Repository navigation

Releases

podnet v0.4.0-beta.5 Pre-release

Pre-release

github-actions released this 11 Nov 23:56

v0.4.0-beta.5

8f53288

A prerelease of podnet, for tests. It follows v0.4.0-beta.4.

Binaries

File	System
`podnet-x86_64-unknown-linux-musl`	Linux x86-64
`podnet-aarch64-unknown-linux-musl`	Linux ARM64
`podnet-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`podnet-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`podnet-i686-unknown-linux-musl`	Linux x86 (32-bit)
`podnet-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`podnet-loongarch64-unknown-linux-musl`	Linux LoongArch64
`podnet-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. llms.txt and llms-full.txt are the
manual and the documents as plain text. SHA256SUMS lists each file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.5 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.5   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Breaking

None.

Changes for a tester

podnet pod --backend seccomp: a connect to an IPv4-mapped loopback
address (::ffff:127.0.0.1, from a dual-stack socket, as .NET makes) goes
direct, as a connect to 127.0.0.1 does. Before, it went to the -x
chain (T-255).
podnet doctor has the row ssh_relay: it probes the relay of podnet ssh-relay (the TCP connect, the SSH banner, the auth of the user, the
time). Give the relay with --ssh-relay HOST:PORT --ssh-user USER, or the
row reads the relay of a running ssh-relay instance; with no relay the
verdict is unknown. doctor --json has the new key ssh_relay (T-165).
podnet takes the crates of PodUtils/podcrates at v0.25.0 (T-137).

What to report

Open an issue in PodUtils/podnet with the output of podnet doctor --json
and podnet pod doctor --json, the command, and the stderr of the command
with -v. The test guide is GitHub #89.

Limits

This is a beta. Each item of Breaking can change again before the stable
release.
No crates.io release of podnet exists.
The Rekor inclusion proof is not checked by podnet update.
The row ssh_relay is not measured against a live relay.
The limits of v0.4.0-beta.4 stand.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

T-132: use try_update, remove the macro update_atomic! (7963170)
T-132: record done (6686ff5)
T-132: cite the rebased commit 7963170 (4831c4d)
T-165: a row of podnet doctor probes the SSH relay (connect, banner, auth, time) (7395b6a)
T-165: done (the row ssh_relay of doctor); Done section; leave the work order (b355e3a)
T-165: cite the rebased commit 7395b6a (3838554)
T-255: the seccomp connect takes an IPv4-mapped loopback address (::ffff:127.0.0.1) as loopback (e78bde9)
T-255: record done (d1bf8ac)
T-255: cite the rebased commit e78bde9 (1e0f8f8)
T-137: the crates of podcrates at v0.25.0 (no hand-off for podnet; pod-netstack has the calls of T-249) (e64fb99)
T-245: done (v0.4.0-beta.4 at 9df5438; release run 43104434114, release-proofs 43107969792); T-249 open again on podcrates v0.25.0; handoff (fe20246)
record: #454 closed (podcrates v0.25.0); map #456 (COORD-038) (2a8b30c)
T-249: blocked on three gaps of pod-netstack (#457); the move waits on a local branch (457a195)
T-256: version 0.4.0-beta.5, its notes and its entry (T-255 for podrunner, the ssh_relay row, podcrates v0.25.0) (8f53288)

Assets 17

podnet v0.4.0-beta.4 Pre-release

Pre-release

github-actions released this 11 Nov 21:59

v0.4.0-beta.4

9df5438

A prerelease of podnet, for tests. It follows v0.4.0-beta.3.

A user of cfrs reads the notes of v0.4.0-beta.1 first. They give the
rename and the move from cfrs.

Binaries

File	System
`podnet-x86_64-unknown-linux-musl`	Linux x86-64
`podnet-aarch64-unknown-linux-musl`	Linux ARM64
`podnet-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`podnet-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`podnet-i686-unknown-linux-musl`	Linux x86 (32-bit)
`podnet-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`podnet-loongarch64-unknown-linux-musl`	Linux LoongArch64
`podnet-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. llms.txt and llms-full.txt are the
manual and the documents as plain text (T-222). SHA256SUMS lists each
file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.4 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.4   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Breaking

A command or a script written for v0.4.0-beta.3 must change for each item
below.

podnet pod -r stops with exit 64 when an earlier rule shadows a later
reject rule. Give --allow-shadowed-rules to keep the old order. A rules
file of the router with such a rule does not load. A shadowed rule of
another action gives a warning only (T-242).
scripts/install.sh stops before each download when the tag is not a
release tag, or when PODNET_REPO is not OWNER/NAME. install.sh and
podnet update need exactly one valid line of SHA256SUMS for the file
(T-239).
warp: a registration POST that got an HTTP answer (a 5xx too) is not
sent to the second API host. The identity file can hold a device with
state: "created" after a kill; the next run finishes it with a PATCH
and makes no new device. A second registration of one identity file waits
for the lock, and stops with exit 75 after 60 s (T-241).
warp tun --default-route: a second warp tun on one state directory
stops with "another warp tun runs". The new resolv.conf has the mode of
the old file (0644 for a new file), not the mode of the umask (T-240).
The netns backend makes a veth pair when the namespace cannot open
/dev/net/tun. Before, the pod stopped there (T-174).

doctor --json is schema 1 with a fixed key set: keys are only added. It has
the new keys quick and lanes (T-216, T-217). docs/protocol.md section 9
lists each key; section 10 is the connector profile (T-218).

Changes for a tester

The router:

podnet route --config FILE: a YAML file of networks, groups,
policies, health, control and doors. Each door is a SOCKS5 and HTTP
CONNECT door on TCP or unix:, over a network, a group or a rules file. A
door can have a DNS door (dns, dns_upstream). --detach --name N and
autostart add take it (T-100, T-098).
route --check --to HOST:PORT [--door N]: a dry run that prints the rule,
the way and the member of each door, with no dial (T-177).
route --status unix:/PATH [--json]: the state of a running router from
its control socket: each group, the health, the round-trip time and its
floor, the flows, the bytes and the head (T-097, T-178).
The key kernel of the router file writes policy routing with no ip
program: a table, a default route and an fwmark rule for each WAN, and a
weighted multipath route; it needs CAP_NET_ADMIN (T-119). The keys
masquerade, mss_clamp, kill_switch and rp_filter (each on by
default) add a masquerade and an MSS clamp through nf_tables, an
unreachable route when each WAN is down, and rp_filter 0 on each WAN
(T-120).
route --config FILE --export mwan-json prints the WANs in the JSON form
of the mwan director (T-121).
splits: GROUP: up=MEMBER down=MEMBER sends the UDP datagrams of a
group by one member and receives them on another (off by default; TCP is
not split) (T-179).
health takes down_after, up_after, cooldown, timeout and
window (T-097, T-178). policies takes weighted, rr, minrtt,
leastload and protect (T-178).

Fixes:

The tests that need a namespace, a loopback or a TUN skip on hosts that
do not allow them (GitHub runners): the veth wire, the register tests of
WARP, the kernel mode of the router.
Each probe child of pod doctor closes the descriptors that it inherits.
ci runs the netns tests as root on a GitHub runner (T-250); live
probes the hosted mailboxes and relays through a proxy for TCP 443 only
(T-253).
The documents name the former name once, in a footnote of the README
(T-254).

Forwards and tools:

podnet forward -L udp:LISTEN=HOST:PORT over the datagrams of a network,
and --dns ADDR:PORT --dns-upstream HOST:PORT (T-099).
podnet expose TARGET --via tunnel|relay|switch (T-099).
podnet ssh-relay --server HOST:PORT --user USER --url-match TEXT
runs the SSH forward-relay leg and keeps its session: it reconnects with
a backoff and records the new URL (T-165).
podnet bench URL [--json]: requests, errors, rate and latency over the
way out (T-221).
The network netbird:[PORT] (default 1080) dials an address through the
SOCKS5 listener of NetBird in netstack mode; a name target fails, as that
mode has no DNS. net doctor has a row for the listener (T-246).
NetBird, Firezone and ZeroTier are studied as networks
(docs/research/podnet/overlays.md, T-118).
--help --json on each command prints the manual of that command as JSON
(T-222).

Overlays:

net tailscale --tailnet NAME (or PODNET_TAILNET) opens the door only
when tailscaled is Running in that tailnet: exit 78 in another
tailnet, exit 69 when the daemon is not ready. net doctor has a row for
tailscaled (T-243).

Library and crates:

warp (the WireGuard leg): the handshake, the cookie, the session and
the timers are the crate pod-wg of podcrates. It fixes these defects:
a bad response reset the times of a rekey; the age of a session was read
from the system clock; a TAI64N timestamp could go back or repeat; a
responder under load refused each handshake (no mac2 of a cookie); a
failure of the random bytes was a panic. The keys are wiped on drop
(T-137).
podnet takes the crates of PodUtils/podcrates at v0.22.0. The
measurement of the edge of Cloudflare's tunnels moved to
PodUtils/podcrates:scripts/services/edge-facts.sh (T-137).

