FluxGate v0.4.0

FluxGate v0.4.0

FluxGate 0.4 introduces the trust and compatibility foundation for future
adaptive clients: signed server metadata, secure client bootstrap bundles,
and the first Pathfinder compatibility layer.

Highlights

• Independent Ed25519 FluxGate server signing identity
• Stable opaque server identity
• Exact-byte signed capability manifests
• Explicit public-key pinning model
• Signed client bootstrap bundles
• Per-artifact SHA-256 integrity verification
• Exact bootstrap/manifest generation binding
• WireGuard, OpenVPN and sing-box artifacts in one verified bundle
• Deterministic cross-platform-safe artifact identities
• Typed Pathfinder connection candidates
• Typed client capability descriptions
• System-tunnel vs local-proxy capability distinction
• Deterministic candidate compatibility evaluation
• Human-readable incompatibility reasons

Security hardening

• Pinned trust rejects replacement signing identities
• Mixed valid manifest/bootstrap generations are rejected
• Transactional bundle publication has an explicit durable commit boundary
• Post-commit stale-backup cleanup cannot roll back the valid new bundle
• Client bootstrap credentials remain isolated per client
• Unsafe symlink, hard-link and writable-ancestor paths fail closed
• Enabled connection candidates require usable endpoints
• Corrupt initialized signing identities degrade server status

Supported cores

• WireGuard
• OpenVPN
• sing-box

Supported sing-box profiles

• VLESS / TCP / TLS
• Trojan / TCP / TLS
• Hysteria2 / QUIC / TLS

Pathfinder in v0.4

Pathfinder currently performs offline compatibility evaluation only.

It does not yet perform:

• active network probing
• latency or packet-loss measurement
• scoring or ranking
• automatic transport selection
• automatic failover
• censorship detection

Trust model

Initial trust is explicitly established by the administrator through a
trusted bootstrap containing the FluxGate public signing identity.

Future signed metadata can then be verified against that pinned identity.

Signing provides authenticity and integrity, not confidentiality.
Bootstrap bundles contain client credentials and must be transferred and
stored securely.

The bootstrap/manifest digest binding ensures generation consistency inside
a bundle; complete signed-document replay prevention is not yet implemented.

Validation

The v0.4 candidate was validated with:

• Python 3.10–3.14 CI
• real Ed25519 signing/verification
• signed-manifest tamper tests
• pinned trust replacement tests
• mixed-generation bundle rejection
• provider artifact tamper detection
• multi-provider bootstrap tests
• cross-client credential-isolation tests
• publication failure-injection tests
• Unicode/case-insensitive filesystem safety
• Ubuntu 24.04 focused validation
• macOS offline verification
• checksum-verified sing-box 1.13.19 parser validation
• existing WireGuard/OpenVPN/sing-box regression coverage

Deferred

Future releases may add:

• active Pathfinder probing
• reachability/latency/loss observations
• scoring and ranking
• automatic transport selection/failover
• remote signed-manifest delivery
• remote enrollment
• anti-replay/freshness policy
• signing-key rotation
• Xray-core
• additional transports
• client applications

FluxGate remains an early-stage networking project. Review SECURITY.md and
the testing documentation before deployment.

FluxGate v0.3.0

FluxGate v0.3.0

FluxGate 0.3 introduces the protocol/profile layer and the first production proxy core alongside
WireGuard and OpenVPN.

Highlights

• Production sing-box provider
• Typed Core / Protocol / Transport / Security / Profile architecture
• VLESS over TCP + TLS
• Trojan over TCP + TLS
• Hysteria2 over QUIC + TLS
• Managed TLS identities with strict certificate verification
• Profile-scoped client credentials
• Provider/profile-selective revocation
• Unified WireGuard, OpenVPN and sing-box exports
• Secret-free capability manifest
• Verified sing-box binary acquisition
• TCP/UDP and IPv4/IPv6 collision protection
• WireGuard + OpenVPN + sing-box coexistence
• Stronger path, migration, TLS and service convergence hardening

Validation

The release candidate was validated with:

