinfo.ExitNodeID. It relies on a properly
set ipn.Prefs.ExitNodeID, which should already be resolved by
`tailscale set`.

Updates tailscale/corp#30536

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2025-07-22 13:54:28 -07:00
KevinLiang10
19faaff95c
cmd/tailscale/cli: revert key for web config for services to FQDN (#16627)
This commit reverts the key of Web field in ipn.ServiceConfig to use FQDN instead of service
name for the host part of HostPort. This change is because k8s operator already build base on
the assumption of the part being FQDN. We don't want to break the code with dependency.

Fixes tailscale/corp#30695

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-07-22 16:23:51 -04:00
Joe Tsai
0de5e7b94f
util/set: add IntSet (#16602)
IntSet is a set optimized for integers.

Updates tailscale/corp#29809

Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-07-22 12:22:17 -07:00
David Bond
4494705496
cmd/{k8s-proxy,containerboot,k8s-operator},kube: add health check and metrics endpoints for k8s-proxy (#16540)
* Modifies the k8s-proxy to expose health check and metrics
endpoints on the Pod's IP.

* Moves cmd/containerboot/healthz.go and cmd/containerboot/metrics.go to
  /kube to be shared with /k8s-proxy.

Updates #13358

Signed-off-by: David Bond <davidsbond93@gmail.com>
2025-07-22 17:07:51 +01:00
Tom Proctor
22a8e0ac50
cmd/{k8s-operator,k8s-proxy},kube: use consistent type for auth mode config (#16626)
Updates k8s-proxy's config so its auth mode config matches that we set
in kube-apiserver ProxyGroups for consistency.

Updates #13358

Change-Id: I95e29cec6ded2dc7c6d2d03f968a25c822bc0e01

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-22 14:46:38 +01:00
Tom Proctor
6f7e78b10f
cmd/tailscale/cli: make configure kubeconfig accept Tailscale Services (#16601)
The Kubernetes API server proxy is getting the ability to serve on a
Tailscale Service instead of individual node names. Update the configure
kubeconfig sub-command to accept arguments that look like a Tailscale
Service. Note, we can't know for sure whether a peer is advertising a
Tailscale Service, we can only guess based on the ExtraRecords in the
netmap and that IP showing up in a peer's AllowedIPs.

Also adds an --http flag to allow targeting individual proxies that can
be adverting on http for their node name, and makes the command a bit
more forgiving on the range of inputs it accepts and how eager it is to
print the help text when the input is obviously wrong.

Updates #13358

Change-Id: Ica0509c6b2c707252a43d7c18b530ec1acf7508f

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-22 10:07:09 +01:00
Jordan Whited
8453170aa1
feature/relayserver: fix consumeEventbusTopics deadlock (#16618)
consumeEventbusTopics now owns server and related eventbus machinery.

Updates tailscale/corp#30651

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-21 12:36:16 -07:00
David Bond
c989824aac
cmd/k8s-operator: Allow specifying cluster ips for nameservers (#16477)
This commit modifies the kubernetes operator's `DNSConfig` resource
with the addition of a new field at `nameserver.service.clusterIP`.

This field allows users to specify a static in-cluster IP address of
the nameserver when deployed.

Fixes #14305

Signed-off-by: David Bond <davidsbond93@gmail.com>
2025-07-21 19:06:36 +01:00
Andrew Lytvynov
0d03a3746a
feature/tpm: log errors on the initial info fetch (#16574)
This function is behind a sync.Once so we should only see errors at
startup. In particular the error from `open` is useful to diagnose why
TPM might not be accessible.