What to report

Open an issue in PodUtils/podnet with the output of podnet doctor --json
and podnet pod doctor --json, the command, and the stderr of the command
with -v.

Limits

This is a beta. Each item of Breaking can change again before the stable
release.
No crates.io release of podnet exists.
The Rekor inclusion proof is not checked by podnet update.
warp --cc reno|cubic is slow on a link that gives one ACK for each round
trip (smoltcp 0.14; PodUtils/podcrates#66). Keep the default (no
controller).
The door of the router has no UDP ASSOCIATE (T-098). The byte meter of a
member counts TCP flows only, not UDP datagrams (T-178).
warp forward is not yet an alias of podnet forward (T-099).

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Documents

docs: the hand-off names podcrates v0.16.0 (514a765)
docs: the hand-off names the takes and T-231 (821e061)

Other

record: T-235 done (v0.4.0-beta.3 at 649c8e3; release 42949492119, release-proofs 42952184194) (d3fad49)
T-137: take podcrates v0.17.0 (dd04b36)
record: map #426 (COORD-017, the take of v0.17.0) (90428ed)
T-137: take pod_hold::connect and pod_hold::packet (e4d4049)
T-231: podnet pod --loopback-rules applies the rules to a loopback connect (8dd7776)
record: T-231 done (4aef13c)
record: #426 closed (podcrates recorded taken e4d4049) (da6705f)
record: the cut of pod-netstack (COORD-018, #427) (f7ed86b)
T-098: the rules of the router to a network, a group or a refusal (02c4bec)
record: T-098 partial (the rules of the router) (b5dfc29)
record: T-098 names its commit after the rebase (02c4bec) (54281d2)
T-099: podnet forward -L LISTEN=HOST:PORT over a network of the registry (1058f08)
record: T-099 partial (podnet forward over a network) (8877f29)
record: file the donor review (#428 to #443): T-237 to T-244, comments on #375 and #359, COORD-019 to COORD-025 (5e16f6d)
record: #438 closed (podssh recorded the proposals, PodUtils/podssh#188) (a3d0db8)
T-238: bind_private never shows the socket at the mode of the umask (3c6173f)
record: T-238 done (32c2b53)
record: #429 closed (T-238); map #444 (COORD-026) (193bd36)
T-137: take pod-netstack of podcrates v0.20.0 (d23ce4e)
record: #427 closed (the take of pod-...

Assets 17

podnet v0.4.0-beta.3 Pre-release

Pre-release

github-actions released this 11 Nov 03:21

v0.4.0-beta.3

649c8e3

A prerelease of podnet, for tests. It follows v0.4.0-beta.2.

A user of cfrs reads the notes of v0.4.0-beta.1 first. They give the
rename and the move from cfrs.

Binaries

File	System
`podnet-x86_64-unknown-linux-musl`	Linux x86-64
`podnet-aarch64-unknown-linux-musl`	Linux ARM64
`podnet-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`podnet-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`podnet-i686-unknown-linux-musl`	Linux x86 (32-bit)
`podnet-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`podnet-loongarch64-unknown-linux-musl`	Linux LoongArch64
`podnet-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. SHA256SUMS lists each file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.3 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.3   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Breaking

A command or a script written for v0.4.0-beta.2 must change for each item
below.

warp exec and warp shell try the netns backend first, then seccomp
(was seccomp first). The line of the backend ends with Choice: REASON.
Give --backend seccomp for the old choice (T-113).
The netns backend refuses a TCP connect to the gateway 10.66.255.254 at
once (a RST), and drops a datagram to it (not port 53). Before, the flow
went to the proxy. podnet pod --host-gateway sends them to the loopback
of the host (T-112).
A pod with the seccomp backend stops at its start with exit status 3 when
the pod cannot read the memory of a program (/proc/<pid>/mem). Before,
the program ran and each connect was refused (T-231).
A dual-stack socket that connects to the IPv4-mapped form of a fake
address (::ffff:198.18.x.y, as .NET and Java do) goes to the proxy with
the name. Before, the proxy got the fake address and the dial failed
(T-233).
The netns router does not take a packet with an IP header under 20 bytes,
or a fragment past the first, as a SYN (T-234).

podnet pod doctor --json has the new object hold and the new row
read program memory (T-230, T-231). The other keys do not change.

Changes for a tester

The way out:

--egress SPEC on each command: direct (as --no-proxy), a proxy URL (as
--proxy), relay or relay:URL (as --transport relay and --relay).
With podnet pod, each --egress is one -x hop of the chain, in its
order. The old flags stay (T-060).
podnet pod -x takes socks5h+unix:/PATH and http+unix:/PATH (T-060).
serve --ingress relay --detach and git serve --ingress relay --detach
return when the node of the pair is connected to the relay. Before, a
client at once got HTTP 503: reverse: node offline (T-236).

The file server and git:

podnet serve DIR: --list (a listing in HTML and JSON), --users FILE
with the roles read and write, --pin, --anon-read, --hash-password,
--upload (PUT and a form, --max-upload), more than one --local, and
--ingress tunnel|relay|none (the road to the visitors) with --pair
(T-088 to T-091).
podnet share --local and a directory in share (T-091).
podnet git serve --root DIR: smart HTTP through a quick tunnel, SSH with
--authorized-keys, --ingress relay through a relay pair, git init
and git urls (T-092 to T-094).

Pod backends (podnet pod, warp exec, warp shell):

warp exec --detach --name N keeps a pod under the supervisor: podnet ps, logs, stop (T-109). warp exec --join N -- CMD runs a command in
that pod (T-110). podnet pod --session DIR shares the inbound listeners
and the fake DNS table.
podnet pod --host-gateway (T-112).
pod doctor prints hold netns and hold seccomp: the level
(enforced, advisory or none) and what the backend does not hold
(T-230).
scripts/pod-runner-measure.sh measures the pod with the runner of
actions/runner v2.338.2, a Node fetch, actions/checkout and
actions/setup-node (docs/reports/pod-runner.md, T-229).

WARP:

Each sender that waits on the WARP QUIC socket gets its wake-up (T-228).
podnet uses noq through pod-quic (no quinn in the tree) (T-137).

Library and crates:

podnet-core has the network types (Target, Dial, Datagrams,
Network, Link; T-055), the dialers (T-056), the combinators Chain,
Rules, Race and Failover (T-058). podnet::networks is the registry
of the networks and the parser of their specs (T-059).
podnet::road and podnet::roads: the trait Road, the table of services
and the roads local, tunnel, relay and vnet (T-062); guard puts the users,
the roles and the PIN on any service (T-084).
Balance: a group of ways with weights and a kill switch, and the health of
each member (Up, Cooldown, Probation, Down) with its probe and its
status document (T-096, T-097). No command uses them yet (T-099, T-100).
podnet takes pod-quic and pod-hold of PodUtils/podcrates v0.15.0: the
generic core of the hold of the pod backends is in pod-hold (T-137,
T-232).

What to report

Open an issue in PodUtils/podnet with the output of podnet doctor --json
and podnet pod doctor --json, the command, and the stderr of the command
with -v.

Limits

This is a beta. Each item of Breaking can change again before the stable
release.
No crates.io release of podnet exists.
The Rekor inclusion proof is not checked by podnet update.
T-060: a chain of --egress works with podnet pod only. The registry has
no WARP network yet (T-057).
T-229: run.sh of the runner is not measured to its long poll.
T-231: the rules of podnet pod do not apply to loopback TCP under the
seccomp backend yet.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Documents

docs: the hand-off of the session of 2026-11-11 (d366131)
docs: the hand-off names T-062 to T-097 and the release step (f677751)
docs: the hand-off: the notes are current (5f3c8c0)

Build, tests and CI

secrets: allow the test URLs of T-056 and T-092 (8a0feda)
live: the agent step skips when the quick-tunnel service limits the address (649c8e3)

