h5i v0.4.1

Install

One binary. h5i is the confined development environment, and it
carries its own browser engine.

Linux / macOS:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.4.1/h5i-v0.4.1-<TARGET>.tar.gz | tar -xz
sudo mv h5i /usr/local/bin/

Windows: download the .zip, extract h5i.exe, and add it to your PATH.

The browser

h5i browser open https://example.com
h5i browser snapshot
h5i browser requests     # what it asked for, and what was refused
h5i browser audit        # the whole session, afterwards

The rendering engine is part of this binary. It used to ship as a
second archive (h5i-browser-light); h5i browser execs itself to
become it now, and h5i __engine reaches its own CLI for the cases
that want it directly.

The websec workbench

h5i-websec is a separate archive, and installing it is a
deliberate act:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.4.1/h5i-websec-v0.4.1-<TARGET>.tar.gz | tar -xz
h5i plugin install websec --from ./h5i-websec

It holds no privilege of its own: every verb runs the h5i browser
verbs a person would type, through the same policy, budget and
receipts.

Every request it makes is checked against an allowlist — every
request and every redirect hop — and written to the log before any
bytes move. A request that is not in h5i browser requests did not
happen. What a box adds, with --in, is that the record gains a
witness outside the browser; on a bare host that part is not
claimed.

Available targets

Target	Platform
x86_64-unknown-linux-musl	Linux x86_64 (static, glibc-free)
aarch64-unknown-linux-musl	Linux arm64 (static, glibc-free)
aarch64-apple-darwin	macOS Apple Silicon (arm64)
x86_64-pc-windows-msvc	Windows x86_64

Intel Macs have no published build: Rosetta 2 translates x86_64 to
arm64, not the reverse, so the aarch64-apple-darwin archive will
not run there. Build from source instead:
cargo install --git https://github.com/h5i-dev/h5i

Each archive is accompanied by a .sha256 checksum file.

What's Changed

• Rename h5i browser light by @Koukyosyumei in #600
• Improve websec bench by @Koukyosyumei in #602
• add a raw send path for verbatim request-targets and smuggling by @Koukyosyumei in #603
• Improve benchmark by @Koukyosyumei in #604
• Update README.md by @Koukyosyumei in #605
• Koukyosyumei patch 1 by @Koukyosyumei in #606
• Fix exploitable bugs in the websec workbench by @Koukyosyumei in #607
• bump to v0.4.1 by @Koukyosyumei in #608
• SHOWCASE: h5i-audit-report by @Pewpenguin in #613
• improve doc by @Koukyosyumei in #614
• Skill for websec by @Koukyosyumei in #615
• fix the windows release build by @Koukyosyumei in #616

New Contributors

• @Pewpenguin made their first contribution in #613

Full Changelog: v0.4.0...v0.4.1