• 150+ unit/regression tests
• Checksum-verified upstream sing-box parser validation
• Python 3.10–3.14 CI
• Ubuntu 24.04 privileged lifecycle validation
• WireGuard/OpenVPN/sing-box coexistence
• Real macOS VLESS/TCP/TLS connection
• Real macOS Trojan/TCP/TLS connection
• Real macOS Hysteria2/QUIC/TLS connection
• IPv4 egress and remote DNS
• Selective credential revocation
• Service restart recovery
• VPS reboot persistence
• Linux/OpenSSL managed TLS identity verification

Supported

Core providers:

• WireGuard
• OpenVPN
• sing-box

sing-box profiles:

• VLESS / TCP / TLS
• Trojan / TCP / TLS
• Hysteria2 / QUIC / TLS

Planned

• Xray-core
• TUIC
• WebSocket
• HTTP/2
• gRPC
• Reality
• Pathfinder / adaptive profile selection
• Web UI and additional integrations

FluxGate remains an early-stage networking project. Review the security and testing documentation
before deployment.

FluxGate v0.2.0

FluxGate v0.2.0

FluxGate 0.2 introduces the second production connectivity provider and proves the multi-provider control-plane architecture.

Highlights

• Production OpenVPN provider
• WireGuard + OpenVPN coexistence
• Unified provider-independent client identities
• Provider-selective provisioning and revocation
• Unified client exports
• Standalone OpenVPN profiles
• OpenVPN PKI, CRL and tls-crypt management
• Shared forwarding ownership
• Independently managed provider NAT rules
• Stronger transactional rollback and crash recovery
• Expanded doctor/status diagnostics
• 0.1 state compatibility

Validation

The release candidate was validated through:

• 113 regression tests
• Python 3.10–3.14 CI
• real Ubuntu 24.04 privileged lifecycle
• simultaneous WireGuard/OpenVPN operation
• service restart recovery
• VPS reboot persistence
• real macOS WireGuard and OpenVPN clients
• IPv4 Internet egress
• DNS
• OpenVPN certificate revocation enforcement
• cleanup and ownership-safety tests

Provider status

Supported:

• WireGuard
• OpenVPN

Planned:

• sing-box
• Xray-core
• AmneziaWG

FluxGate remains an early-stage project. Review the security and testing documentation before deployment.

FluxGate v0.1.1

FluxGate v0.1.1

FluxGate v0.1.1 is a patch release that makes the strict mypy check portable on Python 3.10 when
the conditional tomli dependency is installed. It contains no runtime behavior changes and adds
no features.

The release preserves the production-validated WireGuard functionality from v0.1.0. Its
tag-triggered CI matrix passes on Python 3.10 through Python 3.14.

Provider status

Supported:

• WireGuard

Planned and not included:

• OpenVPN
• sing-box
• Xray-core
• AmneziaWG

FluxGate remains an early-stage project. Review SECURITY.md and the documentation before
deployment.

FluxGate v0.1.0

FluxGate v0.1.0

FluxGate's first public release establishes the core architecture and ships production-tested
WireGuard management.

Highlights

• Modular provider architecture
• WireGuard provider
• Unified FluxGate client identities
• Safe client creation, export, revocation, and deletion
• Idempotent provider lifecycle
• Dry-run and rollback-aware operations
• FluxGate-owned nftables integration
• systemd persistence
• Strict typed configuration and versioned state
• Structured doctor and status diagnostics
• Guarded Ubuntu/Debian installer
• Python 3.10+ support
• CI, strict typing, and regression tests

Validation

WireGuard was validated on a real Ubuntu 24.04 VPS and with a real macOS client, including:

• Successful handshake
• Full-tunnel IPv4 Internet access
• DNS resolution
• Live server peer counters
• Service restart and reconnect
• Revoke enforcement
• Reboot persistence
• Ownership-safe cleanup

Current provider status

Supported:

• WireGuard

Planned:

• OpenVPN
• sing-box
• Xray-core
• AmneziaWG

FluxGate remains an early-stage project. Review SECURITY.md and the documentation before
deployment.