OpenRad 2.0.1 — Lighter status updates and client hardening

OpenRad 2.0.1 is a maintenance release: lighter status updates between the engine and desktop, a hardened Android TUN reader, faster Python packet handling, and Windows installer builds that also work natively on Windows. The wire format, identities and saved preferences are unchanged. It includes community pull request #8 by @mariananetto-sys — thank you!

• Status updates: the engine publishes state snapshots, and the desktop polls the shared service, every 500 ms instead of 250 ms, halving full-roster copies on large networks. Packets, keepalives and RTT probes are unaffected; peer status and traffic counters can take up to about a second to appear. Repeated identical phase notices are merged without reordering phases or operation results.
• Graphics: the wgpu renderer (the Windows default) prefers an integrated GPU over a discrete one, so the VPN window does not wake a discrete GPU. Linux still starts with OpenGL.
• Android: the TUN reader stops on poll errors, EOF and read errors instead of spinning, retries spurious zero-byte reads, and reports the interface as failed (retryable from the app) only while it still owns the current TUN — an older reader can never close a newer interface.
• Python: faster memoryview checksums, local API delivery that skips IPv4/UDP parsing when no subscriber needs it, and packet builders that reject malformed MAC lengths, oversized IPv4 payloads and out-of-range protocols/ports. Install with pip install "git+https://github.com/gringoestrangeiro/openrad.git@v2.0.1#subdirectory=clients/python".
• Windows packaging: windres icon paths and NSIS payload paths now work on Windows build hosts, and the TAP-Windows6 corresponding source is exported with pinned line-ending settings, so every host produces the same audited archive. Packages now include the 1.5.0 and 2.0.0 release notes.

Downloads: Linux archive; offline Windows installer (standalone EXE or documentation ZIP); portable Windows ZIP for an already installed dedicated TAP adapter; Android APK (com.openrad.mobile, version code 3, signed with the same key as 2.0.0, so it installs as an update); and SHA256SUMS for all distribution files.

Upgrade: Stop the old shared service with openrad stop and close the desktop before replacing binaries. Keep CLI and desktop from this release together. Existing identities, memberships and saved preferences are retained.

Validation: 332 default Linux workspace tests pass (8 optional ignored, and the ignored renderer/screenshot tests also pass), formatting and Linux/Windows Clippy pass with warnings denied, every Windows test executable compiles, 127 Android JVM unit tests (including new TUN poll tests), the Python suites and self-test, scripts/check-sync.py and the Wine installer-flow regression pass. Linux uses the Debian 12 / Rust 1.95 builder; the CLI requires glibc 2.34+, desktop glibc 2.35+. The PowerShell installer mocks were not run for this release; their scripts are unchanged since 2.0.0.

Windows remains experimental. Cross-compilation, synthetic rendering and Wine do not establish native TAP/UAC or real Radmin interoperability, and the native-Windows build fixes were verified on Linux only. Windows applications are unsigned; the bundled TAP driver is the unchanged upstream signed package. The Android reader changes were not exercised on a device.

Release notes · All 23 changed files

OpenRad 2.0.0 — Monorepo with Android and Python clients

OpenRad 2.0.0 turns the repository into a monorepo: the Android client (beta) and the Python SDK join the Rust desktop and CLI on one shared wire format, fixture set and message catalog.

• Android (beta): Kotlin port with TCP plus Wi-Fi-only UDP and a packet path about 1.5x faster with byte-identical wire output. This release ships a signed APK (com.openrad.mobile, Android 8.0+). Fixes a TUN reader thread leak on interface rebuilds and a rename race that could stop the VPN service underneath the new session.
• Python: stdlib-only SDK, installable with pip install "git+https://github.com/gringoestrangeiro/openrad.git@v2.0.0#subdirectory=clients/python".
• Windows installer: asks before touching a running OpenRad, stops it gracefully with its own bundled openrad stop (never an executable already in the install folder), closes the desktop window and offers Retry/Cancel while a file is still in use. It never force-terminates processes. Integrity failures name the mismatching file.
• UDP: truncated or overflowing datagrams return errors; ENET commands shorter than their 4-byte header are rejected before transmission. New errors are translated in all four languages.
• Branding and Linux launcher: one canonical logo for window, executable and installer icons. The Linux archive adds org.openrad.desktop.desktop (matching the window app_id) and install-desktop-entry.sh for a per-user menu entry.