Other

T-113: warp exec and warp shell try the netns backend first (44e323a)
T-113: done (44e323a) (80c09a4)
T-109: warp exec --detach --name N keeps a pod under the supervisor (6992453)
T-109: done (6992453) (be6dc34)
T-110: warp exec --join N runs a command in a detached pod (101d6e2)
T-110: done (101d6e2) (24f227a)
T-112: netns: the gateway address reaches the loopback of the host, when the user asks (af529c1)
T-112: done (af529c1) (025be76)
Merge main into wt-m7c (8eeaa8b)
T-088: the file server gives a listing of a directory in HTML and JSON (c1d4daf)
T-088: done (c1d4daf) (c0d3f29)
T-089: the file server has users with read and write roles, and a PIN (73e250e)
T-089: done (73e250e) (bdbc30e)
T-090: the file server takes uploads into the tree with PUT and a form (03bae2f)
T-090: done (03bae2f) (d402cd7)
T-091: serve DIR with --via, more than one --local, share --local and a directory in share (3d9e225)
record: T-091: partial; the live run of the file server steps waits for a live host (38dbfb3)
Merge T-088, T-089, T-090, T-091 (file server: listing, users and PIN, uploads, serve DIR) (50e8c7f)
T-228: each sender that waits on the WARP QUIC socket gets its wake-up (1d556fb)
T-228: done (1d556fb) (1384736)
T-137: take pod-quic of podcrates v0.14.0 (b7b0aef)
T-137: record the take of pod-quic (b7b0aef) (f163815)
T-227: done (v0.4.0-beta.2 at 5465007; release 42833480545, release-proofs 42836050242) (31d040f)
record: T-229 to T-232 from PodUtils/podvm#228 (podrunner asks; the pod-hold hand-off) (8a3ca7b)
T-055: add the network types to podnet-core (d9ac293)
T-055: done (d9ac293) (b63f656)
T-056: add dialers for direct, the proxy, the relay, the upstream chains, the tailnet and the vnet (03a3b49)
T-056: done (03a3b49) (c66997a)
Merge T-055, T-056 (the network types in podnet-core and the dialers) (456834e)
record: the calls on the start conditions (T-055, T-056, T-092) and on pod-hold (T-232) (8f7233a)
T-091: the live step of the file server over the relay uses a free port (7221d6b)
T-092: a CGI runner for git http-backend and the smart HTTP router (60a1d80)
T-092: done (60a1d80) (d3679f4)
T-094: podnet git serve, git init, git urls, the doctor line and the live steps (84b5c5e)
record: T-094: partial (84b5c5e); the live steps have not run (fac01ae)
Merge T-092 (git smart HTTP) and T-094 (podnet git serve) (b573e4d)
T-094: the live step of git over the relay stops its gitrelay instance (9e8d177)
T-094: the live git steps clone the branch main (8383095)
record: map #420 to #423 (#423: the live steps of T-091 and T-094) (4e81cc8)
record: T-091 and T-094 done (live 42851836974); the hand-off of the pause of 2026-11-10 (423bd19)
T-137, T-232: take pod-hold of podcrates v0.15.0 (b759937)
record: T-232 done (b759937); the call on podcrates T-169 and T-170 (a6ef7ef)
T-058: the combinators Chain, Rules, Race and Failover (8d85f9f)
record: ...

Assets 15

podnet v0.4.0-beta.2 Pre-release

Pre-release

github-actions released this 10 Nov 14:37

v0.4.0-beta.2

5465007

A prerelease of podnet, for tests. It follows v0.4.0-beta.1.

A user of cfrs reads the notes of v0.4.0-beta.1 first. They give the
rename and the move from cfrs.

Binaries

File	System
`podnet-x86_64-unknown-linux-musl`	Linux x86-64
`podnet-aarch64-unknown-linux-musl`	Linux ARM64
`podnet-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`podnet-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`podnet-i686-unknown-linux-musl`	Linux x86 (32-bit)
`podnet-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`podnet-loongarch64-unknown-linux-musl`	Linux LoongArch64
`podnet-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. SHA256SUMS lists each file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.2 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.2   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Breaking

A command or a script written for v0.4.0-beta.1 must change for each item
below.

Each message of podnet pod and podnet pod doctor starts with
podnet pod: (was podnet-netns:). podnet pod --version prints the
line of podnet --version (T-135). Change each script that matches the
old prefix.
The seccomp backend has a new default ceiling of tracked sockets:
(RLIMIT_NOFILE - 64) / 2, from 64 to 65536 (was 4096). The supervisor
raises its soft limit to the hard limit after it starts the program. The
program keeps its limit. Use --flow-budget N (64 to 1048576) to set the
old value. A value above the default gives a warning (T-181).
A socket call that fails because the supervisor has no descriptor for a
socket pair gets EMFILE (was EIO) (T-181).
At the exit of a seccomp pod, one line on stderr gives the counts of the
refused socket calls, when a call was refused (T-181).
The seccomp backend gives the program the accepted inbound connection
itself, with no relay and no socket pair. The accepted socket has the name
of the listening socket, and the supervisor reads no byte of it (T-150).
With --flow-log, the pod relays each TCP flow again, to count bytes
(T-157).
The netns backend: podnet pod returns the exit code of the first program
at once. The pod and its router stay until each process of the namespace
ends. A script that waited for the end of the router must wait for the
processes (T-108).
podnet warp nc refuses a destination name over 255 bytes with
invalid destination: ... is longer than the 255 bytes of SOCKS5. Before,
it cut the name. The error words of the SOCKS5 datagram path are those of
pod-proxy. A reply with a SOCKS version other than 5 is refused
(T-224).
A seccomp pod answers a connect or a datagram that a reject or block
rule refuses with ECONNREFUSED (connect) or EACCES (datagram). A
-r rule with an unknown action is a usage error, exit 64 (T-156).

The keys of podnet doctor --json do not change. podnet pod doctor --json
has the new key flow_budget (T-181) and a new row for netfilter (T-152).

Changes for a tester

Pod backends (podnet pod, warp exec, warp shell):

-r takes the actions reject and block, for TCP and for datagrams
(T-156).
--default-action allow|reject and --flow-log FILE (T-157). The log has
one JSON line for each decision and one at the close of each relayed TCP
flow, with bytes_out and bytes_in.
--learn FILE records the destinations. --fail-on-violation FILE refuses
a destination that is not in FILE, and exits 4 when the program exits 0
(T-158). Both are a usage error with --serve.
--flow-budget N and the row flow budget (seccomp) of pod doctor
(T-181).
pod doctor has the row netfilter in a namespace (not a backend). No
backend uses it (T-152).
The seccomp relay has a buffer of 64 KiB for each direction (T-151).
The seccomp backend gives the accepted inbound connection to the program
(T-150).
The netns backend: generic UDP, with a flow table (60 s idle, 256 flows)
(T-111). The pod lives past its first program (T-108). A large TCP
download keeps full speed with a bounded buffer (T-226).
podnet-netns uses pod_proxy::udp for the SOCKS5 datagram path (T-224).
Fuzz targets for the seccomp handlers: seccomp_sendto, seccomp_sendmsg,
seccomp_sockopt (T-154).

WARP:

The send poller of the WARP QUIC socket keeps its wake-up (T-225).

Tunnel and services:

podnet connect URL --stdio carries one stream on stdin and stdout, for an
SSH ProxyCommand through tunnel --forward (T-082).
serve --tar: GET /PATH/?tar gives a directory as one tar stream
(T-085).

Git:

An SSH server for git-upload-pack and git-receive-pack, with host key,
authorized_keys (ed25519 and ecdsa) and anon_read (T-093). It is a
library item; no command starts it yet.

Virtual network:

net socksify --cidr (repeatable), PODNET_SOCKS_CIDRS and
net shim --socks-route send chosen destinations to the SOCKS5 door
(T-167).
net passwd-shim and the row passwd entry for this uid of net doctor
(T-168).
A reader of a wg-quick file, with optional reserved bytes (T-116). It is a
library item.

The CLI and doctor:

podnet pod --version prints the line of podnet --version (T-135).

Build and crates:

The code moved into the crates podnet-core, podnet-serve and
podnet-vnet, and into smaller files. The library paths stay the same
through re-exports (T-046, T-047, T-048, T-051, T-033, T-034, T-037,
T-038, T-040, T-041, T-042, T-044).
podnet takes the shared crates of PodUtils/podcrates up to v0.13.0,
with pod-ws (T-137).
CI checks the citations of the last commit (T-015). The live step updates
from v0.4.0-beta.1 (T-024). The publish to crates.io is a switch (T-023).

What to report

Open an issue in PodUtils/podnet with the output of podnet doctor --json
and podnet pod doctor --json, the command, and the stderr of the command
with -v.

