v1.4.3

MirrorProxy 1.4.3

MirrorProxy 1.4.3 improves PyPI compatibility for HTML indexes with relative
package download links, corrects Linux package delivery, and fixes desktop
converter alignment. Thank you to @comqx for
contributing the relative-link fix in PR #8.

PyPI: relative package downloads

Some simple indexes link to wheels or source archives using
../../packages/.... These links previously resolved to an unhandled local
route. The server now rewrites the links to its public /pypi/packages/...
endpoint and forwards downloads with the upstream packages/ segment intact.
Configured file-base directories, query strings, and SHA-256 fragments are
preserved; the existing /pypi/files/... route remains compatible.

Set upstreams.pypi_files to the file host or base directory before
packages/, for example https://files.pythonhosted.org or
https://mirror.example/python. This patch supports the specified relative
link pattern in HTML simple indexes; it does not claim arbitrary HTML/JSON
index rewriting or unrestricted forwarding to file hosts.

The new route shares the existing path validation, proxy forwarding,
enablement, access, quota, rate-limit, and observability paths. Regression tests
exercise a real local upstream from index retrieval through download, checking
upstream paths, archive bytes, SHA-256, HEAD, base directories, query strings,
quoted links, disabled PyPI, and invalid paths. A real pip smoke test also
confirmed wheel download, SHA-256, and archive contents against a local index.

Linux packages and Web console

• Include ARM64 server DEB and RPM packages alongside x86_64 server packages.
• Use per-artifact checksum sidecars with matching package filenames, avoiding
  checksum-name mismatches and collisions across release matrix jobs.
• Build RPMs with an explicit target architecture and avoid host-only strip
  and debug-package helpers when packaging cross-architecture binaries.
• Align quick converter input controls across desktop cards when the hints
  above them wrap to different line counts.

Security impact

• Update development/test dependency undici from 7.29.0 to 7.30.0 to resolve
  audit findings. This dependency update is not a production Rust proxy
  vulnerability fix.
• Preserve the upstream redirect and destination protections introduced in
  1.4.2. No authentication, authorization, TLS, CSRF, or SSRF controls are
  relaxed by this patch.

Compatibility, upgrade, and rollback

• No configuration or SQLite schema migration is required. Existing client
  commands, routes, stored data, and encrypted secrets remain compatible.
• Keep configuration, databases, cache, and GeoIP data when replacing the
  server binary. Back up the current binary before restarting the service.
• Verify the downloaded artifact against SHA256SUMS. To roll back, restore
  the previous 1.4.2 binary and restart the service; the relative PyPI download
  limitation will return.

Verification and delivery

• The implementation commit passed CI and CodeQL, including public-client
  protocol smoke. The versioned release commit is validated separately with
  locked Rust builds/tests, formatting, strict Clippy, frontend tests/build,
  browser E2E, real administrator API smoke, and dependency audits.
• The release workflow builds cross-platform client archives, server archives,
  native Linux packages, checksums, signed APT repository, and package-manager
  metadata. The release handoff verifies a representative artifact's checksum
  and binary version after publication.
• Production deployment is separate from publishing this release.

Full comparison: v1.4.2...v1.4.3