Downloads: Linux archive; offline Windows installer (standalone EXE or documentation ZIP); portable Windows ZIP for an already installed dedicated TAP adapter; Android APK; and SHA256SUMS for all distribution files.

Upgrade: Stop the old shared service with openrad stop and close the desktop before replacing binaries. Keep CLI and desktop from this release together. Existing identities, memberships and saved preferences are retained. On Android, the earlier debug build (com.openrad.mobile.debug) is a separate app; uninstall it after installing this one.

Validation: 330 default Linux workspace tests pass (8 optional ignored), formatting and Linux/Windows Clippy pass with warnings denied, every Windows test executable compiles, Android JVM unit tests, Python suites and scripts/check-sync.py pass, and a Wine installer-flow regression covers stopping a running install through the bundled binary. Linux uses the Debian 12 / Rust 1.95 builder; the CLI requires glibc 2.34+, desktop glibc 2.35+.

Windows remains experimental. Cross-compilation, synthetic rendering and Wine do not establish native TAP/UAC or real Radmin interoperability. Windows applications are unsigned; the bundled TAP driver is the unchanged upstream signed package. The Android lifecycle fixes were not exercised on a device.

Release notes · All 135 changed files

OpenRad 1.5.0 — Peer transport display and packet-path hardening

OpenRad 1.5.0 adds an optional per-peer transport address display, a faster packet path without wire-format changes, and fault containment for send-buffer congestion, roster updates and engine panics.

• Enable Settings → Peer IP to show Peer IP: {endpoint} for direct channels and Relay IP: {ip} for relay channels, only while Connected. Off by default; fully translated.
• Sliced CRC, pipelined 32-block CBC receive, word-wise authentication, cached handshake prime, 8 KiB TCP/relay read-ahead and nonblocking Linux TAP reads. Loopback-only microbenchmarks in the performance guide; live throughput unmeasured.
• A full UDP send buffer retries as 10 ms congestion with a 35 s bound instead of failing the channel; malformed member updates no longer mutate peers or roles; panics become errors; poisoned locks recover; service/config locking split.
• Complete four-language translations, updated desktop/architecture/performance guides and two synthetic Portuguese screenshots.

Fresh Linux x86-64 and Windows x64 builds use the same committed source. Linux uses Debian 12 / Rust 1.95; the CLI requires glibc 2.34+, desktop glibc 2.35+.

Downloads: Linux archive; offline Windows installer (standalone EXE or documentation ZIP); portable Windows ZIP for an already installed dedicated TAP adapter; and SHA256SUMS for all four distribution files.

Upgrade: Stop the old shared service with openrad stop and close the desktop before replacing binaries or installing. Keep CLI and desktop from this release together. Existing identities, memberships and saved preferences are retained.

Validation: Reuse the completed implementation checks: 329 default Linux tests, formatting and Linux/Windows Clippy, Windows test compilation, Wine version check of the Windows CLI (1.5.0), and inspected CPU-rendered screenshots. The suites were not rerun for version and release-document changes. Release checks verify fresh executable versions, package checksums, architecture/imports, driver provenance and every extracted installer payload file.

Windows remains experimental. Cross-compilation, synthetic rendering and Wine version checks do not establish native TAP/UAC or real Radmin interoperability. Applications are unsigned; the bundled TAP driver is the unchanged upstream signed package.

Release notes · All 34 changed files

OpenRad 1.4.0 — Broadcast peer selection

OpenRad 1.4.0 adds multiple outgoing broadcast recipients and peer exclusions in both the CLI and desktop. Saved selections are shared through the service and apply without reconnecting.

• Select several peers to receive broadcasts, or exclude them from normal distribution. Use Settings → Outgoing broadcasts or openrad broadcast-peer [--exclude] TARGET ....
• Restore all eligible recipients with --all; query the current selection without targets. Keep existing single-peer preferences and the broadcast-peers alias.
• Validate and save the full selection atomically, deduplicate targets, and reject invalid, ambiguous or self targets.
• Compile recipients on policy/channel changes. Frame forwarding iterates effective destinations without per-packet policy locks, RID lookups or exclusion-set scans; shared buffers and FIFO/cancellation bounds are retained.
• Include complete four-language controls, updated CLI/desktop guides, a synthetic Portuguese screenshot and documented performance measurements.