Limits

This is a beta. Each item of Breaking can change again before the stable
release.
No crates.io release of podnet exists.
The Rekor inclusion proof is not checked by podnet update.
T-152: the netfilter probe is not measured on a container, and not on a
runner with AppArmor limits on user namespaces. No backend uses it.
T-181: the counters are for each pod. The per-door counters wait for the
router. The run of 5000 connections is not measured.
T-093: podnet git serve does not exist yet (T-094).
T-151: the netns TCP path was slow for a large transfer before T-226; the
speed on a real proxy is not measured.
T-167: the external shim of the issue is not measured. T-168: ssh-keygen
on a host with no passwd entry is not measured.
T-154: the libFuzzer run is not made for this release.
T-111: a full queue of a UDP flow holds the datagram, with no failover.
T-116: a wg-quick file with PresharedKey is read, but the WireGuard code
does not use it yet.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Build, tests and CI

secrets: the allow file names each commit with 12 hex digits (9026797)
secrets: allow the test URL of mask() at its path in podnet-core (5bf153d)

Other

T-023: publish.yml packs the crates only when the switch crates-io is true (707435f)
T-040: move the seccomp filter to seccomp/filter.rs (9a0e8af)
T-040: move the memory access to seccomp/mem.rs (ab4ada4)
T-040: move the notification helpers to seccomp/notif.rs (5c64f66)
T-040: move the send calls to seccomp/send.rs (51d9d18)
T-040: move listen and accept to seccomp/accept.rs (8ce76c3)
T-040: move the TUN device to netns/tun.rs (90e8851)
T-040: move the descriptor passing to netns/fdpass.rs (082056c)
T-040: move the stack of the netns backend to netns/backend.rs (e45914d)
T-040: move the packet builders to netns/packet.rs (934b7cf)
T-040: remove seccomp.rs and netns.rs from the size allowlist (07a9ac0)
T-040: cite the new files of seccomp/ and netns/ (6f57e61)
T-040: done (9a0e8af to 6f57e61) (908b9b7)
T-154: fuzz targets for the seccomp handlers (6389505)
T-154: done (6389505) (095ad98)
Merge T-040 (the split of the pod backends) and T-154 (fuzz targets of the seccomp handlers) (e51efec)
T-023: done (v0.4.0-beta.1 at e756ce2; release 42729897311, release-proofs 42731594509) (6480b40)
record: T-023 status done (the Done section came first in 6480b40) (ddb2a8d)
record: the work order drops T-023 (done) (98fe7c0)
T-137: move each podcrates tag to v0.9.0 (191f2b4)
T-224: podnet-netns calls pod_proxy::udp for the SOCKS5 datagram path (127c095)
T-224: done (127c095) (620134c)
Merge T-137 (podcrates v0.9.0) and T-224 (pod_proxy::udp in podnet-netns) (24cc236)
record: State: podcrates v0.9.0; the datagram path of upstream.rs is podnet's no more (T-224); v0.4.0-beta.1 (be18168)
record: map COORD-009 (#417) (b1d7835)
T-033: split src/detach.rs into supervise, unix and tests files (d0a6df0)
T-033: split src/update.rs into cosign and tests files (a8e648d)
T-033: split src/doctor.rs into clock_check, tls_check and tests files (9d9b2ed)
T-034: split src/vnet/stack.rs into reactor, service, socket, proof and tests files (8cb6ea8)
T-033, T-034: done (...

Assets 15

podnet v0.4.0-beta.1 Pre-release

Pre-release

github-actions released this 10 Nov 00:52

v0.4.0-beta.1

e756ce2

The first prerelease of podnet, for tests. podnet is the new name of
cfrs. The Cloudflare tunnel is one adapter of podnet. The version line
continues above v0.3.0-beta.12.

The releases up to v0.3.0-beta.12 are the releases of cfrs. They have
cfrs-TARGET and pod-netns-TARGET assets. They are signed as
https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/TAG.
Use that identity to check them. Releases from v0.4.0-beta.1 have the
assets and the identity that this note gives.

Binaries

File	System
`podnet-x86_64-unknown-linux-musl`	Linux x86-64
`podnet-aarch64-unknown-linux-musl`	Linux ARM64
`podnet-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`podnet-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`podnet-i686-unknown-linux-musl`	Linux x86 (32-bit)
`podnet-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`podnet-loongarch64-unknown-linux-musl`	Linux LoongArch64
`podnet-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. SHA256SUMS lists each file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.1 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.1   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Move from cfrs

Run cfrs autostart remove NAME for each entry, and cfrs warp down.
podnet does not see the markers and the units of cfrs.
Install podnet new. cfrs update cannot install it: it looks for the
assets of cfrs.
To keep the WARP device, move ~/.local/state/cfrs to
~/.local/state/podnet, or set PODNET_STATE_DIR. podnet registers no
new device then.
Rename each variable, unit, path and metric of the list below in your
scripts, units and dashboards.

Breaking

A command or a script written for v0.3.0-beta.12 must change for each item
below. Item 1 to 12 are the rename.

The binary is podnet (was cfrs). The assets are podnet-TARGET
(were cfrs-TARGET). The manual page is podnet.1 (was cfrs.1). The
repository is PodUtils/podnet, and the signature identity is
https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/TAG.
The pod-netns binary and its assets are gone. Use podnet pod. It has
each option of the old command line, and podnet pod doctor. The crate
podnet-netns (was pod-netns) is a library only.
The image is ghcr.io/podutils/podnet (was ghcr.io/azathothas/cfrs).
The variables change: CFRS_X is PODNET_X, CFRSNET_X is
PODNET_VNET_X, and CFRSSOCKS_X is PODNET_SOCKS_X. The old names have
no effect. The variables POD_NETNS_QUIET and POD_NETNS_TEST_MEM of the
pod library are PODNET_NETNS_QUIET and PODNET_NETNS_TEST_MEM.
The state directory is ~/.local/state/podnet (was
~/.local/state/cfrs). The run directory is $XDG_RUNTIME_DIR/podnet
(was $XDG_RUNTIME_DIR/cfrs), and podnet-UID in the temporary directory
(was cfrs-UID). podnet does not read the old directories.
The default name of the TUN interface is podnet0 (was cfrs0).
The units are podnet-NAME.service (were cfrs-NAME.service). The cron
marker is # podnet autostart NAME. The blocks and files of warp up
have the names podnet: the block # >>> podnet warp up >>>,
90-podnet-warp.conf and conf.d/podnet-warp.fish. podnet warp down
does not remove the files of cfrs.
The metrics are podnet_* (were cfrs_*).
The paths of the edge are /__podnet/ws and /__podnet/unlock (were
/__cfrs/ws and /__cfrs/unlock). A client and a server must both be
podnet.
The User-Agent is podnet/VERSION (was cfrs/VERSION). The realm of the
proxy login is podnet.
The log filter is podnet=LEVEL (was cfrs=LEVEL), for example
RUST_LOG=podnet=debug.
The default directories of the file commands are ~/Downloads/podnet
and ~/podnet-uploads.

Output and exit codes:

podnet pod doctor uses the verdict words of podnet doctor. The text
form gives ok or fail for each probe and each backend (before: ok,
no, available, unavailable). The JSON form has the new keys
schema (1), verdict for each capability, and verdicts (netns,
seccomp, any). The keys ok, backend_netns, backend_seccomp and
backend_available stay. The exit code stays 3 when no backend can run.
A refused TCP bind exits 69 in net switch, net proxy, warp proxy,
relay connect --listen and net tailscale.
tunnel --config with an origin flag (--port, --forward,
--no-tls-verify) exits 64 and names the flag. It ignored the flag
before.
relay stop checks the pair before it stops the local node.
The ready line of share --json has the keys schema and podnet.
doctor --agent: a row is ok only when the index host and the file host
both answer. doctor --relay URL checks the relay that you name.

Behaviour:

An ingress path: rule matches the decoded path, as cloudflared does:
%XX is decoded, + stays. A rule for /a b now matches /a%20b.
The library static path decodes + as a plus. A bad escape (%zz) is
refused.
The pair file of the relay always has mode 0600. load checks the file.
warp export writes the reserved bytes in the file. warp export --check checks a file.

Changes for a tester

Seccomp backend (podnet pod, warp exec, warp shell):

A TCP socket stays tracked after its connect. Its options and addresses
come from its entry. There is one entry for each socket of each process,
and copies of a descriptor are tracked.
A plain upstream descriptor goes to the program after its handshake.
ICMP datagram sockets, recvmmsg and UDP names over 255 bytes work.
A slow connect dial does not stop the supervisor for other calls.
The close of a UDP socket stops its relay and frees its descriptors. A
datagram written with write(2) leaves the pod. bind on a datagram
socket is recorded, and getsockname reports it.
connect(AF_UNSPEC) dissolves the association of a datagram socket. A
connected datagram socket takes datagrams from its peer only. Datagram and
ICMP sockets keep their IP-level options.
The limits of the UDP relay (ICMP errors, path MTU) are in the
documents.
The fake DNS pool refuses at its end, and names match with no case.
A differential check compares the socket calls with the host kernel. It
closed six TCP gaps.

