podssh v1.0.0

podssh v1.0.0

The first stable release. podssh carries SSH, or another TCP stream, through
a WebSocket relay on port 443, for a host whose only way out is HTTPS, often
through an HTTP CONNECT proxy: one binary for each platform (static on
Linux), which starts no helper program and uses no capability of the host
that it did not probe for first.
It is v1.0.0-beta.4 with this version and one repair: podssh update of a
build of a release, while the list holds prereleases alone, says that there
is nothing to do (exit 0), where it said that it found no list (T-426).
Its tag never moves: a defect found in it goes into v1.0.1.

The files

File	For
podssh-x86_64-unknown-linux-musl	Linux on x86-64, static: no library and no loader needed
podssh-aarch64-unknown-linux-musl	Linux on aarch64, static
podssh-armv7-unknown-linux-musleabihf	Linux on 32-bit ARM with hard float (a Raspberry Pi with a 32-bit system), static
podssh-riscv64gc-unknown-linux-musl	Linux on 64-bit RISC-V, static
podssh-aarch64-apple-darwin	macOS on Apple silicon; it links the system's libraries only
podssh-x86_64-apple-darwin	macOS on Intel
podssh-x86_64-pc-windows-msvc.exe	Windows on x86-64, with a static C runtime
podssh-aarch64-pc-windows-msvc.exe	Windows on ARM64, with a static C runtime
SHA256SUMS	The SHA-256 of each binary
SHA256SUMS.sigstore.json	The signature of SHA256SUMS: Sigstore's keyless signing, by the release workflow at this tag
provenance.sigstore.json	The provenance of each binary (SLSA), signed the same way: the workflow, the tag and its commit
THIRD-PARTY-LICENSES.md	The licenses of the crates in the binaries, with their texts

Each binary ran on its own platform before it was published: --version,
the whole manual, keygen and keygen -y, the iroh road's parse of a
ticket, WARP's road asking for Cloudflare's Terms before it dials, and
GitHub's SSH banner through the live relay.

Check a download

T=v1.0.0; B=podssh-x86_64-unknown-linux-musl   # or another file of the table
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/$B"
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/SHA256SUMS"
grep " $B\$" SHA256SUMS | sha256sum -c - && chmod +x "$B"
./"$B" --version   # podssh 1.0.0 (the commit of the tag)
./"$B" doctor      # what this host allows, and whether the whole path works

On macOS, check with shasum -a 256 -c in place of sha256sum -c -. A
binary that curl fetched has no quarantine; after a browser's download,
run xattr -d com.apple.quarantine "$B" first. On Windows, compare
(Get-FileHash podssh-x86_64-pc-windows-msvc.exe).Hash with its line in
SHA256SUMS (the case of the letters differs).

The provenance of a binary names the release workflow and the tag (with the
GitHub CLI):

gh attestation verify "$B" --repo Azathothas/podssh \
  --signer-workflow Azathothas/podssh/.github/workflows/release.yml --source-ref "refs/tags/$T"

The signature of SHA256SUMS names the workflow at the tag (with cosign; 3.x
and 2.6 both check it):

curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/SHA256SUMS.sigstore.json"
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity "https://github.com/Azathothas/podssh/.github/workflows/release.yml@refs/tags/$T" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

The two proofs and podssh --version name the same commit.

The sizes

The sizes of the release's dry run of 2026-11-01 (at e3f90ca, the code of
this tag but for the repair of update, run 41350666813), beside beta.3's:

Binary	beta.3	v1.0.0
Linux x86-64	15.2 MiB	15.7 MiB
Linux aarch64	11.7 MiB	12.1 MiB
Linux armv7	8.8 MiB	9.1 MiB
Linux riscv64	11.7 MiB	12.1 MiB
macOS, Apple silicon	9.2 MiB	9.5 MiB
macOS, Intel	12.2 MiB	12.6 MiB
Windows x86-64	11.9 MiB	12.3 MiB
Windows ARM64	10.5 MiB	10.8 MiB

What works

podssh ssh, each, run, job, session, containers, proxy, pipe,
cp, mv, scp, sftp and edit, doctor, keygen, agent, man,
status, ping, health, node, operator, relay, chat, play,
config, mcp, update and detached. podssh man is the reference: each command,
flag, -o keyword, variable, file and exit code. The iroh road is in each
binary: podssh node --iroh, a destination iroh:TICKET, and
--iroh-ticket. So is WARP's road, warp://HOST[:PORT], and the DERP road,
podssh node --derp and a destination derp:TICKET. These binaries have no
Tailscale: podssh ts exits with 70 and says so.

How it was checked

The release check of T-251 (scripts/release-check.sh) ran before the tag on
the release's dry run and a build of its own, and runs again on the
published files: the checksums, the signature of SHA256SUMS and the provenance of each
binary first; then the README's first steps, doctor, proxy and ssh
through the live relay, the reverse road with two sessions at once, cp of
200 MiB each way through a node, pipe, the iroh road through n0's relays,
the static binary in a fresh container and in a box like the target sandbox,
the Tailscale runs against headscale, the throughput run, IRC against
ngircd, and the planted defect of each check. GitHub's runners ran the rest:
Windows and macOS, the box, WARP's road, Cloudflare's edge, the public
forwarders, DNS over HTTPS, a node as a unit of systemd, podssh update,
and 200 MiB each way through a node with its moves. docs/STATUS.md, "The
release check", holds the table of each run.

What is not in it

• The entries that wait for the relay's operator, each an item of
  docs/relay-operator.md:
  a relay that its users host, a signed list of relays and a second
  deployment, resumption in the relay for a standard sshd, a local HTTP
  service at https://NAME, and the relay's tolerance of a frame on its way
  when a client's link is lost (T-421), among them.
• The work that the operator holds (Q32): podssh serve with a terminal of
  its own (vi, less and Ctrl-C in a box), two sessions from one box to a
  node in another, and the work parked behind them.
• The import of FinalShell's and Termius's exports (T-328) and the live run
  of the roads iap:// and eice:// in throwaway cloud accounts (T-376),
  which wait for the operator.
• Outside services that turn the relay's address away: railway.new's limit
  for anonymous visitors, and the IRC networks libera, undernet and, at
  times, OFTC (docs/irc.md).
• Signatures of the platforms: the Mac binaries are not signed with an
  Apple Developer ID, and the Windows binaries carry no Authenticode
  signature, so SmartScreen may warn. The proofs above stand in for them.
• Tailscale (podssh ts), the Tor road (tor://) and their features are
  not in these binaries: a build with --features ts or --features tor
  has them.

Report a defect

Open an issue at https://github.com/Azathothas/podssh/issues with the
output of podssh --version and podssh doctor --json. Read that output
before you post it: it names this host's proxy and addresses, and never a
token or a password.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

• T-425 (partial): irc.live skips when each network turned the relay's address away in its own words; T-251: the runs before beta.4's tag (e3db9db)
• T-425: done, irc.live skips on the networks' own refusal and fails without it (planted: a closed port, FAIL); the work order names 4e79a1f for beta.4 (9c73e32)
• v1.0.0 made ready (the steps of T-250): the version 1.0.0, the README's install lines, and the notes (e3f90ca)
• T-426: podssh update of a build of a release with prereleases alone listed is nothing to do; T-425: a stalled TLS handshake counts as a network's refusal; ts-headscale.sh takes its build from CARGO_TA… (35a0d19)