WolfProxy v0.4.10

v0.4.10: load config the nginx way — read root.conf main config + process its includes

WolfProxy previously only auto-scanned <config_dir>/sites-enabled/* and
conf.d/*.conf and never read a top-level main config, so an nginx-style
root.conf full of include directives was ignored (wabil report).

New load_nginx_config(): if <config_dir>/root.conf exists, parse it as the
main config and let its include directives pull in everything else —
relative paths and * globs resolved against each file's directory, exactly
like nginx, recursively. Both the live loader and 'wolfproxy --test' use it.

Falls back to the existing sites-enabled/ + conf.d/ auto-scan when there is
no root.conf, so existing installs are unchanged — root.conf is a
non-standard filename, so detecting it by presence only ever opts a user in.

Test covers both: root.conf include-glob loads a subfolder server, and the
no-root.conf auto-scan fallback still loads conf.d servers.

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.