WARP:

A probe of the TCP data path renews a session that carries no TCP.
warp tun has a SYN probe and --session-max-age, and sets rp_filter
to 0 on its interface.
warp exec, warp shell and warp nc find a running warp up that has
another state directory. warp exec and warp shell take --backend,
and name the backend in one line.
warp forward has the pins of --resolve and a list of the forwards.
status, the ready document and warp status have data_path and the
time of the last TCP probe. warp status names the warp-tun instance.
warp up --tun forwards --replace and refuses the flags that it cannot
forward. warp down and warp up --persist own the fish file only when
podnet wrote it.
warp ssh-config prints a ProxyCommand with the same quote as --write.
warp proxy --dns has a bound and a counter.

Tunnel and DNS:

tunnel verify keeps the tunnel up when this host cannot resolve the name
yet, pins the new public name while the process runs, and names the remedy
when the name does not resolve. Quick-tunnel provisioning does not retry a
DNS failure that cannot recover.
The DoH resolver keeps one connection for each server.
WebSocketTunnel dials through the egress layer and parses IPv6.
An http:// proxy URL with no port has one default port in podnet and
podssh.
The errors of an ingress or config file name the line. The tailnet front
door warns when tailscaled is not logged in.

Virtual network and relay:

The switch counts each packet that it drops. A stack over a switch link has
bounded queues.
The listener table of net doctor names each command that listens.
net proxy --forward takes a name as a real target, reports the failed hop
and reports a failed bind before it prints the forward. net proxy --map
fills the gateway resolver and the shim table.
The doors of net proxy, net tailscale and pod --serve have a deadline
for the client handshake. A unix listener claims its socket path first. The
datagram socket of the vnet shim takes the same user only.
A relay close aborts the session task of the node. The relay node waits
after a local end of stream. relay connect --listen has the instance
surface of connect -L.

Other commands:

serve of a directory with no index.html logs no WARN for the 404 at /.
A nested detached start does not inherit PODNET_DETACH_SUPERVISED.
agent status --json prints the status as JSON.
--no-verify is in the README with its limits.
The start of a session no longer changes the global git identity (a
development fix).

Checks:

A CI job runs the tests with the loopback down.
The source tree moved: src/main.rs is split into the module src/cli/.
The behaviour is the same (a parity snapshot checks it).

What to report

Open an issue in PodUtils/podnet with the output of `...

Assets 15

cfrs v0.3.0-beta.12 Pre-release

Pre-release

github-actions released this 04 Nov 15:39

v0.3.0-beta.12

3b6e173

The twelfth prerelease of cfrs, for tests.

Binaries

File	System
`cfrs-x86_64-unknown-linux-musl`, `pod-netns-x86_64-unknown-linux-musl`	Linux x86-64
`cfrs-aarch64-unknown-linux-musl`, `pod-netns-aarch64-unknown-linux-musl`	Linux ARM64
`cfrs-armv7-unknown-linux-musleabihf`, `pod-netns-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`cfrs-arm-unknown-linux-musleabihf`, `pod-netns-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`cfrs-i686-unknown-linux-musl`, `pod-netns-i686-unknown-linux-musl`	Linux x86 (32-bit)
`cfrs-riscv64gc-unknown-linux-musl`, `pod-netns-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`cfrs-loongarch64-unknown-linux-musl`, `pod-netns-loongarch64-unknown-linux-musl`	Linux LoongArch64
`cfrs-powerpc64le-unknown-linux-musl`, `pod-netns-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

The image is ghcr.io/azathothas/cfrs:v0.3.0-beta.12 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.12 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.3.0-beta.12   # rebuild and compare (x86_64, aarch64)

cfrs update from 0.3.0-beta.8 does the first three checks itself.

Breaking

A command or a script written for beta.11 must change for each item
below.

Output and exit codes:

cfrs doctor says fail where it said refused, in the text and in
--json. Each JSON object has the key status; the old key verdict
keeps the same value for one release. cfrs net doctor says ok,
fail and unknown in place of OK, FAIL and ?.
--detach writes one JSON document on stdout. The human lines are on
stderr.
cfrs status: proxy.kind is the kind of the dial (http, socks5,
socks5h, with +unix or +exec, or direct). It was http for
each proxy.
cfrs wait --timeout exits 124 at its time limit.
cfrs warp env with no proxy variables exits 69 (was 0) and prints
nothing on stdout.
relay connect and relay stop with no pair exit 69 (was 64), and
with a bad pair file 78 (was 64).
share --file with a missing file exits 78 (was 1). share --port 0
and a directory as --identity exit 64 (were 1 and 69).
warp scan --timeout-ms outside 100 to 60000 exits 64 (was clamped).
A bad CFRS_RESOLVE exits 78 for each command (was a warning).
A missing program on warp run --backend netns-raw exits 3 (was 127).

Behaviour:

A bare cfrs share exits 64. Give --mode upload or --dir.
share uploads have mode 0600.
The PIN cookie has Secure: a visit over plain http cannot unlock.
path: of an ingress rule is a regular expression with no anchor, as
in cloudflared. path: /api also matches /x/api and /apix, and
. matches each character. Write ^/api/ for a prefix and \. for a
dot. An invalid expression is a config error (exit 78).
tunnel --check fails a config with no ingress rule.
With --leg-failover serial, the next leg starts after at most 130 s
(quic) or 280 s (http2), not after 8 s.
Each unix socket that cfrs binds has one rule: a live socket is an
error (69), a file that is not a socket is an error (64), a stale
socket is removed (net switch, net proxy, relay connect,
warp proxy).
Root with the HOME of another user writes no file there.
CFRS_FOREIGN_HOME=allow writes anyway.
net ts-shims --out refuses a directory of another user, or one that
other users can write.
cfrs net: a process of another user (also root) cannot use the
switch unix socket, the control socket of the shim, an imported name or
a shim listener.
cfrs net switch --listen tcp://... needs a token: set
CFRS_SWITCH_TOKEN, or give --switch-token-file, to the switch and
to each net proxy --switch tcp://.... With no token, the switch exits
64.
cfrs pod: the default inbound directory is
$XDG_RUNTIME_DIR/pod-netns-inbound, else
$TMPDIR/pod-netns-inbound-<uid>; it was /tmp/pod-netns-inbound. An
--inbound-dir of another user, or one that the group or others can
write, is refused.

Library (cfrs crate):

StaticServer::respond gives a StaticResponse with a reader body
(StaticBody), not a BufferedResponse. A large file gets 200, not
413. StaticDir refuses dotfiles. A ResponseWriter can get more than
one body() call for one response.
IngressRule::path is Option<PathPattern>, not Option<String>.
vnet::switch::serve and attach take a token argument.
cfrs::feature::MetricsEndpoint, metrics_response, METRICS_PATH
and cfrs::util::metrics are removed. The library relay puts its
default origin socket in a private directory of the user.

Fixed

This release has the fixes of the issues #212 to #258 and #279 to #309
(the QA findings), and the podssh study. Each commit names its issue.
The main groups:

Proxy and fetch parsers: request heads to the origin are checked;
hop-by-hop headers stay on their hop; limits for header lines, interim
answers, chunk sizes and trailers; a URL fragment is not part of the
host; a built-in body of no known size is streamed.
Edge HTTP/2: limits for the handshake, a failed attempt and the
configuration push. WebSocket: 502 before the dial, IPv6 relay hosts.
Egress: an unresolvable proxy host is an error, not a crash;
socks5:// uses the resolver chain; Digest among other challenges.
Share and the PIN gate: no modulo bias in the PIN, a slot before each
compare, no host detail in errors, a depth limit for YAML, each
multipart field counts toward --max-request.
Update and install: the tag is checked before it goes into a URL; the
new file is checked after its trial run; --force with no --version
installs again; install.sh hides the token.
Instances: a name is checked before each path; a held lock is never
removed; the record of --name has no secret; status, bug-report
and wait write nothing; autostart --from keeps the secrets.
cfrs pod (seccomp backend): the doctor sets no_new_privs in its
probe; getsockname and getpeername keep to the buffer of the
caller; SO_ERROR gives the error of a failed connect; datagram
lengths are checked before a read; recvfrom and recvmsg on an
unconnected UDP socket give the real source address; a SOCKS5 user,
password or name over 255 bytes is refused.
cfrs net: a port 0 listener prints the port that it bound; the
switch drops a frame with a spoofed source address.
The tests skip, not fail, on a host that refuses bind(AF_INET) or has
no loopback; a CI job runs them with bind(AF_INET) refused.

Changes for a tester

Update:
```
cfrs update
```
cfrs serve --local ADDR serves the files on a local listener (TCP
HOST:PORT, or unix:PATH) and makes no tunnel:
```
cfrs serve --dir ./site --local 127.0.0.1:8080
```
A config of cloudflared with token:, url: or hello-world: works.
A path: of cloudflared works as a regular expression.
cfrs doctor has a last line with the step to take. cfrs --help
lists the commands by purpose; each command has examples in its
--help and in its man page.
Each JSON document has schema and version.

