v0.1.0

First release of uploader: a resumable file upload and download service over gRPC, with a Go SDK.

Highlights

• StartUpload RPC: the session is created before any data is sent, so an interrupted upload always has a session ID to resume with.
• The SDK resumes transient failures on its own (WithMaxRetries, default 3). Uploads resume from the server's committed offset, downloads from the local file.
• Download returns a DownloadResult with the session ID, size and completion state.
• Resuming an upload that already completed reports it, instead of failing.

Security

• File and session IDs from clients are validated before they reach the filesystem. Earlier, unreleased commits allowed a crafted ID to read or write files outside the data directory.
• Internal errors no longer send server filesystem paths to clients.

Other fixes

• WithChunkSize rejects sizes outside 1..MaxChunkSize, just under the server's 4 MiB limit. This also fixes a hang at 0 and a panic for negative sizes.
• The code generators are pinned. CI runs the tests on Linux, macOS and Windows, and checks the gRPC API for breaking changes.