Skip to content

v0.1.28

Choose a tag to compare

View all tags
@UncleStephenCode UncleStephenCode released this 03 Sep 11:03
v0.1.28
60629c1

Highlights

  • Unified build and packaging matrices without separate jobs for individual distributions.
  • 43 binary builds and 43 packages across supported architecture families.
  • Package installation validation for 86 distribution and architecture combinations.
  • 172 mandatory firewall E2E jobs: separate nftables and iptables/ip6tables scenarios for every platform.

Supported platforms

The release matrix covers Debian, Ubuntu, Fedora, Rocky Linux, AlmaLinux, openSUSE Leap, openSUSE Tumbleweed, Alpine Linux, and Arch Linux.

Supported architectures include:

  • AMD64/x86-64
  • x86/386
  • ARMv5, ARMv6, and ARMv7
  • ARM64/AArch64
  • PowerPC64LE
  • RISC-V 64
  • IBM Z/s390x

AMD64 and ARM64 use native GitHub-hosted runners. Other architectures use x86 compatibility mode or digest-pinned Cross/QEMU environments.

Testing improvements

  • Every binary is checked for its expected ELF architecture and static linkage.
  • Every package is installed using the target distribution’s native package manager.
  • Every platform runs complete Learning → Enforcing scenarios with both nftables and the iptables fallback.
  • Application-aware TCP and UDP rule matching is tested under QEMU using a dedicated static native client.
  • Package tests verify metadata, architecture, version, filesystem layout, permissions, system integration, and executable identity.
  • The Rust workspace passes all 262 unit tests.

Fixed

  • Fixed Alpine package version validation with apk-tools 3.
  • Added an explicit per-file APK manifest to avoid unsafe or unintended package contents.
  • Fixed package tests on minimal openSUSE Tumbleweed images by installing gawk.
  • Added complete iptables-only coverage for Alpine, Arch Linux, and Tumbleweed.
  • Removed the dependency on the disallowed docker/setup-qemu-action.

Release security

  • GitHub Actions and container images are pinned to immutable revisions or SHA-256 digests.
  • Cross compiler images are validated as digest-pinned inputs.
  • QEMU registration uses a dedicated fail-closed script and is restricted to ephemeral GitHub-hosted runners.
  • Publication requires complete installation and firewall-test evidence for every matrix entry.
  • Release assets, evidence manifests, and checksums are verified before publication.
  • Existing release assets are never silently overwritten.

QEMU results provide emulation evidence and do not represent certification on physical hardware.

Assets 90
Loading