WolfProxy v0.4.9

v0.4.9: WebSocket / upgrade proxying — consoles work through the proxy

handle_proxy did http_client.request().await and returned the response,
and stripped the Upgrade header, so WebSocket upgrades never completed —
every console (WolfStack + Proxmox, both wss) hung behind the proxy (wabil
2026-06-12). The plain-HTTP listener uses axum::serve (upgrades work
natively); only the HTTPS manual loop was broken (it used serve_connection).

Fix:

• TLS listener -> serve_connection_with_upgrades.
• New is_ws_upgrade(); handle_proxy gains a WebSocket branch that forwards
  the handshake to one backend KEEPING Upgrade/Connection/Sec-WebSocket-*
  (stripping the other hop-by-hop headers), captures the client upgrade
  before sending upstream, and on a 101 spawns a detached copy_bidirectional
  tunnel between the two upgraded sockets (handshake bounded by a 30s
  timeout; copy unbounded for the session).
• Reuses the existing hyper-util legacy client (it manages upgrades), so
  v0.4.8's hyper-rustls connector handles wss upstreams too.

Verified end-to-end (netns-isolated): normal HTTPS GET unregressed, plus
wss->plain-ws and wss->wss(TLS) upstreams both 101 + correct accept +
working bidirectional tunnel. Confirmed the 5-min connection cap does NOT
kill upgraded tunnels (the conn future resolves at upgrade; timer never fires).

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.