Fresh Linux x86-64 and Windows x64 builds use the same committed source. Linux uses Debian 12 / Rust 1.95; the CLI requires glibc 2.34+, desktop glibc 2.35+.

Downloads: Linux archive; offline Windows installer (standalone EXE or documentation ZIP); portable Windows ZIP for an already installed dedicated TAP adapter; and SHA256SUMS for all four distribution files.

Upgrade: Stop the old shared service with openrad stop and close the desktop before replacing binaries or installing. Keep CLI and desktop from this release together. Existing identities, memberships and saved preferences are retained.

Validation: Reuse the completed implementation checks: 303 default Linux tests, formatting and Linux/Windows Clippy, Windows test compilation, and eight inspected CPU-rendered settings screenshots covering four languages and two widths. The suites were not rerun for version and release-document changes. Release checks verify fresh executable versions, package checksums, architecture/imports, driver provenance and every extracted installer payload file.

Performance scope: Nine alternating pinned-CPU runs measured 5,000 broadcasts to 120 peers at 18.59 ms before / 18.69 ms after, within observed variation. Selecting 60 peers measured 9.44 ms; excluding 60 measured 9.46 ms. The separate 50,000 directed-frame case measured 5.16 / 5.45 ms. These synthetic routing/queue measurements exclude encryption, TAP and network I/O; live throughput and latency were not measured.

Windows remains experimental. Cross-compilation, synthetic rendering and Wine version checks do not establish native TAP/UAC or real Radmin interoperability. Applications are unsigned; the bundled TAP driver is the unchanged upstream signed package.

Release notes · All 23 changed files

OpenRad 1.3.0 — Faster initial connections

OpenRad 1.3.0 speeds up initial peer setup through more parallel direct attempts and overlapping relay preparation, while preserving direct preference and existing connection deadlines.

• Raise initial capacity to 96 outgoing / 128 total peer handshakes, retaining reserved incoming capacity and retry pacing.
• Run four TCP candidate lanes with a diverse public/LAN IPv4/IPv6 first wave.
• Prepare relay TCP/ticket pairing during direct attempts on both roles. Relay authentication still follows the existing four-second direct head start and eight-second maximum extension, including the existing outgoing direct-exhaustion behavior.
• Validate up to four incoming TCP rendezvous preambles concurrently within the existing eight-socket bound; retain serialized TCP peer authentication.
• Make Windows TCP connects cancellable and recover peer-worker allocation failures without interrupting established shared channels.

Fresh builds for Linux x86-64 and Windows x64 use the same committed source. Windows includes the previous 1.2.0 installer/Radmin recovery fixes.

Downloads: Linux archive; offline Windows installer (standalone EXE or documentation ZIP); portable Windows ZIP for an already installed dedicated TAP adapter; and SHA256SUMS for all four distribution files. Linux CLI requires glibc 2.34+, desktop glibc 2.35+.

Upgrade: Stop the old shared service with openrad stop and close the desktop before replacing binaries or installing. Keep CLI and desktop from this release together. Existing identities, memberships and preferences are retained.

Validation: Reuse the completed implementation checks: 300 default Linux tests, formatting and Linux/Windows Clippy, Windows test compilation, and 43 selected Windows Rust tests under isolated Wine. The suites were not rerun for release metadata updates. Release checks verify freshly compiled executable versions, package checksums, architecture/imports, driver provenance and every extracted installer payload file.

Windows remains experimental. Cross-compilation and synthetic Wine tests do not establish native TAP/UAC or real Radmin interoperability. Public-network connection-time measurements remain outstanding. Applications are unsigned; the bundled TAP driver is the unchanged upstream signed package.

Release notes · All 17 changed files

OpenRad v1.2.0 — Broadcast controls and Windows recovery

OpenRad 1.2.0 adds saved outgoing broadcast controls, improves shared-engine and frontend processing, and fixes Windows TAP error 995 and official Radmin adapter recovery. Fresh Linux x86-64 and Windows x64 builds include all changes since 1.1.0. Windows support remains experimental.

Windows installer refresh — 2026-10-04

The three Windows downloads and SHA256SUMS have been refreshed. The installer now closes official Radmin VPN before creating/repairing OpenRad's TAP, including first installation, repair and the already-installed launch path. Preparation failure stops installation before files or TAP changes.

