v0.6.0

Initial public release of the Genmeta CLI family for the DHTTP release wave.

• Move the genmeta launcher and CLI crates onto the published DHTTP endpoint stack.
• Add certificate server V2 identity flows in genmeta-identity, including create, apply, renew, staged email verification, identity/email approval paths, and certificate-chain summaries.
• Move genmeta-ssh onto the dshell WebTransport conversation API while preserving the user-facing DShell CLI.
• Add manifest-based release packaging and dry-run/publish workflows for DEB/APT, RPM, Scoop, and Homebrew S3/R2 surfaces.
• Configure product S3/R2 publishing for Cloudflare R2-compatible upload checksums.
• Add crates.io publishing workflow coverage for all publishable gmutils workspace crates except xtask.
• Improve NAT diagnostics with deterministic bootstrap STUN selection, typed failure reporting, streamed interface reports, and clearer summaries.
• Normalize bare DHTTP authorities in genmeta-curl before request construction.
• Converge release dependencies to crates.io: dhttp 0.2.0, dhttp-access 0.2.0, h3x 0.4.0, dyns 0.4.0, dshell 0.4.0, and rankey 0.2.1.
• Complete Apache-2.0 crate and package metadata for crates.io, DEB, RPM, Scoop, and Homebrew surfaces.

This is an initial release for all gmutils public/package surfaces.

• genmeta 0.6.0

• genmeta-curl 0.5.0

• genmeta-ssh 0.6.0

• genmeta-access 0.2.0

• genmeta-identity 0.2.0

• genmeta-proxy 0.2.0

• genmeta-discover 0.3.0

• genmeta-doctor 0.3.0

• genmeta-nat 0.3.0

• genmeta-nslookup 0.3.0

• DEB/APT packages

• RPM packages

• Scoop manifest and archives

• Homebrew formula and archives

Because this is the first gmutils release on these surfaces, first publication uses the merged release commit as the source of truth. The crates.io packages were published after the release PR merged and before the final v0.6.0 tag; product package publication is tracked from the final tag CI.

Release-prep PR CI passed for:

• crates.io dry-run publish
• Linux DEB/APT package and S3/R2 dry-run
• Linux RPM package and S3/R2 dry-run
• Linux Scoop package and S3/R2 dry-run
• Homebrew package and S3/R2 dry-run

Authentication and provenance

• Tag: v0.6.0
• Annotated tag object: c01d861bc573ee12f55a84d7f7aa784677b85717
• Target commit: 7041df2b5a1b6a3ddd8f6dbd9735fb149c08b961
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/27670130711
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

gmutils v0.5.0

[0.5.0] - 2026-04-20

Major release following the workspace-wide migration to the h3x
ecosystem and the introduction of the dhttp-home identity model.
Compared to v0.4.2, identity management, the DNS stack, several CLI
shapes, and the crate layout have all changed.

Added

• genmeta-identity crate — the sole entry point for managing
  identities (genmeta identity create | apply | renew | list | info | default). Talks to the certificate server over DHTTP/3 with TLS
  certificate pinning. Supports --captcha and the CERT_SERVER_URL
  environment variable for non-interactive enrollment and renewal.
  Displays key usage and extended key usage, and manages the default
  identity explicitly.
• dhttp-home as a first-class dependency — a DHTTP home holds
  many identity homes. genmeta identity is the only writer; every
  other tool discovers identities from the same home.
• Unified identity-lookup convention across every tool —
  -i/--id <name> accepts either a partial or fully qualified name
  (expanded via Name::try_expand_from), otherwise the default
  identity is used. --anonymous skips identity loading entirely.
  The GENMETA_HOME environment variable selects an alternate home.
• genmeta-proxy crate — a new HTTP/1.1 forward proxy. Routes
  .genmeta.net hosts over DHTTP/3, tunnels CONNECT over TCP,
  supports --daemon/--log, TCP keepalive, a connection cap, and a
  header read timeout. Defaults to dual-stack [::]:16080.
• genmeta-access crate — identity-scoped access rules persisted
  in SQLite (replaces the former standalone firewall-bin CLI).
• xtask crate — packaging pipeline using
  dpkg-buildpackage + debhelper, cross-compiling to multiple
  targets in parallel with mounted cargo caches. --sibling
  bind-mounts sibling workspaces for integrated builds.
• Dynamic interface rebinding in curl, ssh, nslookup,
  proxy, and discover via watch_bind_interfaces, stabilised by
  identity_key so stable endpoints survive interface churn.
• Minor CLI features — curl -4/-6 address-family selection;
  ssh native raw mode with SIGWINCH resize forwarding; genmeta nat resolves its STUN server via gmdns instead of a hard-coded
  address.

Changed

• Workspace-wide migration to the h3x ecosystem (Network +
  QuicEndpoint API), replacing the previous h3 / gm-quic stack.
  dquic is re-exported through h3x::dquic.
• Default DNS resolver: http → h3, with a system-resolver
  fallback.
• SSH URI scheme: ssh3:// → https://.
• Terminology sweep: HTTP/3 → DHTTP/3 across the codebase.
• Identity CLI flags: --domain/--domains → --suffix/--identities;
  the .genmeta.net suffix is hidden in display output.
• genmeta-common reorganised into bind / dns / id /
  h3-client features, with bon-based builder APIs for h3 client
  setup.
• A custom root CA (project root.crt) is merged with the system
  trust store instead of replacing it.
• Structured error types across curl, ssh, nslookup, nat,
  discover, and identity: Whatever replaced by named Error
  enums, with snafu::Report for consistent error rendering.

