Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 17:08
· 91 commits to main since this release
v0.6.0
1e1d2f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

pxgo v0.6.0

This release closes the largest remaining proxy-parity gaps and publishes the first PxGo release with end-to-end Unix Kerberos/SPNEGO upstream authentication.

Highlights

  • Unix Kerberos/SPNEGO is wired end-to-end. On Linux and macOS, --kerberos now uses the manager-owned FILE credential cache to obtain an HTTP/<proxy-host> service ticket and authenticate upstream Negotiate challenges for both ordinary HTTP proxy requests and CONNECT tunnels.
  • HTTPS parent proxies are covered. Kerberos/SPNEGO retry behavior is regression-tested when the upstream proxy itself is reached over TLS.
  • Live KDC verification no longer skips SPNEGO. CI provisions a real MIT KDC plus HTTP/proxy.pxgo.test, then requires successful SPNEGO service-ticket acquisition.
  • Migration from Python px is easier. Legacy PX_* environment variables and px.ini are accepted as fallbacks, while native PXGO_* and pxgo.ini retain precedence.
  • More deterministic reliability tests. Replay-body cleanup failure is tested with explicit fault injection rather than filesystem permission behavior that varied under root/container execution.
  • Broader CLI/diagnostic confidence. Doctor and quit behavior now have additional live/fallback/error-path tests.
  • Distribution is operational. Homebrew is published from khanhkit/homebrew-tap; each release also carries the generated direct-install Scoop manifest. The KhanhKit.PxGo WinGet submission is technically validated upstream but is not advertised as published until Microsoft accepts it.

Authentication behavior

Linux and macOS

With --kerberos enabled, PxGo manages the Kerberos ticket lifecycle and uses that credential cache for upstream SPNEGO authentication. The service principal is derived as HTTP/<proxy-host>.

Windows

Windows transparent authentication remains a separate current-user SSPI path. Do not use --kerberos as a Windows SSPI selector; omit explicit upstream credentials when current-user NTLM/Negotiate SSO is desired.

Real domain-backed AD/SPN verification remains tracked separately because it requires a protected domain-joined Windows runner. Hosted Windows native SSPI roundtrip and handle-soak tests remain green, but they are not represented as a substitute for real AD evidence.

Migration compatibility

Existing PxGo configuration remains compatible. For users migrating from Python px:

  • PXGO_* overrides the corresponding legacy PX_* variable.
  • pxgo.ini is preferred over legacy px.ini.
  • Legacy px.ini is read as a compatibility fallback; --save continues to write native pxgo.ini.

The effective precedence remains:

command line > PXGO_ environment > PX_ environment > explicit dotenv > pxgo.ini/px.ini > defaults

Installation

Release archives are available for Linux, macOS, and Windows on amd64 and arm64. Verify downloads against checksums.txt.

Homebrew:

brew tap khanhkit/tap
brew install pxgo

Windows Scoop direct install:

scoop install https://github.com/khanhkit/pxgo/releases/latest/download/pxgo-scoop.json

WinGet package KhanhKit.PxGo is still pending publication in the external Microsoft catalog and should not yet be treated as an official install path.

Verification

This release line is gated by:

  • Ubuntu and Windows full test/race coverage required by branch protection.
  • Native Linux arm64 and macOS arm64 CI.
  • CodeQL and repository security scans.
  • Live MIT Kerberos KDC integration including non-skipping TestKerberosIntegrationSPNEGOToken.
  • Native Windows SSPI roundtrip and handle-soak verification in the release workflow.
  • Artifact-first GoReleaser staging and execution of the exact candidate archives before immutable promotion.
  • SBOMs, checksums, and GitHub artifact attestations.
Assets 16
Loading