• Force-terminate both RvRvpnGui.exe and RvControlSvc.exe, even if service-stop requests are refused. Use exact-image termination and a taskkill fallback.
• Try administrator recovery, escalate to a temporary SYSTEM task, and make one final administrator attempt if SYSTEM fails.
• Try GUID-bound NetAdapter, CIM, netsh, PnP and PnPUtil disabling, including PnPUtil's supported force fallback. Verify two seconds of stopped/disabled state and handle immediate restarts.
• Carry the large initial program through private UTF-8 stdin to respect Windows' command-line limit. Keep trusted system tools/modules, encoded SYSTEM workers, protected diagnostic IPC and cleanup.
• Recognize numbered official adapter descriptions and identify the exact adapter/address in remaining conflicts.

This refresh passed 295 default tests, 53 synthetic PowerShell cases, nine isolated installer-flow cases and fourteen selected Windows Rust tests under Wine, plus formatting, Clippy for both targets and compilation of all Windows tests. Packaging verified 518 internal Windows archive checksums, 505 installer-manifest entries, exact extracted binaries/worker, driver/source hashes, notices and all relative documentation links.

The Linux archive remains byte-for-byte unchanged. The original v1.2.0 tag and GitHub's automatically generated source archives still refer to the initial release. Refreshed Windows source: 25afcb8, recorded in each Windows package's BUILD-INFO.json. See the refresh guide and 19-file inventory.

Download the installer again, stop/disconnect OpenRad and close its desktop before updating. The installer closes official Radmin itself. Identities and saved settings are retained. Native installation with Radmin initially running remains unverified; Windows support remains experimental.

Broadcast controls

Choose one recipient in Settings → Outgoing broadcasts, or use openrad broadcast-peer with a RID, exact device name or VPN IP. Use --all or 0.0.0.0 to restore all eligible recipients.

The preference is saved by RID, shared between desktop and CLI, and applies without reconnecting. Querying, choosing a RID and restoring all recipients also work while disconnected. Name/IP selection requires a loaded roster and rejects ambiguous matches. An unavailable selected peer causes outgoing broadcasts to be dropped without fallback; incoming broadcasts and normal unicast/multicast routing are preserved.

Read the CLI reference or the new Brazilian Portuguese CLI guide. Controls and messages are translated into English, Portuguese, Russian and Vietnamese.

Windows fixes

• Start the first overlapped TAP read on the persistent engine thread after setup handoff. The previous read could be canceled when its setup thread exited, producing OS error 995 immediately after interface setup.
• Continue selected official-adapter recovery when the Radmin service refuses to stop or its process cannot be terminated. The refresh force-terminates both known Radmin images even after a refused stop request and verifies stopped/disabled state before proceeding.
• Return bounded SYSTEM-worker failure details through a temporary current-user/SYSTEM protected named pipe. Show readable errors instead of raw PowerShell CLIXML and retain useful service-stop and adapter-disable details.

Recovery preserves the user's profile and identity, and leaves Radmin's startup configuration intact. See Windows migration and troubleshooting.

Engine and frontend improvements

• Route outgoing frames through one bounded FIFO forwarding worker and cache indexed authenticated endpoints, preserving dispatch order and cancellation.
• Reject inbound frames from replaced channel generations before TAP delivery.
• Parse setup records on attachment workers, transfer owned buffers, and index incoming admission/cleanup by connection and peer IDs.
• Deduplicate catalog pages in expected linear time, cache joined-network names, release replaced snapshots outside the notice lock, and avoid repeated atomic exchanges for pending wake notifications.

The performance guide explains the scope of synthetic measurements. This release does not claim measured live VPN throughput or whole-client CPU/RSS improvement.

Read the full changelog, 32-file change inventory, and release verification and platform limits.

Downloads

Package	Use
Linux archive	CLI and desktop; glibc 2.35+ for the desktop, 2.34+ for CLI
Windows installer	Offline setup with the pinned signed TAP-Windows6 driver
Windows setup ZIP	Installer and documentation
Windows portable ZIP	Requires an installed dedicated TAP adapter and elevation

Verify downloads with SHA256SUMS. Packages include guides, synthetic screenshots, build/import metadata, dependency notices and internal checksums. Refreshed Windows build metadata identifies the later source commit above. The installer also includes corresponding driver source, installer source and an audited installation manifest.

