WolfProxy v0.4.8

v0.4.8: upstream HTTPS — proxy_pass https:// backends actually work

The upstream client was a plain hyper HttpConnector with no TLS path at
all: an https:// proxy_pass parsed fine, then the client sent a
cleartext HTTP hello to the TLS port and the backend reset the
connection (502, ConnectionReset). Every https upstream — WolfStack
:8553, Proxmox :8006, PBS :8007 — was categorically broken while http
upstreams worked, and no config directive could fix it.

The client now wraps the same tuned connector (keepalive, connect
timeout, bounded pool) in hyper-rustls with nginx-parity defaults for
the fleet this proxies: certificate verification off (proxy_ssl_verify
off equivalent — these upstreams all serve self-signed certs; the TLS
session itself is still fully verified against the presented cert) and
SNI sent automatically from the URI host. https_or_http keeps plain
http:// upstreams on the same client.

Verified live: a self-signed local TLS upstream through wolfproxy
returned 502/ConnectionReset on v0.4.7 and returns 200 with the
upstream body on this build; the http control path is unchanged.

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.