What to report

cfrs pod --backend seccomp with a UDP program (DNS, QUIC, STUN): is
the source address of each answer right?
A config file copied from cloudflared that does not do the same in
cfrs.
live.yml prints the median time of 20 small requests over the URL and
over cfrs connect (#206).

Limits

cfrs pod --backend seccomp: recvmmsg gets the AF_UNIX address of
the socketpair as the source.
cfrs net: a datagram socket of the shim has no same-user check.
path: does not decode %XX before the match (cloudflared does).
The token of a TCP switch goes over the connection as plain text: use
a tunnel on a network that others can see.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

WARP and the virtual network

warp stack: no Nagle on the TCP sockets (a128955)
warp API: a second host, and CFRS_WARP_API (de6fdc6)
warp: replace a MASQUE session through the relay before the relay limit (f820078)
warp: four gaps of #278, and the rules for --l4 (#140) (db6dbe6)
warp proxy: the UDP relay is on the address of the control connection (#278) (cabf6ac)
warp ssh-config: --host is one pattern with no space or control character (#252) (1e4b7e9)
warp env: no proxy variables exits 69 (#255) (cd24b78)
pod-netns doctor: the seccomp probe sets no_new_privs (#299) (4915178)
pod-netns: refuse a SOCKS5 user, password or name over 255 bytes (#304) (d871001)
vnet: a listener prints the bound address, not the requested one (#300) (8410146)
pod-netns: the default inbound directory is private to the user (#306) (ddda6a9)
vnet: the shim and switch sockets take the same user only (#308) (afbe2d4)
vnet: the switch drops a spoofed source address, a TCP switch needs a token ([#30...

Assets 23

cfrs v0.3.0-beta.9 Pre-release

Pre-release

github-actions released this 03 Nov 13:36

v0.3.0-beta.9

3e1e1a3

The ninth prerelease of cfrs, for tests.

Binaries

File	System
`cfrs-x86_64-unknown-linux-musl`, `pod-netns-x86_64-unknown-linux-musl`	Linux x86-64
`cfrs-aarch64-unknown-linux-musl`, `pod-netns-aarch64-unknown-linux-musl`	Linux ARM64
`cfrs-armv7-unknown-linux-musleabihf`, `pod-netns-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`cfrs-arm-unknown-linux-musleabihf`, `pod-netns-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`cfrs-i686-unknown-linux-musl`, `pod-netns-i686-unknown-linux-musl`	Linux x86 (32-bit)
`cfrs-riscv64gc-unknown-linux-musl`, `pod-netns-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`cfrs-loongarch64-unknown-linux-musl`, `pod-netns-loongarch64-unknown-linux-musl`	Linux LoongArch64
`cfrs-powerpc64le-unknown-linux-musl`, `pod-netns-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

The image is ghcr.io/azathothas/cfrs:v0.3.0-beta.9 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.9 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.3.0-beta.9   # rebuild and compare (x86_64, aarch64)

cfrs update from 0.3.0-beta.8 does the first three checks itself.

Breaking

Changes that a command written for beta.8 can need:

The TCP window of the userspace stack of WARP has no limit by default
(before: 1 segment). CFRS_WARP_TCP_BURST=1 gives the old window (#100).
smoltcp is 0.12 (before: 0.11), in cfrs and in pod-netns.
The vnet stack takes an MTU from 576 (before: at least 1280).

Fixed

An upload through the userspace stack of WARP (warp proxy, warp run, warp
nc) of more than the send buffer sent some bytes twice: the TLS server
answered bad record mac. Each byte now goes once. beta.8 and before have
the fault (f55dd65).

Changes for a tester

Transports of the tunnel

warp --masque-transport h3: MASQUE over HTTP/3 on UDP 443. Each IP packet
is an HTTP datagram (#157).
warp --transport wireguard: the tunnel on WireGuard (UDP 2408), with the
device of warp export (#152).
warp --carry wg: a second WireGuard device inside the tunnel; a
destination sees its exit. With --transport wireguard, both hops are
WireGuard (#154, #155).
warp --cc none|reno|cubic: the congestion controller of the TCP
connections of the stack (#134).

Proxy

warp proxy --l4: one HTTP/3 CONNECT for each TCP client, with no IP
stack (#140). The door of WARP does not take it yet: a report only.

Release

scripts/rebuild.sh TAG: rebuild a release and compare it with
SHA256SUMS. release-proofs.yml runs it for x86_64 and aarch64; the
binaries of beta.8 were the same (#162).

Live numbers (a download of 20 MB through warp proxy, GitHub runner)

Transport	window 1	window 16	no limit
HTTP/2	7.1 to 8.9 MB/s	11.1 and 12.3 MB/s	11.6 to 16.8 MB/s
HTTP/3	9.5 and 9.6 MB/s	29.8 and 34.2 MB/s	44.8 and 66.1 MB/s

An upload of 16 MiB: 23 to 24 MB/s over HTTP/2 (each controller), 29 and
35 MB/s over HTTP/3, 28.5 MB/s over WireGuard.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

docs: v0.3.0-beta.8 is published (e1706c7)
warp: an upload through the stack sent bytes twice; smoltcp 0.12 and --cc (#134) (f55dd65)
warp: MASQUE over HTTP/3 on UDP 443 (--masque-transport h3) (#157) (165021d)
release: rebuild a release from its tag and compare with SHA256SUMS (#162) (72259d2)
warp: the variable of --masque-transport is CFRS_WARP_MASQUE_TRANSPORT (5b7fee6)
warp: a WireGuard leg for the tunnel (--transport wireguard) (#152) (ece0155)
live-batch2: the download over h3 and h2 with TCP windows 16 and none (#100) (b752443)
warp proxy: --l4, one HTTP/3 CONNECT for each TCP client (#140) (9d30496)
warp: --carry wg, a WireGuard device inside the tunnel (#154, #155); mac1 with zero reserved bytes (#152) (87cebb8)
warp: the TCP window of the stack has no limit by default (#100); log the error of an L4 client (#140) (81e56d0)
Version 0.3.0-beta.9; release notes (aa93371)
warp proxy --l4: three forms of the CONNECT, for a test of the door (#140) (3e1e1a3)

Assets 23

cfrs v0.3.0-beta.8 Pre-release

Pre-release

github-actions released this 03 Nov 10:38

v0.3.0-beta.8

df99e33

The eighth prerelease of cfrs, for tests.

Binaries

File	System
`cfrs-x86_64-unknown-linux-musl`, `pod-netns-x86_64-unknown-linux-musl`	Linux x86-64
`cfrs-aarch64-unknown-linux-musl`, `pod-netns-aarch64-unknown-linux-musl`	Linux ARM64
`cfrs-armv7-unknown-linux-musleabihf`, `pod-netns-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`cfrs-arm-unknown-linux-musleabihf`, `pod-netns-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`cfrs-i686-unknown-linux-musl`, `pod-netns-i686-unknown-linux-musl`	Linux x86 (32-bit)
`cfrs-riscv64gc-unknown-linux-musl`, `pod-netns-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`cfrs-loongarch64-unknown-linux-musl`, `pod-netns-loongarch64-unknown-linux-musl`	Linux LoongArch64
`cfrs-powerpc64le-unknown-linux-musl`, `pod-netns-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

New in this release:

The image ghcr.io/azathothas/cfrs:v0.3.0-beta.8 (also :beta), for the
8 architectures: FROM scratch, user 65534, the volume /var/lib/cfrs
(#160).
scripts/install.sh: a POSIX sh installer with downloader fallbacks and
a SHA256SUMS check (#160).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.8 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

cfrs update from 0.3.0-beta.7 does these checks itself.

Breaking

Changes that a command written for beta.7 can need:

The SOCKS5 server of warp proxy answers 0xff (no acceptable method) to a
client that offers no method the server takes. Before, a client that
offered only user and password (0x02) to a proxy with no credentials got
0x00. A client that offers 0x00 is served as before (#146).
warp proxy refuses a loopback, a link-local or an unspecified address,
and localhost, with SOCKS5 reply 0x02 or HTTP 403. Before, the
connection went into the tunnel and failed after up to 15 s. A rule
(-r cidr:127.0.0.0/8=direct) changes this (#132).
pod-netns, library: RuleMatch::Cidr holds a list of IPv4 or IPv6
prefixes (Arc<[Net]>), not one IPv4 address and a length. Use
RuleMatch::parse("cidr:10.0.0.0/8") (#142).
The stack of WARP sends no new packet while its outbound queue is full,
in place of a drop (#134).