Upgrade and validation

Use Disconnect or openrad stop, close the old desktop, and replace both Linux binaries together or run the Windows installer. Keep the CLI beside the desktop. Restart the background service so it loads the new engine. Existing identities, memberships, favorites, saved lists and credential-storage choices are preserved.

Initial release validation: 293 default Linux tests, five optional CPU-rendering tests with twenty reviewed synthetic captures, formatting and Clippy for both targets, compilation of all Windows tests, 38 synthetic PowerShell cases, eight isolated Wine installer-flow cases and twelve selected Windows Rust tests under Wine. All fresh executables report 1.2.0. Linux was built with Rust 1.95 on Debian 12; Windows was cross-built with Rust 1.98.1/MinGW-w64.

Initial package audits verified 1,155 internal archive checksums, 504 installer-manifest entries, exact extracted executables and embedded setup worker, all relative documentation links, source provenance, binary versions/imports, pinned driver/source hashes and external SHA-256 checksums.

The privileged Linux TAP/Polkit session path and native Windows TAP, UAC, SYSTEM recovery, named-pipe ACLs, credential storage and real Radmin interoperability were not established by these synthetic checks. Cross-compilation, mocked PowerShell cmdlets and Wine do not establish native Windows support. The applications are unsigned; the bundled TAP driver retains its upstream signature.

OpenRad v1.1.0 — Linux TAP authorization and service security

OpenRad 1.1.0 fixes Linux TAP setup from the shared background service and includes the service, identity, and protocol security changes made since 1.0.0. Fresh Linux x86-64 and Windows x64 builds are included. Windows support remains experimental.

Linux interface fix

The detached VPN service could not reliably use the launching terminal's sudo -v authorization, even after the password was accepted. OpenRad now tries existing noninteractive sudo authorization, then opens the system permission dialog through the session's Polkit agent. Only the short-lived TAP helper is elevated; OpenRad never collects the administrator password.

Interface setup runs in a separate worker, with bounded authorization/setup waits, cancellation on Disconnect/Stop, and protection against duplicate pending retries. Actual setup errors do not trigger a second authorization prompt. Guidance is updated in English, Portuguese, Russian, and Vietnamese.

Allow the system permission dialog when connecting. Polkit/pkexec and a session authentication agent must be running. See the Linux guide for headless setups and troubleshooting.

Other changes since 1.0.0

• Bound local service clients to 32 workers and queued commands to 128; enforce aggregate local I/O deadlines and request-size limits.
• Resolve curl and elevated PowerShell through protected OS paths, restrict module lookup, and embed validated adapter setup scripts.
• Reject remote loopback peer candidates and IPv4-mapped IPv6 bypasses while retaining private LAN candidates and explicitly local control deployments.
• Sanitize terminal control characters in remote names and validate imported device names.
• Use bounded regular-file reads for identities, passwords, settings, moduli, and installation records; reject FIFOs promptly and retain corrupt/broken preferences.
• Keep private passwords and IPC buffers in zeroized memory; clear Windows overlapped buffers only after completion/cancellation.
• Prevent duplicate device registration when credential storage is unavailable or locked; retain incomplete private profiles and existing identity storage.

Read the full changelog, 41-file change inventory, and release verification and platform limits.

Downloads

Package	Use
Linux archive	CLI and desktop; glibc 2.35+
Windows installer	Offline setup with the pinned signed TAP driver
Windows setup ZIP	Installer and documentation
Windows portable ZIP	Requires an installed TAP adapter and elevation

Verify downloads with SHA256SUMS. Packages include guides, synthetic screenshots, build/import metadata, and dependency notices; the installer includes corresponding driver source.

Upgrade and validation

Use Disconnect or openrad stop, close the old desktop, and replace both Linux binaries together or run the Windows installer. Keep the CLI beside the desktop. The previous background service retains its old code until restarted. Existing identities, memberships, favorites, and saved lists are preserved.

Passed: 279 default Linux tests, four offscreen rendering tests, formatting and Clippy for both targets, all Windows test compilation, 30 mocked PowerShell cases, eight isolated Wine installer-flow cases, and two selected Windows security/I/O tests under Wine. All release executables report 1.1.0. Linux was built with Rust 1.95 on Debian 12; Windows was cross-built with Rust 1.98.1/MinGW-w64.

