Skip to content

v0.23.16

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 19:37
· 45 commits to main since this release
v0.23.16
67678bf

What's Changed

Fixed

  • Embedded RDP to a Linux server that offers only Standard RDP Security no longer dies silently — it falls back to the external FreeRDP client (issue #366) — a server such as xrdp with its default security_layer=negotiate down-selects the connection to Standard RDP Security (RC4) after the embedded IronRDP client advertised SSL/HYBRID/HYBRID_EX. ironrdp-connector 0.10 rejects that with "client advertised SSL | HYBRID | HYBRID_EX, but server selected STANDARD_RDP_SECURITY". The failure classifier matched the prose spelling "standard rdp security" (from the #235 negotiation error) but not STANDARD_RDP_SECURITY — the SecurityProtocol enum-variant name ironrdp-connector prints verbatim, which lowercases to standard_rdp_security with underscores, not spaces. The message therefore fell through to RdpFailureClass::Other, which warrants no fallback, so the session was stranded with no handover even though external FreeRDP speaks the RC4 standard security IronRDP does not implement. The underscore spelling is added to SECURITY_MARKERS, so the case now classifies as SecurityUnsupported and hands the session to the external client exactly like the #235 prose form. Confirmed live against xrdp 0.9.24 on Ubuntu 24.04: the classification moved from Other (silent death) to SecurityUnsupported (external FreeRDP launched). A regression test pins the verbatim connector-0.10 string. (rustconn-core/src/rdp_client/failure.rs)
  • A wrong password to an NLA-only RDP server now says so, instead of reporting a raw exit status: 161 (issue #366) — the #366 TLS-only fallback hands the session to external FreeRDP pinned to /sec:tls when the embedded client's CredSSP is rejected with STATUS_LOGON_FAILURE (0xc000006d), on the hunch that the server is a KRdp/FreeRDP-3.32 box advertising HYBRID_EX it cannot complete. But that status is byte-for-byte identical to a genuinely wrong password, so against a server that legitimately requires NLA the /sec:tls retry is refused with ERRCONNECT_HYBRID_REQUIRED_BY_SERVER ("The server requires Network Level Authentication, but it is not enabled"). classify_client_output had no branch for that code and fell through to the generic "RDP connection failed (exit status: 161)", which told the user nothing. A HYBRID_REQUIRED_BY_SERVER branch now reports that the server requires NLA and the credentials are likely wrong — the actionable truth, since reaching this point means the 0xc000006d really was a credential failure rather than the HYBRID_EX regression. Confirmed live against a FreeRDP 3.32.1 NLA server. A regression test pins the verbatim external-client output. (rustconn/src/embedded_rdp/connection.rs)

Removed

  • Removed 59 stale editor backup files from the source tree — numbered backup snapshots (automation.rs.bak2….bak42, terminal/osc52.rs.bak18….bak67, terminal/detach.rs.bak9….bak37, window/group_broadcast.rs.bak27….bak40, external_session.rs.bak*, utils.rs.bak*, dialogs/tunnel.rs.bak26, dialogs/widgets.rs.bak15….bak17, window/detach_actions.rs.bak29) were still tracked. The 0.23.15 cleanup removed only the embedded_rdp/embedded_vnc batch and recorded that .gitignore would stop new ones — but the *.bak pattern does not match the numbered suffixes editors actually produce (git check-ignore confirms foo.rs.bak30 was not ignored). The files are deleted and the ignore pattern is widened to *.bak*, so numbered backups are now both untracked and ignored. (.gitignore)

Dependencies

  • Updated: cc 1.8.0 → 1.9.0, find-msvc-tools 0.1.14 → 0.1.15, inout 0.2.4 → 0.2.5, ppmd-rust 1.5.0 → 1.5.1, zip 9.0.4 → 9.0.5. All semver-compatible patch/minor bumps (zip is the one direct dependency, used by the archive import/export path; the rest are build-time or transitive). No security advisories affected (cargo deny check advisories clean). CLI download versions all current (TigerVNC pinned at 1.16.2, confirmed latest upstream; kubectl/Tailscale/Teleport/Boundary/Hoop.dev/Bitwarden/1Password auto-resolve and were reachable); the RustCrypto release-candidate family and the out-of-range majors remain held back, pinned transitively by the sspi/picky-krb stack exactly as in 0.23.1–0.23.15.
  • Flatpak/Flathub: FreeRDP 3.32.1 → 3.32.2 — a FreeRDP upstream security and bugfix release that hardens the code base against malicious client/server messages (a large batch of CVE/GHSA advisories), plus [server,ntlm] fix missing UNICODE flag that causes authentication to fail. The bundled source module and its sha256 are updated in all three manifests (local, Flathub, and the .local dev manifest). The rest of the Flatpak stack is confirmed current and unchanged: GNOME runtime 51 (GNOME 52 is not due until spring 2027), cJSON 1.7.19 (latest), OpenH264 2.6.0 (latest). The Snap stays on core24 + the gnome-46-2404 extension — the core26 GNOME extension still does not exist (issue #174).

Installation

Flatpak (Recommended)

flatpak install flathub io.github.totoshko88.RustConn

Snap

sudo snap install rustconn

Debian/Ubuntu (.deb from this release)

sudo dpkg -i rustconn_0.23.16_amd64.deb
sudo apt-get install -f  # Install dependencies if needed

Fedora (.rpm from this release)

sudo dnf install rustconn-0.23.16-1.fc44.x86_64.rpm

AppImage

chmod +x RustConn-0.23.16-x86_64.AppImage
./RustConn-0.23.16-x86_64.AppImage

macOS (Homebrew)

brew tap totoshko88/rustconn
brew install rustconn
open $(brew --prefix)/opt/rustconn/RustConn.app

All dependencies (GTK4, libadwaita, VTE, Adwaita icons) are installed automatically.
Requires macOS 13 (Ventura) or later.

OBS Repositories

Packages available at: https://build.opensuse.org/package/show/home:totoshko88:rustconn/rustconn

# Debian 13 (Trixie)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 24.04 LTS (Noble)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 26.04 LTS (Resolute)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Fedora 44
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_44/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# Fedora 43
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_43/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# openSUSE Tumbleweed
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Tumbleweed/ rustconn
sudo zypper ref && sudo zypper in rustconn

# openSUSE Leap 16.0
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Leap_16.0/ rustconn
sudo zypper ref && sudo zypper in rustconn

Arch Linux (AUR)

yay -S rustconn

FreeBSD (Ports)

pkg install rustconn

Full installation guide: https://github.com/totoshko88/RustConn/blob/main/docs/INSTALL.md

Verifying your download

Every binary on this release (deb, rpm, AppImage, Flatpak) is covered two ways.

Plain checksums — download SHA256SUMS alongside the asset, then:

sha256sum -c SHA256SUMS

Signed build provenance (SLSA, via Sigstore) — proves the file was built by this
workflow from this commit:

gh attestation verify RustConn-0.23.16-x86_64.AppImage --repo totoshko88/RustConn

(The snap is signed by the Snap Store; the macOS build is delivered via the Homebrew tap.)

Assets 10
Loading