Changes for a tester

New commands and flags of `cfrs warp`

warp exit [--json]: the colo, the country and the address of the exit
of the session. warp probe prints one exit line (#147).
warp forward -L LISTEN=HOST:PORT: as ssh -L, through WARP; HOST is
resolved inside the tunnel (#143).
warp scan [--candidate IP[:PORT]]: the TCP and TLS time of each front
door, with the pinned key (#139).
warp export [--format wg-quick|json] [--delete]: a WireGuard device with
its own key, for other clients (#148).
warp proxy -r KIND:VALUE=ACTION, --rules-file, --rule-default,
--check: tunnel, direct or reject for each destination; the file is
read again when it changes (#132, #136).
warp proxy --listen-identity LISTEN=PATH: one device for each listener
(#150).
warp proxy --proxy-user USER --proxy-password-file FILE (also on
warp up): SOCKS5 user and password, HTTP Basic (#146).
warp --resolver SPEC (CFRS_WARP_RESOLVERS): the DNS resolvers inside
the tunnel, UDP or DNS over TLS (#145, #144).
warp --device-name, --device-model, --device-locale: what a new
device declares (#141).
warp --fragment-client-hello [record|sni], --fragment-size: the TLS
ClientHello of the MASQUE connection in more than one record (#135).
warp up --env-d: the proxy variables in
~/.config/environment.d/90-cfrs-warp.conf for the next login (#138).

Paths and counters

The front door that carried data is kept for 7 days in
warp-door.json; a door whose session carried no packet goes last (#133).
cfrs_decisions_total{decision,outcome} in the metrics: DNS steps,
egress, legs, MASQUE paths, proxy requests and rules (#137).
The health line of warp proxy has the decisions, tx_dropped and
tx_held (#134, #137).
pod-netns: -r cidr: takes IPv6 prefixes and cidr:@FILE (#142).

An IPv6-only host (#163)

DNS over HTTPS by the IPv6 addresses of 1.1.1.1 and 8.8.8.8, in the order
of the routes of the host.
warp tun --default-route routes the front door in use (IPv4 or IPv6),
and skips a relay address that has no route.
cfrs doctor measures the IPv6 front door.
scripts/v6only/: an IPv6-only network namespace on a runner, with its
live step.

Recipes

Tor, Psiphon, and a nested session (a second device through the first):
docs/target-environment.md (#156, #158, #159).

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

share: the race test flushes each file before the read (21c1b33)
IPv6-only host: IPv6 DoH servers, warp up --tun front door, doctor IPv6 front door, shutdown on a failed verify (issue 163) (4fc2a76)
warp tun --default-route: the front door in use, IPv6 host routes, a relay address with no route is skipped (issue 163) (0c707d4)
scripts/v6only: an IPv6-only host on a runner, and its live step (issue 163) (62fbb6c)
warp: a front door that carries no packet goes last; the door that works is kept (issue 133) (74d8e07)
warp proxy: credentials of the clients; 0xff for a SOCKS5 client with no acceptable method; a time limit for a request (issue 146) (bcb2fe0)
warp: the name, the model and the locale of a new device (issue 141) (c6414f6)
warp --resolver: the DNS resolvers inside the tunnel, on UDP or over TLS (issues 145, 144) (e699648)
warp: print the exit colo and country of a session (#147) (92038e9)
warp: add warp forward -L, a local forward through WARP (#143) (51a693b)
warp proxy: add rules for the destinations; pod rules take IPv6 and prefix files (#132, #136, #142) (d04e3c0)
metrics: count the path decisions by decision and outcome (#137) (46a0d16)
warp: hold the stack when the outbound queue is full; log the drops (#134) (3ebee54)
warp up: add --env-d, the proxy variables for the next login (#138) (5e88dc0)
warp up: check the environment.d file before the start (#138) (d96ea1d)
warp: add warp scan, a measure of front doors (#139) (a57cf75)
warp: add warp export, a WireGuard device for other clients (#148) (5b99937)
warp proxy: add --listen-identity, one WARP device for each listener (#150) (ebb9f85)
docs, live: recipes for Tor, Psiphon and a nested session; live checks of batch 2 (#156, #157, #158, #159) (75f6cd0)
release: a container image and a portable install script (#160) (c5b9834)
docs: the notes of v0.3.0-beta.8 and the open work of the second batch (ccc936a)
warp: split the ClientHello of the MASQUE connection into records (#135) (b811b8e)
live: read the last line of a detached demo; wait for the test proxy (#163) (2a37832)
Version 0.3.0-beta.8 (721fd17)
warp exit: read the trace over HTTPS (#147); live-batch2: curl to the forward with no proxy (4ca3ab3)
live-batch2: a marked local web server on its own port (df99e33)

Assets 23

cfrs v0.3.0-beta.7 Pre-release

Pre-release

github-actions released this 03 Nov 05:33

v0.3.0-beta.7

9fe4073

The seventh prerelease of cfrs, for tests.

Binaries

File	System
`cfrs-x86_64-unknown-linux-musl`, `pod-netns-x86_64-unknown-linux-musl`	Linux x86-64
`cfrs-aarch64-unknown-linux-musl`, `pod-netns-aarch64-unknown-linux-musl`	Linux ARM64
`cfrs-armv7-unknown-linux-musleabihf`, `pod-netns-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`cfrs-arm-unknown-linux-musleabihf`, `pod-netns-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`cfrs-i686-unknown-linux-musl`, `pod-netns-i686-unknown-linux-musl`	Linux x86 (32-bit)
`cfrs-riscv64gc-unknown-linux-musl`, `pod-netns-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`cfrs-loongarch64-unknown-linux-musl`, `pod-netns-loongarch64-unknown-linux-musl`	Linux LoongArch64
`cfrs-powerpc64le-unknown-linux-musl`, `pod-netns-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

cfrs update from 0.3.0-beta.6 does these checks itself.

Breaking

Changes that a command written for beta.6 can need:

share with no --mode takes the mode of its flags: --file gives
download, --port gives proxy. Flags of two modes, or a flag of another
mode than --mode (--mode upload --file F), exit 64 (#118).
A verify of the public URL that fails exits 69 (before: 1). It waits up to
180 s (before: 20 tries in about 40 s) (#119).
CFRS_WARP_TCP_BURST with a value that is not 1 to 430 or none exits 78
(before: the default, with no message) (#111).
autostart add drops a leading cfrs, and a command that does not parse
exits 64 (#117).
warp proxy does not take a unix socket that answers (a running proxy):
the listener fails (#115).
The ready document of relay node has the pair in pair (before:
name, which the name of the instance overwrote) (#119).
agent up --expose gives no tunnel to a port where nothing accepts a
connection; each entry of exposed has a state (#119).
A new WARP session is up only when a DNS query through it got an answer
(5 s). CFRS_WARP_NO_CHECK=1 turns the check off (#120).
The env file of warp up with no TCP listener sets CFRS_PROXY to the
unix socket, so cfrs commands in that shell use WARP (#116).

Changes for a tester

The fixes of the reports on beta.6 (#109 to #130).

WARP

A UDP datagram to IPv6 no longer stops the userspace stack (a panic in
smoltcp before); a stack whose driver ends is replaced (#112).
The stack frees the sockets of closed connections and of connects that a
caller gave up; TCP has a time limit of 60 s and a keepalive; the end of
the data of a client goes to the peer as a FIN; the operations of a dead
session fail at once; a read that a caller gave up takes no data (#125).
The TCP window of the userspace stack stays 1 by default: on the direct
path to the front door, larger windows still stall (#100, open). Through
the WebSocket relay, no window stalled in the live runs.
A new WARP session tries the direct path first each time; the relay
starts after 3 s (0.5 s when the relay worked last), and the first
session that opens wins (#126, #76).
UDP ASSOCIATE replies 0x01 when it cannot open its socket; DNS through
the tunnel is sent again after 1.2 s; a name in a datagram is resolved
once for each association, A first. docs/protocol.md describes the UDP
association in the stream (0x83) for a host that refuses UDP on
127.0.0.1 (#114).
A capsule longer than 64 KiB ends the session (#123). ADDRESS_ASSIGN is
parsed and logged (#121). The waiting packets go in one HTTP/2 DATA frame
(#122).
The front door is the IPv4 address of the peer, then its IPv6 address;
the one that worked goes first (#124). The leg that worked (direct or
relay) is kept in warp-leg.json; a relay that worked in the last 6 h
goes first after a restart (#126).
warp nc -u HOST PORT carries UDP; warp probe checks UDP too (#115).
warp proxy --dns ADDR and warp up --dns ADDR: a DNS forwarder through
WARP (#117). warp proxy --max-connections N; the log has a health line
each 10 min (#117, #116).
warp ssh-config --write --host H owns its block in ~/.ssh/config;
--check and --remove (#130).
warp up --replace; --persist also for zsh and fish; warp status
shows the instance; warp exec and warp shell set CFRS_WARP_SOCKET
(#115, #116, #117).

