v1.6.0

MirrorProxy 1.6.0

MirrorProxy 1.6.0 adds native Linux source migration, clearer source capabilities
and upstream diagnostics, bounded runtime work, and administration usability fixes.
This is a backward-compatible feature release, not a protocol-breaking upgrade.

Native Linux package-manager configuration

• A shared catalog describes 28 distribution profiles and their version ranges.
  The CLI detects supported systems and writes native APT, RPM, pacman, APK,
  XBPS, Gentoo, and other supported configurations with dry-run previews and
  protected multi-file rollback. Existing signatures, architecture restrictions,
  comments, disabled repositories, and unrecognized third-party sources remain.
• Explicit Ubuntu flavour IDs and Mint vendor identification avoid treating
  unrelated derivatives as supported systems. Mint/LMDE support is scoped to
  Mint 19–22 and LMDE 6–7.
• Recognize 96 LinuxMirrors mirror roots using exact host and path boundaries;
  this does not automatically select that mirror as the server upstream.
  Attribution and the upstream MIT notice are retained.
• Add EPEL, EPEL Next, EPEL Archive, AlmaLinux Vault, independent Docker CE
  repository operations, and signed Gentoo HTTP snapshot synchronization.
  Docker CE source configuration does not install or restart a Docker daemon;
  APT bootstrap requires an operator-provisioned official Docker signing key.
• Fix CentOS Stream metalink migration and Void vendor aliases. RHEL still
  requires an entitled customer mirror; NixOS requires module activation.

Source visibility and runtime improvements

• Source cards and setup dialogs explain cache support/current enablement,
  authentication, supported clients, and Hugging Face transport limitations.
• Administrator diagnostics explain upstream order, failures, latency and
  cooldown without exposing full request URLs or running a new probe on refresh.
• Bound cache I/O and Argon2 concurrency, share immutable configuration
  snapshots, batch/paginate user summaries, and bound upstream endpoint state.
• Large package streams no longer fail solely because their total duration
  exceeds the request timeout. Connection/read-idle deadlines, redirect checks,
  and bounded cache behavior remain in effect.
• Use the corrected Fedora default and merge missing supplemental defaults
  while preserving custom upstreams. Optional GeoIP download prefixes retain
  pinned SHA-256 validation for reproducible container builds.

Security and interface fixes

• Resolve CodeQL findings using runtime-generated authentication fixtures,
  explicit local TLS trust in SOCKS protocol tests, and accurately named Argon2
  result helpers. No security query is suppressed and no alert is dismissed.
• Passwords remain Argon2-hashed; sessions remain independent random tokens.
  TLS, SSRF, path validation, authentication, authorization, CSRF, quotas and
  existing token lookup/database formats are unchanged.
• Fix destructive-button hover contrast in both themes, remove duplicate inner
  search focus outlines, and give setup dialogs centered square close buttons
  with a 44-pixel touch target and visible keyboard focus.
• Update the Vitest development-tool dependency family to 5.0.5 for
  mock-registration injection
  and Windows redirect traversal.
  These tools are not embedded in the production server. No broad dependency
  upgrade is included. The existing scoped
  RUSTSEC-2023-0071 exception remains: the OIDC dependency uses RSA public-key
  verification, not the affected private-key operations. See
  SECURITY.md.

Compatibility, verification, and rollback

• Existing routes, TOML and SQLite schema 4 remain compatible with v1.5.0;
  this release adds no new database migration. Preserve configuration, SQLite,
  cache, GeoIP files, and any encryption master key when replacing the binary.
• Existing enabled-source choices and custom upstreams remain. Explicitly
  customized repository maps may need additional roots enabled/configured.
  Docker registry-mirrors applies to Docker Hub; other OCI registries require
  explicit image-host rewriting.
• Verify release archives with SHA256SUMS. After replacement check /version,
  /healthz, real package payloads/signatures, the embedded Web assets, and logs.
  A rollback to v1.5.0 can reuse the schema-4 database, but should also restore
  compatible runtime configuration. Client rollback uses its recorded state and
  refuses unsafe or foreign configuration paths.
• Native acceptance exercised 21 representative x86_64 profiles plus signed
  supplemental repositories. Seven profiles remain unverified in authentic
  environments: Zorin, Armbian, Proxmox, Raspberry Pi OS, RHEL, EndeavourOS and
  NixOS. Do not interpret the catalog as complete release/architecture coverage.
  See the acceptance record.
• Release validation includes locked all-feature Rust tests, strict Clippy,
  frontend tests, Chromium E2E, real administrator smoke, dependency audits with
  the documented exception, and exact-commit CI/CodeQL. Published checksums and
  a representative server archive must be read back and verified after release.
  Local gates passed 387 Rust tests, 40 frontend tests, 30 Chromium E2E tests,
  administrator API smoke, and npm audit with zero vulnerabilities.
• Docker publication/signing is independent and may finish after native assets.
  Publishing a release alone does not deploy it. Host-specific DNS settings and
  operator-selected Trisquel fallback mirrors are not changed by these binaries.

Full comparison: v1.5.0...v1.6.0