RouteSphere BonVoyage API Gateway 1.0.4

RouteSphere BonVoyage API Gateway 1.0.4

BonVoyage 1.0.4 is the checksum-bound public release of the self-hosted
BonVoyage API Gateway. It combines an Apache-2.0 Gateway with the optional
no-cost, proprietary BonVoyage Console.

Release assets

• bonvoyage-gateway_1.0.4-1_amd64.deb: Gateway package for Ubuntu 24.04 AMD64.
• bonvoyage-gateway-1.0.4-linux-amd64.oci.tar: portable Linux AMD64 OCI image archive.
• bonvoyage-console_1.0.4-1_amd64.deb: optional Console package for Ubuntu 24.04 AMD64.
• SHA256SUMS: checksums for every downloadable release asset.
• Gateway Sigstore bundles, CycloneDX and SPDX SBOMs, provenance, and the checksum-bound technical release evidence archive.
• A separate Console evidence archive containing its SBOMs, OpenVEX disposition, candidate identity, vulnerability review and bounded qualification summary.

What is included

• HTTP/1.1, downstream TLS, HTTP/2, unary gRPC, WebSocket and bounded SSE paths.
• Virtual-host and route matching, weighted upstreams, health checks, retries, timeouts and circuit-breaking controls.
• API-key, HMAC and JWT policies, rate limiting, header transformation, CORS and request-size controls.
• Immutable snapshot activation with explicit ACK/NACK state, rollback and node reconciliation.
• Metrics, structured operational events and release-matched public documentation.
• Optional Console workflows for configuration, validation, preview, activation, rollback, node state and audit visibility.

Verification

The Gateway Debian package and OCI archive were reproduced in two isolated hosted builders, checksum-compared, dual-SBOM validated, vulnerability reviewed, provenance-bound, keyless signed and independently verified. Their install, upgrade, rollback, reactivation, shutdown and removal paths were replayed against the exact release bytes.

The Console package is built from the separate private Console source and distributed as a proprietary no-cost binary. Its release evidence includes an exact checksum, candidate identity, SBOM, vulnerability review and bounded lifecycle replay. The Console is not Apache-2.0 source and is not covered by the Gateway's keyless signature claim.

Exact release identities:

• Source tag: v1.0.4
• Source commit: 9c252fcc583641341b44ba5ca8b7434a6ff0a165
• Gateway Debian SHA-256: dd6f3f96af391c312e80576c53351f9be0e72950e07cc80b425989865464b6cd
• Gateway OCI SHA-256: 94e1ddddcf37ef4677e6021b56b4de27730d2366e50e4fd5cbda25256ca24d39
• Console Debian SHA-256: a979c4f37349d0a456dcba31c674e5c5131e7525108912e690968b1d8421ef3b
• Gateway technical manifest SHA-256: f1976d21f8c6f9762c032856bbc7106965f8e2aaa5da8ae86432de33d03b4239

Supported release boundary

• Initial artifacts target Linux AMD64 and Ubuntu 24.04.
• The Console is optional; the Gateway can be operated from release-matched YAML and documented command-line procedures.
• Public management-API documentation and third-party automation contracts are not included in the OSS release.
• GitHub issue intake does not include a human-response or incident-response SLA.
• Published benchmark evidence is environment- and workload-specific. This release does not claim universal superiority, dedicated-hardware capacity or a performance result for an untested deployment.

Start with the installation and verification guide and report reproducible defects through GitHub Issues.

RouteSphere BonVoyage API Gateway v1.0.0

RouteSphere BonVoyage API Gateway 1.0.0

BonVoyage 1.0.0 is the first public release of the self-hosted BonVoyage API
Gateway. It combines an Apache-2.0 Gateway with the optional no-cost,
proprietary BonVoyage Console.

Release assets

• bonvoyage-gateway_1.0.0-1_amd64.deb: Gateway package for Ubuntu 24.04
  AMD64.
• bonvoyage-gateway-1.0.0-linux-amd64.oci.tar: portable Linux AMD64 OCI
  image archive.
• bonvoyage-console_1.0.0-1_amd64.deb: optional Console package for Ubuntu
  24.04 AMD64.
• SHA256SUMS: checksums for every downloadable release asset.
• Gateway Sigstore bundles, CycloneDX and SPDX SBOMs, provenance, and the
  checksum-bound technical release evidence archive.
• A separate Console evidence archive containing its SBOMs, OpenVEX
  disposition, candidate identity, vulnerability review and bounded
  qualification summary.

What is included

• HTTP/1.1, downstream TLS, HTTP/2, unary gRPC, WebSocket and bounded SSE
  paths.
• Virtual-host and route matching, weighted upstreams, health checks, retries,
  timeouts and circuit-breaking controls.
• API-key, HMAC and JWT policies, rate limiting, header transformation, CORS
  and request-size controls.
• Immutable snapshot activation with explicit ACK/NACK state, rollback and
  node reconciliation.
• Metrics, structured operational events and release-matched public
  documentation.
• Optional Console workflows for configuration, validation, preview,
  activation, rollback, node state and audit visibility.

Verification

The Gateway Debian package and OCI archive were reproduced in two isolated
hosted builders, checksum-compared, dual-SBOM validated, vulnerability
reviewed, provenance-bound, keyless signed and independently verified. Their
install, upgrade, rollback, reactivation, shutdown and removal paths were also
replayed against the exact release bytes.

The Console package is built from the separate private Console source and is
distributed as a proprietary no-cost binary. Its release evidence includes an
exact checksum, candidate identity, SBOM, vulnerability review and bounded
lifecycle replay. The Console is not Apache-2.0 source and is not covered by
the Gateway's keyless signature claim.

Exact release identities:

• Source tag: v1.0.0
• Source commit: 03f5c5a355a645d17621b8743b6dfcefd4953c02
• Gateway Debian SHA-256:
  56857733ae73640721d83e19ee11d0ef8a1f9e5fc515d93d926e90cdc3ed5e16
• Gateway OCI SHA-256:
  eaadd14b4a9a25625e8d514d6b273350e97358635f2ad803cfb7b9dd9e153edb
• Console Debian SHA-256:
  9060f1d53266ede7dc2018db141cd586d649480fedef55970fda8665884b2252
• Gateway technical manifest SHA-256:
  19ba78cc81bf0e0a8e24614234f9a4131981cc4bcef94f517dff74ae04e7473a

Supported release boundary

• Initial artifacts target Linux AMD64 and Ubuntu 24.04.
• The Console is optional; the Gateway can be operated from release-matched
  YAML and documented command-line procedures.
• Public management-API documentation and third-party automation contracts
  are not included in the OSS release.
• GitHub issue intake does not include a human-response or incident-response
  SLA.
• Published benchmark evidence is environment- and workload-specific. This
  release does not claim universal superiority, dedicated-hardware capacity or
  a performance result for an untested deployment.

Start with the installation and verification guide
and report reproducible defects through GitHub Issues.