Removed

• genmeta-profile crate — identity modelling has moved into
  dhttp-home plus genmeta-identity.
• genmeta-ssh3 crate — renamed to genmeta-ssh alongside the
  URI-scheme change.
• The system DNS resolver helper in genmeta-common.
• The STUN_SERVER environment variable.
• The legacy buildx / Makefile packaging — superseded by xtask.

Fixed

• Certificate-server client now enforces TLS certificate pinning.
• Proxy: rewrites upstream HTTP/3 responses to HTTP/1.1 before
  forwarding; uses the low-level h3 API for correct stream
  lifecycle management.
• SSH: defers connection.close() while forwarding tasks are still
  active; moved stdin reads to a dedicated thread; PTY/flush fixes
  via updated genmeta-ssh-core.
• Removed panic risks from unwrap/expect on dynamic data paths.
• TTY detection gates ANSI colouring in tracing output so logs stay
  clean when redirected.

Dependencies

• All git dependencies are pinned to specific revisions: gmdns,
  rankey, firewall-base/-db/-migration, and genmeta-ssh-core.
• dhttp-home tracks branch = "main" to stay unified with the
  transitive usage from firewall-db; Cargo.lock still locks it
  to a specific commit.
• h3x is pulled once: the direct dependency tracks main over
  https://, with a [patch."https://github.com/genmeta/h3x.git"]
  redirect to ssh:// at a fixed revision. This unifies the direct
  dependency with transitive h3x uses from gmdns and
  genmeta-ssh-core, so exactly one copy is compiled.
• h3x is the only git dependency over https://; everything else
  uses ssh://.

Components

• genmeta v0.5.0
• genmeta-common v0.2.0
• genmeta-curl v0.4.0
• genmeta-discover v0.2.0
• genmeta-doctor v0.2.0
• genmeta-nat v0.2.0
• genmeta-nslookup v0.2.0
• genmeta-ssh v0.5.0 (formerly genmeta-ssh3)
• genmeta-identity v0.1.0 (new)
• genmeta-access v0.1.0 (new)
• genmeta-proxy v0.1.0 (new)

Policy

• Starting with v0.5.0, this CHANGELOG is written in English and
  follows Keep a Changelog.

genmeta v0.2.8

[0.2.8] - 2025-06-26

Changed

• 重构：将 genmeta-request 重命名为 genmeta-curl，更好地反映工具的用途
• genmeta-nslookup: 优化输出格式，提升可读性
• genmeta-discover: 优化输出格式，提升可读性

Fixed

• genmeta-nslookup: DNS 结果去重，避免重复显示
• genmeta-discover: DNS 结果去重，避免重复显示

Components

• genmeta v0.2.8
• genmeta-ssh3 v0.2.7
• genmeta-curl v0.1.4 (formerly genmeta-request)
• genmeta-nslookup v0.1.2
• genmeta-discover v0.1.1

v0.2.6

genemta v0.2.6, genmeta-ssh3 v0.2.6, genmeta-request v0.1.3, genmeta-nslookup v0.1.0, gnemeta-discover v0.1.0

新工具：genmeta-nslookup，支持DNS查询，genmeta-discover，支持发现局域网中的设备（mdns）

genmeta-ssh3和genmeta-request支持http dns和mdns解析

Full Changelog: v0.2.5...v0.2.6

v0.2.5

genmeta v0.2.5, genmeta-ssh3 v0.2.5, genemta-request v0.1.2

request发送请求时设置http版本为h3

request发送请求时设置Host, User-Agent, Accept 头

ssh修复进程退出时没有恢复终端

ssh支持-l（登录用户名）选项，更好支持rsync

Full Changelog: v0.2.4...v0.2.5

v0.2.4

genmeta v0.2.4, genmeta-ssh3 v0.2.4, ssh3-proto v0.1.0

提取gateway和gmutils关于ssh协议的共通代码

支持本地转发和远程转发，整理动态转发

发送心跳保活包保持连接活跃

session结束时结束程序

server返回进程退出的状态码

Full Changelog: v0.2.3...v0.2.4

v0.2.3

genmeta v0.2.3, genmeta-ssh3 v0.2.3

自己实现配置解析而不是使用ssh_config(修复了难以交叉编译的问题)

跟进gm-quic-traversal更新

Full Changelog: v0.2.2...v0.2.3

v0.2.2

genmeta v0.2.2, genmeta-ssh3 v0.2.2

修复mux不正确退出，收包完全惰性的问题

支持加载系统ssh配置文件

将fake-ssh.sh（genmeta-ssh3.sh）打包进deb

Full Changelog: v0.2.1...v0.2.2

v0.2.1

往事不可追

genmeta v0.2.1, genmeta-ssh3 v0.2.1

优化mux的行为，更贴近标准的ssh，只有多路复用的所有Channel结束ssh才结束

优化了日志打印

让ssh不处理heredoc

加上了changelog