Skip to content

v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Sep 00:37
· 79 commits to main since this release
v0.7.0
38c4262
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

pxgo v0.7.0

This release brings PxGo in line with the applicable behavior changes from upstream Px v0.12.0 and hardens the release/distribution path introduced in v0.6.0.

Highlights

  • PAC encoding now auto-detects by default. HTTP Content-Type charset is honored first, UTF-8/UTF-16/UTF-32 BOMs are recognized, valid UTF-8 is accepted, then legacy Windows-1252/Windows-1251/Latin-1 fallbacks are tried. Explicit --pac-encoding still overrides detection.
  • Unix file-descriptor capacity is raised at startup. Linux and macOS best-effort raise the RLIMIT_NOFILE soft limit toward min(hard, 65536), with conservative fallbacks when the requested limit is rejected.
  • Real syscall coverage exists on Linux and macOS. Native CI lowers the child soft limit and proves PxGo raises it again using the platform getrlimit/setrlimit path.
  • The official Scoop bucket is live. Stable releases publish the exact staged pxgo-scoop.json into khanhkit/scoop-bucket after immutable release promotion.
  • Release provenance is stronger. Generated Scoop manifests join the release checksum/provenance set, release-contract checks now run on normal PR CI, and Homebrew checksum selection is exact-filename matched.
  • Guardian confidence improved. Native macOS CI now exercises crash/recycle/hang/forced-stop/orphan-cleanup lifecycle behavior.
  • Linux keyring diagnostics are clearer. Password-store failures preserve the underlying Secret Service/D-Bus error and point to the explicit plaintext fallback; optional startup lookup remains best-effort.

Installation

Homebrew

brew tap khanhkit/tap
brew install pxgo

Scoop

scoop bucket add khanhkit https://github.com/khanhkit/scoop-bucket
scoop install khanhkit/pxgo

A bucket-independent Scoop manifest is also attached to the GitHub Release as pxgo-scoop.json.

Direct archives

Release archives are published for:

  • Linux amd64 / arm64
  • macOS amd64 / arm64
  • Windows amd64 / arm64

Verify downloads against checksums.txt and the GitHub artifact attestations.

PAC compatibility

The default pac_encoding is now auto, matching current upstream Px behavior. For HTTP PAC sources, an explicit response charset wins. Local/remote PAC source decoding otherwise follows BOM and validity detection before legacy single-byte fallbacks.

To force an encoding, continue using for example:

pxgo --pac=/path/to/proxy.pac --pac-encoding=utf-8

Unix capacity behavior

On Linux and macOS, Guardian startup attempts to raise the process file-descriptor soft limit without exceeding the hard limit. Failure is non-fatal; PxGo remains startable under restricted environments. Windows behavior is unchanged.

Credential storage on Linux

PxGo uses the Secret Service D-Bus interface for the OS keyring. Headless Linux requires a working session D-Bus and Secret Service provider. If one is unavailable, password-store operations now surface the backend cause. PXGO_KEYRING_PLAINTEXT=1 remains the explicit fallback for environments such as Docker/CI.

Verification

The release path is gated by:

  • required Ubuntu and Windows race/full-test jobs;
  • native Linux arm64 and macOS arm64 execution;
  • live MIT Kerberos KDC/SPNEGO integration;
  • native Windows SSPI verification in the release workflow;
  • artifact-first GoReleaser staging and native candidate execution;
  • checksums, SBOMs, artifact attestations, and fail-closed immutable promotion proof;
  • PR-time release/artifact contract validation.

The KhanhKit.PxGo WinGet submission remains externally pending Microsoft CLA/moderator completion and is not advertised as published by this release.

Assets 16
Loading