Proxies and DNS

--proxy SCHEME+unix:/PATH and --proxy SCHEME+exec:COMMAND (a proxy at
the stdin and stdout of a command, as the ProxyCommand of SSH) (#129).
An NXDOMAIN answer of one DoH operator does not stop the chain: the next
operator is asked (#119).
A reset or a close during a TLS handshake is the hop network, with a
hint about an egress policy, not about the CA or the clock (#127).

Pods

getaddrinfo with AF_UNSPEC works when the supervisor cannot write the
memory of the program (RES_OPTIONS=single-request) (#113).
UDP to a fake IP of the pod goes to the proxy with its name (#113).
POD_NETNS_QUIET (and cfrs -q) silence the warnings of the pod (#115).

Tunnels, share, relay and the CLI

share --file shares the file (#118). A refused upload is read to its
end before the 413, also past the body limit (#92).
serve of a directory with no index.html: the 404 of / is not a
warning (#119).
ports --probe; origins on localhost with no /etc/hosts; relay stop
stops the node instances of the pair (#119).
relay connect keeps the answer when the input ends at once (#109).
doctor: the relay road, the DNS answer of each name, the clock, and a
summary of the roads direct, warp and relay (#128). doctor --agent
names a synthetic resolver (#117).
cfrs raises the soft limit of open files at start; cfrs status shows
it (#126).
cfrs bug-report: one text for a report, with no secret (#117).
agent up and doctor --agent give no eval line when warp up has no
TCP listener (#110).

What to report

Open an issue with:

the output of cfrs --version, cfrs status and cfrs doctor --agent;
the command, and its output with RUST_LOG=cfrs=debug;
the network limits of the host (proxy, UDP, ports, DNS, TLS interception).

CFRS_ERROR_PROGRAM=/path/to/program gives each failure as one JSON
document to that program, with the credentials masked.

Limits of this prerelease

Linux only.
A proxy that terminates TLS cannot carry the edge connection or the WARP
MASQUE connection.
The netns backend of cfrs pod carries TCP and DNS, not other UDP; use
--backend seccomp or netns-raw for other UDP.
TCP through warp proxy and warp up has a small window by default
(CFRS_WARP_TCP_BURST): about 0.5 MB/s on some paths (#100, open).
The relay limits each session to 64 MiB and 12 h.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

warp: a UDP datagram to IPv6 does not stop the userspace stack (issue 112) (96939b6)
resolve, verify: a new name that one DoH operator does not know yet (issue 119) (0775407)
warp stack: free the sockets, time limits, half-close; UDP association fixes (issues 125, 114) (1eff505)
capsule limit, CFRS_WARP_TCP_BURST check, agent advice, share mode, autostart args (issues 123, 111, 110, 118, 117) (25e242d)
pod AF_UNSPEC lookups and UDP to a name; relay connect answer; TLS reset hop (issues 113, 109, 127) (3c0c030)
live.yml: close the MASQUE connection with a TCP reset rule when ss -K fails; warp: log each close of the session (975bb84)
ports --probe, expose probe, localhost origins, relay node pair (issue 119) (1d0e06f)
Breaking heading of the release notes, the limit of open files, the WARP leg that worked (issue 126); live.yml: the new warp up line (b3a34ea)
warp ssh-config --write, --remove, --check: the block in the SSH config file (issue 130) (f1c2067)
proxy carriers: a unix socket and a command (issue 129); warp up env and exec (issue 116) (15bb151)
doctor: the relay road, DNS of each name, the clock, and the roads (issue 128) (31a689b)
warp: a new session is up when a packet crossed it; ADDRESS_ASSIGN; the IPv6 front door (issues 120, 121, 124) (e4bc032)
share: a refused upload is read to its end, also past the body limit (issue 92, live run 41556133042) (3ab5dd1)
QOL: warp nc note, a live socket is kept, warp up --replace, zsh and fish, POD_NETNS_QUIET, warp status instance, persist files, crontab check (issues 115, 116, 117) (194dc4b)
warp: the packets that wait go out in one DATA frame (issue 122) (e10b03e)
warp proxy --max-connections, client counters and a health line; doctor --agent: a synthetic resolver (issues 117, 116) (f2b3e62)
warp nc -u and the UDP line of warp probe (issue 115) (205bece)
fmt: the signatures of nc.rs (746a864)
warp proxy --dns and warp up --dns: a DNS forwarder through WARP (issue 117) (e50cff4)
warp: the default TCP window of the userspace stack is 8 (issue 100) (acc57e6)
cfrs bug-report: one text for a report, with no secret (issue 117) (40037ea)
Version 0.3.0-beta.7; release notes (7d576d8)
warp: the direct path first for each session, the relay after a delay; the leg in the live table (issues 126, 100) (fb8803f)
warp: the default TCP window is 1 again; live.yml: A/B with the binary of beta.6 (issue 100) (9fe4073)

Assets 23

cfrs v0.3.0-beta.11 Pre-release

Pre-release

github-actions released this 03 Nov 23:51

v0.3.0-beta.11

3044aa1

The eleventh prerelease of cfrs, for tests.

Binaries

File	System
`cfrs-x86_64-unknown-linux-musl`, `pod-netns-x86_64-unknown-linux-musl`	Linux x86-64
`cfrs-aarch64-unknown-linux-musl`, `pod-netns-aarch64-unknown-linux-musl`	Linux ARM64
`cfrs-armv7-unknown-linux-musleabihf`, `pod-netns-armv7-unknown-linux-musleabihf`	Linux ARMv7 (32-bit, hard float)
`cfrs-arm-unknown-linux-musleabihf`, `pod-netns-arm-unknown-linux-musleabihf`	Linux ARMv6 (32-bit, hard float)
`cfrs-i686-unknown-linux-musl`, `pod-netns-i686-unknown-linux-musl`	Linux x86 (32-bit)
`cfrs-riscv64gc-unknown-linux-musl`, `pod-netns-riscv64gc-unknown-linux-musl`	Linux RISC-V 64
`cfrs-loongarch64-unknown-linux-musl`, `pod-netns-loongarch64-unknown-linux-musl`	Linux LoongArch64
`cfrs-powerpc64le-unknown-linux-musl`, `pod-netns-powerpc64le-unknown-linux-musl`	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

The image is ghcr.io/azathothas/cfrs:v0.3.0-beta.11 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.11 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.3.0-beta.11   # rebuild and compare (x86_64, aarch64)

cfrs update from 0.3.0-beta.8 does the first three checks itself.

Breaking

None.

Fixed

cfrs update with no --version took the first release of the GitHub
API as the newest. The API lists the releases by tag name, so
v0.3.0-beta.10 came after v0.3.0-beta.7. From beta.10, cfrs update
then said that beta.9 was available, and an update went back to beta.9.
Now cfrs takes the highest version (a release after its prereleases), and
with no --version it never goes to an older version.
install.sh with CFRS_VERSION=latest installed beta.9 for the same
cause. It now takes the highest version of the list (and of
releases.atom).

Changes for a tester

From beta.9 or beta.10, update with the tag:
```
cfrs update --version v0.3.0-beta.11
```
cfrs update with no --version of these two releases does not find a
newer release. From beta.11 on, it does.
Each change of beta.10 is in this release: see
docs/releases/v0.3.0-beta.10.md.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

update, install.sh: the newest release is the highest version; release v0.3.0-beta.11 (3044aa1)

Assets 23

podnet v0.4.0-beta.5

Binaries

Check a download

Breaking

Changes for a tester

What to report

Limits

The commits of this release

Other

Uh oh!

podnet v0.4.0-beta.4

Binaries

Check a download

Breaking

Changes for a tester

What to report

Limits

The commits of this release

Documents

Other

Uh oh!

podnet v0.4.0-beta.3

Binaries

Check a download

Breaking

Changes for a tester

What to report

Limits

The commits of this release

Documents

Build, tests and CI

Other

Uh oh!

podnet v0.4.0-beta.2

Binaries

Check a download

Breaking

Changes for a tester

What to report

Limits

The commits of this release

Build, tests and CI

Other

Uh oh!

podnet v0.4.0-beta.1

Binaries

Check a download

Move from cfrs

Breaking

Changes for a tester

What to report

Uh oh!

cfrs v0.3.0-beta.12

Binaries

Check a download

Breaking

Fixed

Changes for a tester

What to report

Limits

The commits of this release

WARP and the virtual network

Uh oh!

cfrs v0.3.0-beta.9

Binaries

Check a download

Breaking

Fixed

Changes for a tester

Transports of the tunnel

Proxy

Release

Live numbers (a download of 20 MB through warp proxy, GitHub runner)

The commits of this release

Other

Uh oh!

cfrs v0.3.0-beta.8

Binaries

Check a download

Breaking

New commands and flags of `cfrs warp`