podssh v1.1.0-beta.3

podssh v1.1.0-beta.3

The third beta of milestone M10, and the first one after the study of osewa
(docs/research/osewa.md): what a user feels on a slow or busy link is now
measured, and podssh's SSH client keeps a key's echo near the link's round
trip while a download runs on the same connection, against any sshd and
through each road; a session resumes in about a second after the client
moves; and a cold connect takes two round trips fewer. The relay role
gains the hardening that a tester asked for (GitHub #126 to #148). A beta is
a prerelease. Its tag never moves: a defect found in it goes into the next
beta.

What to test again

What a user feels (the study of osewa, Q99):

• podssh ping DEST --under-load types 40 keys beside a download on the
  same connection and gives the echo's p50 and p95; --connect-runs N
  times N cold connects (T-660). scripts/feel-matrix.py runs each road
  through the four links of osewa's lab on the loopback.
• Typing-aware SSH windows: while a key waits for its echo, a bulk
  channel's window is held to the path's round trip and 40 ms, and each
  socket that podssh dials keeps 16 KiB unsent; where nobody types, a
  window grows to the path, up to 16 MiB on --direct (T-661, T-662). The
  server's messages are of 8 KiB, and a window is topped up once a quarter
  of it is used (T-670). Measured on the loopback, a key's echo beside a
  download: about 100 ms on a cellular link where OpenSSH's is 1.6 s, and
  0.4 s on a link of 1 Mbit/s where OpenSSH's is 16 s. The download while
  typing on a long fast link is slower than before (T-670, partial).
• Liveness in round trips: a spare link after three round trips of
  silence, 1 s to 3 s, and a check when the host wakes; a session resumed
  in 1.0 s after the client's new address, where it took 3 s (T-663).
• A faster cold connect: the key that a host took is signed in the first
  request, the pty's request and the command's go together, and a relay
  host's TLS group is kept (T-664): two round trips fewer, faster than
  OpenSSH's own client to the same sshd on the loopback's links.
• The resumable layer ends one direction (END), so a request, its end and
  the reply after it cross the relay role's layer road (T-632).
• The iroh road: PODSSH_IROH_QUIC chooses QUIC's settings at both ends
  (iroh's own by default, tuned, bbr, newreno; T-665, partial: the
  default waits for an A/B run), and the SSH connections of one process to
  one node share one iroh connection, a copy's stream below a terminal's,
  once both ends agree on podssh/2 (T-666, partial).
• The record of the keys that hosts took keeps each host's key when
  podssh each logs in to several at once (T-675).

The relay role, podssh relay serve (GitHub #126 to #148):

• A name that the role does not dial gets one 403 that names no address
  (T-628, #126).
• It keeps no capability after its bind (T-629, #127); a list of private
  ranges that it may dial, --routes (T-635, #133); a share of the pairs
  for each key that may mint (T-630, #128); a turn for each session on a
  node's socket (T-648, #146); a target's bytes after the client's Close,
  as the contract says (T-671); a pair that halts without ending,
  podssh relay halt and relay resume (T-647, #145).
• podssh pipe ws-listen: answers a request that is not an upgrade with a
  page from --cover DIR, and an upgrade with no key with --raw-upgrade
  (T-639, T-645, #137, #143).
• A retired PODSSH_* variable is refused by name (T-634, #132); a node's
  lines keep their priority in the journal (T-640, #138).

The files

File	For
podssh-x86_64-unknown-linux-musl	Linux on x86-64, static: no library and no loader needed
podssh-aarch64-unknown-linux-musl	Linux on aarch64, static
podssh-armv7-unknown-linux-musleabihf	Linux on 32-bit ARM with hard float, static
podssh-riscv64gc-unknown-linux-musl	Linux on 64-bit RISC-V, static
podssh-aarch64-apple-darwin	macOS on Apple silicon; it links the system's libraries only
podssh-x86_64-apple-darwin	macOS on Intel
podssh-x86_64-pc-windows-msvc.exe	Windows on x86-64, with a static C runtime
podssh-aarch64-pc-windows-msvc.exe	Windows on ARM64, with a static C runtime
SHA256SUMS	The SHA-256 of each binary
SHA256SUMS.sigstore.json	The signature of SHA256SUMS: Sigstore's keyless signing, by the release workflow at this tag
provenance.sigstore.json	The provenance of each binary (SLSA), signed the same way: the workflow, the tag and its commit
THIRD-PARTY-LICENSES.md	The licenses of the crates in the binaries, with their texts

Check a download

T=v1.1.0-beta.3; B=podssh-x86_64-unknown-linux-musl   # or another file of the table
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/$B"
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/SHA256SUMS"
grep " $B\$" SHA256SUMS | sha256sum -c - && chmod +x "$B"
./"$B" --version   # podssh 1.1.0-beta.3 (the commit of the tag)

podssh update --version v1.1.0-beta.3 from v1.1.0-beta.2, v1.1.0-beta.1 or v1.0.1
takes it, checked by its signature; a build of a release follows releases
alone, so without --version it stays on v1.0.1. The provenance and the
signature are checked as for v1.0.0 (its notes),
with T=v1.1.0-beta.3.

