FluxGate v0.4.0
FluxGate 0.4 introduces the trust and compatibility foundation for future
adaptive clients: signed server metadata, secure client bootstrap bundles,
and the first Pathfinder compatibility layer.
Highlights
- Independent Ed25519 FluxGate server signing identity
- Stable opaque server identity
- Exact-byte signed capability manifests
- Explicit public-key pinning model
- Signed client bootstrap bundles
- Per-artifact SHA-256 integrity verification
- Exact bootstrap/manifest generation binding
- WireGuard, OpenVPN and sing-box artifacts in one verified bundle
- Deterministic cross-platform-safe artifact identities
- Typed Pathfinder connection candidates
- Typed client capability descriptions
- System-tunnel vs local-proxy capability distinction
- Deterministic candidate compatibility evaluation
- Human-readable incompatibility reasons
Security hardening
- Pinned trust rejects replacement signing identities
- Mixed valid manifest/bootstrap generations are rejected
- Transactional bundle publication has an explicit durable commit boundary
- Post-commit stale-backup cleanup cannot roll back the valid new bundle
- Client bootstrap credentials remain isolated per client
- Unsafe symlink, hard-link and writable-ancestor paths fail closed
- Enabled connection candidates require usable endpoints
- Corrupt initialized signing identities degrade server status
Supported cores
- WireGuard
- OpenVPN
- sing-box
Supported sing-box profiles
- VLESS / TCP / TLS
- Trojan / TCP / TLS
- Hysteria2 / QUIC / TLS
Pathfinder in v0.4
Pathfinder currently performs offline compatibility evaluation only.
It does not yet perform:
- active network probing
- latency or packet-loss measurement
- scoring or ranking
- automatic transport selection
- automatic failover
- censorship detection
Trust model
Initial trust is explicitly established by the administrator through a
trusted bootstrap containing the FluxGate public signing identity.
Future signed metadata can then be verified against that pinned identity.
Signing provides authenticity and integrity, not confidentiality.
Bootstrap bundles contain client credentials and must be transferred and
stored securely.
The bootstrap/manifest digest binding ensures generation consistency inside
a bundle; complete signed-document replay prevention is not yet implemented.
Validation
The v0.4 candidate was validated with:
- Python 3.10–3.14 CI
- real Ed25519 signing/verification
- signed-manifest tamper tests
- pinned trust replacement tests
- mixed-generation bundle rejection
- provider artifact tamper detection
- multi-provider bootstrap tests
- cross-client credential-isolation tests
- publication failure-injection tests
- Unicode/case-insensitive filesystem safety
- Ubuntu 24.04 focused validation
- macOS offline verification
- checksum-verified sing-box 1.13.19 parser validation
- existing WireGuard/OpenVPN/sing-box regression coverage
Deferred
Future releases may add:
- active Pathfinder probing
- reachability/latency/loss observations
- scoring and ranking
- automatic transport selection/failover
- remote signed-manifest delivery
- remote enrollment
- anti-replay/freshness policy
- signing-key rotation
- Xray-core
- additional transports
- client applications
FluxGate remains an early-stage networking project. Review SECURITY.md and
the testing documentation before deployment.