Skip to content

v0.7.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 May 06:22
· 437 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.7.1
This tag was signed with the committer’s verified signature.
fengyily F1
GPG key ID: 32A0CA9EB26E2939
Verified
Learn about vigilant mode.
a94b0e4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenNHP v0.7.1

OpenNHP v0.7.1 expands the project beyond the original three daemons into a fuller Zero Trust platform: a new TCP relay component for cross-network reachability, a browser-native JavaScript agent, an OIDC authentication plugin for enterprise SSO, and the public AWS demo infrastructure that ties them together at opennhp.org.

This release ships 420 commits since v0.6.0.

Note on versioning: v0.7.0 was tagged but never published as a Release due to a tooling lock during artifact upload. v0.7.1 is the first cleanly published release in the 0.7.x line and contains everything intended for v0.7.0 plus a handful of demo/UX fixes that landed since.

Highlights

New components

  • NHP-Relay — a new TCP relay daemon (endpoints/relay/) that lets agents reach servers across NAT'd or otherwise unreachable networks. Hardened with TLS 1.3-only, bounded channel sends to prevent goroutine leaks, X-Real-IP-based client identification, and an O(1) per-relay connection cap. (#1502, bf92704)
  • JS-Agent — a browser-native NHP agent (endpoints/js-agent/) implementing the full protocol in TypeScript, including both Curve25519+AES-GCM and SM2/SM3/SM4 cipher suites. Supports UDP, WebSocket, and Relay transports. (#1517, 6709d00)
  • OIDC plugin — server-side authentication plugin that delegates to any OIDC provider (Auth0, Okta, etc.), with automatic redirect-to-resource on successful auth. (f71277b, 31206cc)

Public demo infrastructure

  • Terraform demo stack for AWS us-east-2 provisioning nhp-server, nhp-ac, and nhp-relay behind nginx + Let's Encrypt, with Cloudflare DNS-01 cert renewal. (0a881b3, cb7291e)
  • Live demo at agent.opennhp.org hosting the JS-Agent demo page. (5cf6184)
  • All deploy automation lives in .github/workflows/deploy-demo-v2.yml and infra-demo.yml.

Login & authentication UX

  • New login page with SSO support, QR code login, OTP code login, multi-language UI, and dual IP display. (9abcd93, 086a437, 2170368)

Tooling & CLI

  • --json output flag on the CLI for scriptable integration. (#1346, 634e3d8)
  • Build Binaries workflow is now manual-only with platform checkboxes (Linux / Windows / macOS) and an explicit "create release" toggle. (b205fce, fcb4cc6)
  • Plugin build pipeline now auto-discovers all plugins in server_plugin/, supports nested directory layouts, and can pull external plugin repos via JSON config. (cdabbb1, b6cf9d0, cac6f52)
  • All daemons now print version banners on startup. (c25d138)

Documentation

  • New Protocol Reference and Glossary pages (English + Simplified Chinese), plus llms.txt for AI agent consumption.
  • README translations for zh-cn, zh-tw, de, ja, fr, es.
  • New Vision section, refreshed badges, and an animated SVG protocol-flow diagram.
  • Stated thesis added to README: "Visibility = Vulnerability."

Notable fixes

  • Security review pass addressing state handling, MITM exposure, DoS surface, and account ID leakage. (e2c5336)
  • OIDC redirect hardening — RedirectUrl validated before server-side redirect; HTML error fallback and nil-safety added. (55db41f, 63552e0)
  • Session cookies now carry the Secure flag. (#1319)
  • KGC master key file permissions tightened. (#1337)
  • IPv6 support — multiple critical bugs fixed in the IPv6 implementation.
  • Crypto error handling — proper error propagation across all crypto operations; panics in crypto/peer/compression code paths fixed via fuzz testing. (#1338, 6534cf6)
  • GOPROXY is now configurable instead of hardcoded in Docker. (#1345, closes #1314)
  • Default cipher scheme aligned between code defaults and Docker quick-start config.
  • errcheck linter enabled across the codebase; all unchecked errors fixed.

Performance

  • Per-relay connection cap is now O(1) under a dedicated lock instead of scanning the full session map. (e7b74e6)
  • Go build cache enabled in deploy-demo-v2 for faster CI runs. (0eb1cf0)

Removals

  • WebRTC transport removed from the server. (757c647)

Upgrade notes

  • The [webrtc] section in server/etc/config.toml is now deprecated; the server logs a warning if it is still present and otherwise ignores it.
  • New optional configs: relay.toml on nhp-server (peer table for relays), db.toml (now optional, was previously required).

Compatibility

Built and tested with Go 1.25. Plugins must be built with the same Go version as the daemon they load into.

Full Changelog: v0.6.0...v0.7.1

Assets 6
Loading