[ClusterLabs] Corosync 3.2.0 is available at corosync.org!

[Jan Friesse]

I am pleased to announce that the latest maintenance release,
Corosync 3.2.0, is available immediately from the GitHub release
section at https://github.com/corosync/corosync/releases.

This release contains important bug fixes and improvements.
The most notable changes (in commit date order) are:

- Fixed CVE-2026-35091, CVE-2026-35092, CVE-2026-81666 and
   CVE-2026-81665. As with previous CVEs, if you use encryption
   and/or a trusted network, you are protected.

- Added a new API for storing extra information in votequorum. See
   the man pages for votequorum_get_qdevice_extra_info(3),
   votequorum_set_qdevice_extra_info(3) and
   votequorum_model_initialize(3) for usage details. This introduces
   a bump to the library soname, but the API and ABI remain fully
   backward compatible.

- The service sync abort callback is now correctly called during the
   barrier phase. This is a highly important fix; if you have been
   observing stalled behavior during synchronization (such as ghost
   cluster members), this patch should solve
   the problem.

- Encryption is now enforced at compile time. More information about
   this change is included in the commit itself
   (65f9450829de5c9c3164e5196b2887cb08308637), the proposal PR
   (https://github.com/corosync/corosync/pull/821) and the mailing list
   (https://lists.clusterlabs.org/pipermail/users/2026-May/036727.html).
   This primarily changes the default configuration. If you still rely
   on unencrypted Corosync and/or the legacy UDPU transport, it is
   still possible to enable them via the --enable-unencrypted and
   --enable-udpu configure flags. This shift in default security is the
   primary reason for bumping the minor version.

- Dynamically fetch cipher and hash lists. The cipher/hash lists are
   now fetched directly from knet (or a hardcoded list if knet support
   is not available). These are now displayed in the corosync -v output
   and properly validated during configuration parsing.

- Removed the Zero-Copy CPG. We were unable to find any users of
   this API and because it was unfinished and seriously flawed, we
   decided to remove it entirely. Backward compatibility for existing
   applications is kept, as the standard CPG API is now used
   seamlessly as a fallback.

- Fixed an issue with knet ping timers where the token timeout was
   incorrectly calculated during a configuration reload.

- Fixed Rust bindings so that bindgen generated files now contain
   only the required types and functions, rather than pulling in the
   almost entire standard C library.

Complete changelog for 3.2.0:

     Andrew Price (1):
           .gitignore: Ignore cscope.out

     Christine Caulfield (1):
           CPG: Remove zero-copy CPG

     Dina Tagantseva (1):
           vqsim: Check partition number is in range

     Fabio M. Di Nitto (2):
           use #include <poll.h> consistently
           totemknet: Add KNET_IOV_LEN_MAX

     Jan Friesse (19):
           testsam: Initialize err
           testcfg: Pass pointer to phtread
           coroparse: Do not format too long path
           main: Remove discards const qualifier warnings
           rust: Allow trailing nul in CPG names
           totemconfig: Fix knet ping timer calc on reload
           totemsrp: Return error if sanity check fails
           totemsrp: Fix integer overflow in memb_join_sanity
           totemknet: Warn if ip_dscp option is unsupported
           Enforce encryption at compile time
           util: Refactor util_is_valid_knet_*_model
           crypto: Support for knet_get_crypto_cipher_list
           crypto: Support for knet_get_crypto_hash_list
           quorum: Fix inconsistent union access warning
           cpg: Fix inconsistent union access warning
           totemsrp: Fix int overflow in commit_token_sanity
           totempg: Replace assert with check in deliver_fn
           rust: Fix warnings issued by newer rustc
           votequorum: Don't segfault when callbacks is NULL

     MichalM132 (1):
           cfgtool: Fix typo

     Shannon Sterz (1):
           man: document knet_link_priority behaviour for 0 and 1

     Thomas Jones (1):
           Add qdevice extra info to votequorum

     Thomas Lamprecht (1):
           sync: Call service abort cb also in barrier phase

     statzitz (1):
           init: Add openrc init script

Upgrade is highly recommended.

Thanks/congratulations to all people that contributed to achieve this
great milestone.