How it was checked

By the operator's ruling Q88 (2026-11-03), until podssh is stable: the gate
green at the tag's commit, the release workflow by hand on it, and the short
form of its binary (scripts/release-short.sh BINARY --net); after the tag,
release-proofs.yml and update-live.yml. The whole release check and the
live runs of each road wait until then.

What a beta does not have yet

• The whole check of a release from end to end with no human
  (scripts/release-check.sh, T-251): it waits (Q88).
• Signatures of the platforms: the Mac binaries are not signed with an
  Apple Developer ID, and the Windows binaries carry no Authenticode
  signature, so SmartScreen may warn. The proofs above stand in for them.

Report a defect

Open an issue at https://github.com/Azathothas/podssh/issues with the
output of podssh --version and podssh doctor --json. Read that output
before you post it: it names this host's proxy and addresses, and never a
token or a password.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

• Research: osewa against podssh, the reality check (Q99); its gaps filed as T-660 to T-669 (856940b)
• The record: the ninth round of drafts, in progress (the triage of #127 to #148, T-660 to T-663) (0b7f303)
• Triage: GitHub #127 to #148 as T-629 to T-650 (Q100) (6d90d04)
• WARP's tests: a stand-in edge forgets what an earlier test met at its port (7e6b9bc)
• The record: the citations of road.rs and stand_in.rs moved with the repair of WARP's tests (c65cfc4)
• node_cut's test: the stand-in's late close gives the node the 1003 that its frame would get (fb018a7)
• T-660, partial: what a user feels, measured: ping --under-load and --connect-runs, osewa's four links, and the matrix of roads (a940886)
• T-663 done: liveness in round trips: a spare link after three round trips, and a check when the host wakes (b7f78d6)
• T-661 done, T-662 partial: typing-aware SSH windows against any sshd, and windows that grow to the path (1525a6c)
• v1.1.0-beta.2 published (Q98): STATUS marks its 80 rows; the proofs of its published files passed (release-proofs 41892109498, update-live 41892114409) (6971076)
• T-632 done: the resumable layer ends one direction: END, and podssh proxy's stdin on it through the relay role (c3a9b89)
• T-629 and T-635 done: relay serve keeps no capability after its bind, and a list of private ranges that it dials (GitHub #127, #133) (ce411ac)
• The record: GitHub #127 and #133 closed with T-629 and T-635 (ce411ac) (3775c2f)
• T-630 and T-648 done: a key's share of the relay role's pairs, and a turn for each session on a node's socket (GitHub #128, #146) (4ae2284)
• The record: GitHub #128 and #146 closed with T-630 and T-648 (4ae2284) (df92546)
• T-664 done: a faster cold connect: the key a host took signed in the first request, the pty's request and the command's together, the TLS group kept (b9cfebc)
• T-671 and T-647 done: the relay role keeps a target's bytes after the client's Close, and a pair halts without ending (GitHub #145) (8caa6f0)
• The record: GitHub #145 closed with T-647 (8caa6f0) (8f6fa3a)
• T-670, partial: the slow link's echo beside a download, from 2.4 s to 0.4 s by --direct (a6a1de0)
• T-634 and T-640 done: a retired PODSSH_* variable refused by name, and a node's lines keep their priority in the journal (GitHub #132, #138) (91669ae)
• The record: GitHub #132 and #138 closed with T-634 and T-640 (91669ae) (bc22f0f)
• T-639 and T-645 done: pipe ws-listen serves a cover page, and takes a keyless upgrade where asked (GitHub #137, #143) (240447e)
• v1.1.0-beta.3 made ready (T-446): the version 1.1.0-beta.3 and the notes; GitHub #137 and #143 closed (240447e) (35e4932)
• T-665 and T-666, partial: the iroh road's QUIC chosen by an arm, and the sessions of one process on one iroh connection (9794df1)
• T-675 and T-676 done: the gate red since T-664 repaired (0500af1)
• v1.1.0-beta.3's notes: T-665, T-666 and T-675, and the version that --version prints (6d30328)