WolfProxy v0.4.13

v0.4.13: resolve relative includes against the config root, like nginx

wabil reported includes that "were working and now aren't." The cause is a
long-standing divergence from nginx: WolfProxy resolved a relative include
path only against the including file's directory, whereas nginx resolves it
against the config-root prefix (e.g. /etc/nginx). So the standard pattern of a
server block in sites-enabled/ doing include snippets/ssl.conf; — written
relative to /etc/nginx — resolved to /etc/nginx/sites-enabled/snippets/ssl.conf
(missing) and the directives were silently dropped.

Fix: thread the config-root prefix through the parser and resolve every
relative include against BOTH the including file's dir (historical behaviour)
and the prefix (nginx behaviour), at the top level and inside server blocks.
Matches are merged and de-duplicated by canonical path, so a config that
already worked keeps working and a file reachable both ways is never loaded
twice. Purely additive — it can only resolve includes that previously matched
nothing, so it can't break an existing install.

• include_candidate_paths() builds the [file-dir, prefix] candidate list.
• parse_nginx_config_in / parse_nginx_content_in carry the prefix recursively;
  load_nginx_config + load_nginx_sites pass nginx_dir as the prefix.
• expand_server_includes() takes the prefix and de-dups the same way.
• 2 tests: a prefix-relative server-block include now resolves; a top-level
  include reachable via identical base+prefix roots loads exactly once.

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.