WolfProxy v0.4.14

v0.4.14: name the process holding a port on bind failure

klasSponsor hit 'Failed to bind HTTPS to 0.0.0.0:80: Address in use'
with the unhelpful blanket hint 'try running with sudo or use ports >
1024' — but sudo can't free a port another process already holds.

bind_failure_hint() now splits by error kind:

• AddrInUse: identify the holder via /proc and name it, e.g.
  'port 80 is already held by nginx (pid 1234). Stop that process or
  move this site to a free port.' Plus a nudge that SSL on port 80 is
  almost certainly a misconfig (HTTP=80, HTTPS=443) — which is what
  klasSponsor's config did to land :80 in the HTTPS listener set.
• PermissionDenied: keep the run-as-root / port>1024 advice (the only
  case where that hint is actually correct).

identify_port_holder() parses /proc/net/tcp{,6} for LISTEN sockets on
the port, collects their inodes, then walks /proc//fd to find the
owning PID(s) and reads /proc//comm. Pure /proc — no ss/lsof
dependency, so it works on minimal images. Best-effort: falls back to
the ss hint if the holder can't be resolved. Runs only on bind failure
(startup, rare). Verified end-to-end against a live listener. clippy-clean.

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.