WolfProxy v0.4.7

v0.4.7: parse CLI args — --version/--test/--help no longer start a server

WolfProxy's main() did no argument parsing, so wolfproxy --version
(WolfStack's install detection) and wolfproxy --test (WolfStack's config
validation) fell straight through to the normal server start and bound
:80/:443. Run while the systemd instance was down, the probe bound :80 and
left an orphaned listener OUTSIDE systemd's cgroup — systemctl can't reap what
it never tracked, so the next systemctl start failed with "Address in use"
and the proxy could neither restart nor apply rules (klasSponsor's hemulen
node, 2026-06-05: ss showed a stray wolfproxy pid on :80 while the unit was
inactive/dead).

Now parse argv before the banner and before binding anything:
--version/-V print version, exit 0
--help/-h usage, exit 0
--test/-t validate wolfproxy.toml + nginx sites, exit 0/1; never binds
--config/-c config path (default ./wolfproxy.toml — unchanged under systemd,
which sets WorkingDirectory=/opt/wolfproxy)

run_config_test() loads config exactly as the serve path does, without binding.
The no-arg systemd start is byte-for-byte unchanged. Runtime-verified:
--version=0, --test valid=0, --test missing=1, --bogus=2, and none leaves a
listener on :80. Build clean, zero warnings.

---

Verifying this release

Each binary is signed via cosign keyless OIDC and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfproxy-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/wolfproxy/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfproxy-x86_64

Verify the build provenance:

gh attestation verify wolfproxy-x86_64 --repo wolfsoftwaresystemsltd/wolfproxy

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfproxy-x86_64 / wolfproxy-aarch64 — static musl binaries (Linux x86_64 and ARM64).
• wolfproxy-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.