Updates #15830

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-07-21 10:35:53 -07:00
Jordan Whited
1677fb1905
wgengine/magicsock,all: allocate peer relay over disco instead of PeerAPI (#16603)
Updates tailscale/corp#30583
Updates tailscale/corp#30534
Updates tailscale/corp#30557

Signed-off-by: Dylan Bargatze <dylan@tailscale.com>
Signed-off-by: Jordan Whited <jordan@tailscale.com>
Co-authored-by: Dylan Bargatze <dylan@tailscale.com>
2025-07-21 10:02:37 -07:00
Brad Fitzpatrick
5d4e67fd93 net/dns/recursive: set EDNS on queries
Updates tailscale/corp#30631

Change-Id: Ib88ea1bb51dd917c04f8d41bcaa6d59b9abd4f73
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-07-21 09:06:13 -07:00
Raj Singh
d6d29abbb6 tstest/integration/testcontrol: include peer CapMaps in MapResponses
Fixes #16560
Signed-off-by: Raj Singh <raj@tailscale.com>
2025-07-21 08:28:10 -07:00
Tom Proctor
f421907c38
all-kube: create Tailscale Service for HA kube-apiserver ProxyGroup (#16572)
Adds a new reconciler for ProxyGroups of type kube-apiserver that will
provision a Tailscale Service for each replica to advertise. Adds two
new condition types to the ProxyGroup, TailscaleServiceValid and
TailscaleServiceConfigured, to post updates on the state of that
reconciler in a way that's consistent with the service-pg reconciler.
The created Tailscale Service name is configurable via a new ProxyGroup
field spec.kubeAPISserver.ServiceName, which expects a string of the
form "svc:<dns-label>".

Lots of supporting changes were needed to implement this in a way that's
consistent with other operator workflows, including:

* Pulled containerboot's ensureServicesUnadvertised and certManager into
  kube/ libraries to be shared with k8s-proxy. Use those in k8s-proxy to
  aid Service cert sharing between replicas and graceful Service shutdown.
* For certManager, add an initial wait to the cert loop to wait until
  the domain appears in the devices's netmap to avoid a guaranteed error
  on the first issue attempt when it's quick to start.
* Made several methods in ingress-for-pg.go and svc-for-pg.go into
  functions to share with the new reconciler
* Added a Resource struct to the owner refs stored in Tailscale Service
  annotations to be able to distinguish between Ingress- and ProxyGroup-
  based Services that need cleaning up in the Tailscale API.
* Added a ListVIPServices method to the internal tailscale client to aid
  cleaning up orphaned Services
* Support for reading config from a kube Secret, and partial support for
  config reloading, to prevent us having to force Pod restarts when
  config changes.
* Fixed up the zap logger so it's possible to set debug log level.

Updates #13358

Change-Id: Ia9607441157dd91fb9b6ecbc318eecbef446e116
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-21 11:03:21 +01:00
KevinLiang10
5adde9e3f3
cmd/tailscale/cli: remove advertise command (#16592)
This commit removes the advertise command for service. The advertising is now embedded into
serve command and unadvertising is moved to drain subcommand

Fixes tailscale/corp#22954

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-07-18 15:06:09 -04:00
KevinLiang10
e01618a7c4
cmd/tailscale/cli: Add clear subcommand for serve services (#16509)
* cmd/tailscale/cli: add clear subcommand for serve services

This commit adds a clear subcommand for serve command, to remove all config for a passed service.
This is a short cut for user to remove services after they drain a service. As an indipendent command
it would avoid accidently remove a service on typo.

Updates tailscale/corp#22954

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>

* update regarding comments

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>

* log when clearing a non-existing service but not error

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>

---------

Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-07-18 13:46:03 -04:00
Andrew Lytvynov
6c206fab58
feature/tpm: try opening /dev/tpmrm0 before /tmp/tpm0 on Linux (#16600)
The tpmrm0 is a kernel-managed version of tpm0 that multiplexes multiple
concurrent connections. The basic tpm0 can only be accessed by one
application at a time, which can be pretty unreliable.

Updates #15830

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-07-18 10:17:40 -07:00
Claus Lensbøl
d1ceb62e27 client/systray: look for ubuntu gnome
Ubuntu gnome has a different name on at least 25.04.

Updates #1708

Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-07-18 09:10:00 -07:00