Package audits verified 1,137 internal archive checksums, 498 installer-manifest entries, exact extracted executable/worker payloads, source provenance, binary versions/imports, and external SHA-256 checksums.

The privileged Linux TAP/Polkit session path and native Windows TAP/UAC/VPN interoperability were not exercised by these synthetic checks. Windows runtime validation remains outstanding; cross-compilation and Wine do not establish native support.

OpenRad v1.0.0 — Shared sessions and network workflows

OpenRad 1.0.0 brings shared desktop/CLI sessions, easier network management, and transport improvements. Fresh Linux x86-64 and Windows x64 builds are included; Windows support remains experimental.

Highlights

• One persistent VPN service: desktop and CLI share the same identity, networks, peers, and interface.
• Network workflows: favorites, saved Auto join lists, paced batch joins, live search, and scrollable network layouts. Saved lists never store passwords.
• Peer controls: authenticated RTT tests, device renaming, and relay-only mode, also available through CLI commands.
• Identity recovery: bounded provisioning retries, visible reset progress, storage retries, and safer diagnostics.
• Efficiency: fewer allocations and copies in UDP, tunnel frames, status updates, UI lists, and Windows TAP writes; higher Unix socket capacity.
• Languages and updates: complete English, Portuguese, Russian, and Vietnamese translations, plus background release notices.

Downloads

Package	Use
Linux archive	CLI and desktop; glibc 2.35+
Windows installer	Offline setup with TAP driver
Windows setup ZIP	Installer and documentation
Windows portable ZIP	Requires an installed TAP adapter and elevation

Verify downloads with SHA256SUMS. See the Linux and Windows setup guides.

Upgrading

Use Disconnect or openrad stop, then close the desktop before upgrading. Replace both Linux binaries together or run the Windows installer. Keep openrad beside openrad-desktop.

Closing the desktop or terminal now leaves the VPN running. Disconnect or openrad stop stops the shared session.

Validation and details

Linux: 252 default tests and four optional rendering tests passed. Formatting, Clippy for both targets, package audits, and uploaded checksums passed.

Windows: 241 Rust tests passed under Wine; one existing named-pipe exclusivity test failed, and the CLI service suite remains unverified. Native Windows driver/UAC/VPN validation is outstanding.

Read the full changelog, complete 53-file change inventory, and detailed verification and platform limits.

OpenRad v0.9.5 — Automatic Radmin VPN conflict recovery

OpenRad 0.9.5 automatically resolves the Windows adapter conflict encountered when migrating from official Radmin VPN.

Automatic Windows recovery

When the enabled Famatech Radmin VPN Ethernet Adapter occupies 26.0.0.0/8, both the desktop and CLI use their administrator elevation to run a temporary SYSTEM task. It stops the service running RvControlSvc.exe, force-terminates any remaining RvControlSvc.exe processes, and disables the selected official adapter. OpenRad removes the task, checks active addresses again, and continues the same connection attempt.

The worker is embedded in the executable and uses built-in Windows PowerShell and Task Scheduler. Recovery works offline, requires no PsExec download, and keeps the application's normal user profile and credentials. Other VPN conflicts and stale OpenRad addresses remain errors. Recovery waits are bounded and errors are logged.

Radmin's adapter stays disabled and its service stays stopped after OpenRad disconnects. Its installation and service startup setting are retained. To switch back, close/disconnect OpenRad, enable the official adapter, and start Radmin's service or restart Windows. See the Windows migration guide.

Downloads

Platform	Asset	Details
Windows x64	OpenRad-Setup-0.9.5.exe	New offline installer; installs the 0.9.5 CLI/desktop and signed TAP-Windows6 9.27.0 driver.
Windows x64	openrad-0.9.5-windows-x86_64-setup.zip	Same installer with guides, build metadata and checksums.
Linux x86-64	openrad-v0.9.0-linux-x86_64.tar.gz	Exact unchanged archive from 0.9.0, reused because this release changes Windows behavior only. Linux binaries and internal metadata still report 0.9.0.
All	SHA256SUMS	SHA-256 checksums for the three downloadable packages.

