WolfStack v25.1.7

v25.1.7: WolfNet-IP conflict check ignores stale routes from deleted nodes (wabil)

After wabil deleted the whole cluster and tried to re-add a node, the join was
rejected: 'WolfNet IP conflict — 10.10.10.4 is already in use'. The v25.0.3 check
reads WOLFNET_ROUTES (the IP→owner cache), and a deleted node's route lingers there
until the 60s prune — with no registry entry left to exclude it, the stale route
looked like a live conflict. Now wolfnet_ip_conflicts() only counts a conflict when
the route's owner is a node that is ACTUALLY in the registry right now (new
live_addrs arg); a stale cache entry for a deleted node can no longer block re-adding
its IP. Still fail-open on unknown/non-live owners. Unit test covers the deleted-node
case.

---

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfstack-x86_64 / wolfstack-aarch64 — static musl binaries (Linux x86_64 and ARM64 / Raspberry Pi 4+).
• wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.