dev-latest (1.1.0, 5c2315a307b0)

conflux 1.1.0, built from 5c2315a307b0d9d0e3bf49659f1db4a10335bb35 on dev, with anchor's newest dev build, dev-latest, embedded.

A dev build: the pre-release at dev-latest, which the next merge into dev replaces. A release is latest.

Changes since 1.0.0

Maintenance: sync with anchor b0a903e5, audit fixes, stamped service logs, VERSION 1.1.0 (#33)

The maintenance pass on dev. It syncs conflux with anchor's dev at b0a903e5, rebuilds the embedded pair from that commit under the dev pin, fixes what the audit found, adds the four changes the owner chose, and moves VERSION to 1.1.0. One commit per area; each says what it fixes and why.

conflux cert ca and p12: a managed CA, and PKCS#12 in the profile FIPS 140-3 approves (#32)

The last two parts of the PQC certificate suite, in one PR as you asked: 1. e673ddf, conflux cert ca: a certificate authority kept in a directory. 2. 0d3e260, conflux cert p12: PKCS#12 bundles in the one profile every part of which FIPS 140-3 approves.

conflux cert probe and serve: what a handshake negotiates, post-quantum or not (#31)

The second part of the PQC certificate suite. It adds a FIPS 140-3 mode TLS client and server, in the spirit of openssl s_client and s_server. Each says, in the observer's words (pqc, hybrid, classical), what a handshake's key exchange and authentication were.

conflux cert: post-quantum keys, certificates and revocation lists, in FIPS 140-3 mode (#30)

The first part of the PQC certificate suite you asked for: an OpenSSL-like toolkit for keys, requests, certificates and revocation lists. It is ML-DSA-87 by default, and every algorithm it uses comes from the Go Cryptographic Module in FIPS 140-3 mode. Three more PRs complete the suite: probe and serve next, then the managed CA, then PKCS#12.

up and proxy --ephemeral: an anchor that keeps nothing (#29)

This is the ephemeral mode you asked for. The credential is never written anywhere, it goes straight to anchord, and when anchord stops, however it stops, everything is gone. It is the third step of the ephemeral-mode and PQC-certificate work, after the FIPS build (#27) and renewal over stdin (#28).

Renewals reach anchorctl on stdin, and leave no file behind (#28)

Second step of the ephemeral-mode and PQC-certificate work. A hot renewal no longer writes the renewed chain to a file. It needs anchor's anchorctl renew -cred - (veil-net/anchor#72), which is merged and in anchor's dev-latest (built from 29aa24b).

conflux runs in FIPS 140-3 mode, against the Go Cryptographic Module v1.26.0 (#27)

This is the first step of the ephemeral-mode and PQC-certificate work. conflux is now built the way anchor builds its own programs: against a frozen Go Cryptographic Module, running in FIPS 140-3 mode. The certificate suite still to come relies on this.

The anchor names its own interface; the observer's overlay in the docs; CI enrols a dev build at api-dev (#26)

This finishes the conflux side of anchor #68 (the Observer merge) and #71 (a dev build pinned to its own realm). It is three changes, one commit each, plus the maintenance skill.

Observer mode; work goes through dev, built with anchor's dev-latest (#25)

Two changes, and a Go bump.

Full diff: 1.0.0...5c2315a

Install

curl -fsSL https://raw.githubusercontent.com/veil-net/conflux/HEAD/install.sh | CONFLUX_VERSION=dev-latest sh

On Windows, in PowerShell as Administrator:

$env:CONFLUX_VERSION = 'dev-latest'; irm https://raw.githubusercontent.com/veil-net/conflux/HEAD/install.ps1 | iex

Then sudo conflux up --api https://api-dev.veilnet.com.au: this build's anchor is pinned to the dev tree, which only api-dev enrols in.
A newer dev build is installed by running the installer again: conflux update reads latest, the release, pinned to the production tree, and asks for --yes first.

What is inside

Each binary carries the anchor pair for its own platform. Verify what you have with conflux version:

conflux 1.1.0 (5c2315a307b0d9d0e3bf49659f1db4a10335bb35) linux/amd64
dev build: anchor's dev-latest, pinned to the dev tree
fips140 on, Go Cryptographic Module v1.26.0
anchor set 40d083e142116646
  anchord    ec5765b2fd84f38edaff56bfabb1e1e61a835349d29c4dd194b5b356ec0351cc
  anchorctl  ed963b404b898baf4d69dc0756b2e54ffe94af5856d278f08efc4a6f332acb78

Windows TUN mode additionally needs wintun.dll, which conflux downloads and verifies when it is first needed:
Version = "0.14.1"
ZipSHA256 = "07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51"