NFT Firewall V2 2.1.0 (validation pending)

NFT Firewall V2 2.1.0 adds managed setup from one WireGuard profile for supported clean Debian 13 hosts, VPN-only IPv4 egress, managed Docker bridge routing, preserved private-LAN administration, and boot recovery.

Prerelease: stable runtime validation is incomplete. Use 2.0.3 for the stable advanced-mode workflow.

The four original downloads pass SHA-256 verification, archive manifest checks, and package identity checks. Download NFTFW-2.1.0-SHA256SUMS alongside the files and run:

sha256sum -c --ignore-missing NFTFW-2.1.0-SHA256SUMS

Hosted CI passed source and CI-package checks; the privileged R2 job was skipped. The attestation consumed by the release build contains all-zero references to its required candidate-comparison and privileged-evidence records. Complete R2, post-tag validation, and final approval have not been verified.

The archives also bind annotated tag object 5f4e1333aeedd0dab9286f29a54faec531fd835d, while the published tag is 674478be474ddb6067e405554f4c795f95a1f8e7. Both point to source commit 3851db45ed7e2f0c2935d20b6034595a6fc05bb0; the tag annotations differ in timestamp. Original downloads and the published tag are retained unchanged.

See the attached PUBLICATION_AUDIT.md for the verified results and remaining requirements. Checksums establish download integrity, not stable release acceptance. The packages are runtime-capable validation builds; do not use them as approved production releases.

NFT Firewall V2 2.0.3

NFT Firewall V2 2.0.3 is the accepted provenance, boot-safety, package, and
dashboard status-contract release.

Validated source:
e2b3fa0a20fa6e36325792397564966b21045120

Before installation, read the default branch's docs/HOST-HANDOFF.md and run
the read-only scripts/host-preflight.sh. Installation is inert: it does not
create or start a VPN, activate NFTFW services, or apply a firewall policy.

Use the Debian package matching the target architecture and verify it with
NFTFW-2.0.3-SHA256SUMS. Candidate, CI, and development artifacts are
intentionally non-installable.

The release includes:

• amd64 and arm64 Debian packages;
• static nftfw, nftfwd, and nftfw-web binaries for amd64 and arm64; and
• a SHA-256 manifest covering every uploaded binary and package.

Checksums provide integrity. This release does not currently include a
cryptographic publisher signature.