The reused Linux archive has SHA-256 d5893fd5f0df173fc74af70b6b8cbf3d1587f3278b54ba59f13a67bf031ca055 and preserves the original Debian 12/Rust 1.95 build provenance.

Validation

• 191 default Rust workspace tests passed on Linux, including nine new recovery regressions; three optional tests remained ignored.
• Rust formatting and Linux/Windows-target Clippy with warnings denied passed. Windows release binaries and all Windows test executables cross-compiled with Rust 1.98.1/MinGW-w64; Windows tests were compiled, not executed.
• 19 synthetic PowerShell recovery cases, eleven existing adapter setup cases, and script syntax checks passed. Eight isolated Wine installer-flow cases passed using dummy executables.
• PE/DLL audits, the installer administrator manifest, extracted installer payload hashes, pinned signed driver/source hashes, ZIP internal checksums and the reused Linux archive hash passed.

Windows support remains experimental. Earlier Windows 10 success was user-reported for 0.9.0. The new SYSTEM recovery has not been executed on a real Windows machine by the Linux release builder; migration with the official adapter/service installed still needs Windows testing. Please report results or problems with relevant logs and no credentials or packet captures.

Changelog · Release details · Windows setup and recovery

Source commit: 8d793b44a380c4d60aca43dd56fda6e4b5d77065.

OpenRad v0.9.0 — Experimental Windows support and four languages

OpenRad v0.9.0 — Experimental Windows support and four languages

OpenRad 0.9.0 adds Windows x64 desktop/CLI support and complete English, Portuguese, Russian and Vietnamese interfaces. Linux remains the established platform.

Windows support is experimental. It has been tested only on Windows 10 so far, where the tester reports it working perfectly in their setup. Windows 11 and other hardware, VM and networking configurations still need validation. Please open an issue with your Windows version/build, hardware/VM details, renderer, reproduction steps and relevant logs. We need more Windows data to make support stable for 1.0.0.

macOS support is planned, but work on it has not started yet.

Downloads

• Linux x86-64: openrad-v0.9.0-linux-x86_64.tar.gz. Keep the CLI and desktop together; run as your normal user, with sudo used only for the TAP helper.
• Windows x64, experimental: openrad-0.9.0-windows-x86_64-setup.zip, containing OpenRad-Setup.exe and guides. A standalone OpenRad-Setup-0.9.0.exe is also attached.
• Checksums: SHA256SUMS covers all three download assets.

The Windows setup works offline, installs both applications and the official signed TAP-Windows6 driver, creates/repairs the dedicated adapter, adds shortcuts and opens the desktop. Repeat setup checks/reuses the installation; --no-launch skips desktop startup for CLI use. Driver source/build scripts and notices are bundled. Native Direct3D 12/WARP rendering is preferred before OpenGL; explicit renderer options remain available. No Radmin driver is bundled.

Windows observations versus the official client

Same Windows 10 setup, one shared network with 76 peers:

Idle measurement	Official Radmin VPN	OpenRad
Memory	176 MB GUI + 23 MB service = 199 MB	41 MB client
CPU	1–4%	0–3%

These are user-reported observations from that setup, not a controlled throughput benchmark. Idle CPU usage is broadly similar; further CPU and memory improvements are planned.

Included changes and verification

• Consolidated TAP discovery/GUID and access-denied fixes, persistent Windows named-pipe CLI control, OS credential storage, native/software graphics selection and desktop/CLI crash diagnostics.
• Added automatic locale detection, saved language preferences and --language overrides, with embedded Noto Sans and its license.
• README includes Linux and Windows build guides and Windows issue-report guidance.
• 182 default tests passed on Linux, plus the optional CPU software-renderer pixel test. Native and Windows-target Clippy with warnings denied, Rust formatting and 11 synthetic PowerShell adapter cases passed.
• Linux release built in Debian 12 with Rust 1.95; Windows release cross-built on Linux with MinGW-w64/Rust 1.98.1. ELF/glibc and PE/DLL audits, NSIS payload extraction, driver/source hashes and archive/checksum verification passed.
• The release builder did not run Windows applications or drivers. Windows 10 runtime success is tester-provided feedback; broader Windows coverage remains pending. Native Windows/MSVC build instructions have not been executed by the Linux release builder.

Full changelog · Release details · Windows setup and logs

Source commit: 7e3466015b2ccc6b260817e73bf015fe4d05c7b7.