chore: retarget upstream portal-tunnel v2.5.0 #96

Merged

gofix merged 1 commit from codex/release-v2.5.0-20260920T152700Z-v2.5.0 into master 2026-09-20 18:41:34 +00:00

Conversation 1 Commits 1 Files changed 25 +585 -577

gofix commented 2026-09-20 18:35:52 +00:00

Owner

• Copy link
• Copy Markdown

Summary

• retarget the Rust relay compatibility baseline to upstream gosuda/portal-tunnel v2.5.0 (0a1270f23904e047bb3443422aa2edf06db6e294)
• implement protocol-10 TLS reverse bindings and authenticated, lease-bound, single-use TLS 1.3 transcript signing
• advertise the v2.5.0 release while retaining protocol-9 discovery and the documented scoped legacy paths
• retarget official-client, API-shape, IVNP capability, and deterministic Axis-B fixtures
• document unsupported reputation/peer-release-map behavior and the supported keyless algorithms

Compatibility boundary

Full current-client interoperability is v2.5.0. Older v2.4.x protocol-9 clients are intentionally outside the full end-to-end window after the upstream protocol-10 bump; the documented v2.3.8 direct-token/protocol-8 extension remains scoped and tested.

Verification

• cargo test --locked (195 passed, 3 ignored on macOS)
• cargo clippy --locked --all-targets -- -D warnings
• cargo fmt --all -- --check
• containerized native Linux CI driver (199 passed, 5 ignored)
• official v2.5.0 ARM64 HTTP/keyless, lifecycle, TCP, UDP, API-shape, lease-JWT, and IVNP capability checks
• deterministic native ARM64 Axis B candidate/control gate with independent signed meshes, exact Rust middle markers, nonce responses, semantic runtime parity, and cleanup proof

Release trail (v2.5.0)

• Dev tag: v2.5.0+rs.1-dev.1 at merged commit 45ff7746eeb0031639e0710add5009e7f129d4a8.
• ARM64 image: v2.5.0-rs.1-dev.1, digest sha256:6dff07787a873397258fb796fbff1f476caf83463946d393c17699b57804c92c; tag workflow 1057 succeeded.
• Live Axis A and the official-client rollout passed. The canonical Axis B helper stopped before a middle-hop request because upstream v2.5.0 removed its --multi-hop flag; the retained logs prove the Rust middle was not exercised.
• The dev deployment and client rollout were rolled back successfully. Dev counter 1 is consumed; any next live attempt must use v2.5.0+rs.1-dev.2 or later.
• No production tag, production image, Forgejo release, or production promotion was created.

## Summary - retarget the Rust relay compatibility baseline to upstream `gosuda/portal-tunnel v2.5.0` (`0a1270f23904e047bb3443422aa2edf06db6e294`) - implement protocol-10 TLS reverse bindings and authenticated, lease-bound, single-use TLS 1.3 transcript signing - advertise the v2.5.0 release while retaining protocol-9 discovery and the documented scoped legacy paths - retarget official-client, API-shape, IVNP capability, and deterministic Axis-B fixtures - document unsupported reputation/peer-release-map behavior and the supported keyless algorithms ## Compatibility boundary Full current-client interoperability is v2.5.0. Older v2.4.x protocol-9 clients are intentionally outside the full end-to-end window after the upstream protocol-10 bump; the documented v2.3.8 direct-token/protocol-8 extension remains scoped and tested. ## Verification - `cargo test --locked` (195 passed, 3 ignored on macOS) - `cargo clippy --locked --all-targets -- -D warnings` - `cargo fmt --all -- --check` - containerized native Linux CI driver (199 passed, 5 ignored) - official v2.5.0 ARM64 HTTP/keyless, lifecycle, TCP, UDP, API-shape, lease-JWT, and IVNP capability checks - deterministic native ARM64 Axis B candidate/control gate with independent signed meshes, exact Rust middle markers, nonce responses, semantic runtime parity, and cleanup proof ### Release trail (v2.5.0) - Dev tag: `v2.5.0+rs.1-dev.1` at merged commit `45ff7746eeb0031639e0710add5009e7f129d4a8`. - ARM64 image: `v2.5.0-rs.1-dev.1`, digest `sha256:6dff07787a873397258fb796fbff1f476caf83463946d393c17699b57804c92c`; tag workflow 1057 succeeded. - Live Axis A and the official-client rollout passed. The canonical Axis B helper stopped before a middle-hop request because upstream v2.5.0 removed its `--multi-hop` flag; the retained logs prove the Rust middle was not exercised. - The dev deployment and client rollout were rolled back successfully. Dev counter 1 is consumed; any next live attempt must use `v2.5.0+rs.1-dev.2` or later. - No production tag, production image, Forgejo release, or production promotion was created.

gofix added 1 commit 2026-09-20 18:35:52 +00:00

chore: retarget upstream portal-tunnel v2.5.0 77f8651daa

gofix merged commit 45ff7746ee into master 2026-09-20 18:41:34 +00:00

gofix deleted branch codex/release-v2.5.0-20260920T152700Z-v2.5.0 2026-09-20 18:41:34 +00:00

gofix referenced this pull request from a commit 2026-09-20 18:41:35 +00:00

chore: retarget upstream portal-tunnel v2.5.0 (#96)

ada commented 2026-09-22 08:16:21 +00:00

Collaborator

• Copy link
• Copy Markdown

Final release trail

• Promotion-gate tag: v2.5.0+rs.1-dev.7 at merged commit 45ff7746eeb0031639e0710add5009e7f129d4a8; image workflow 1063 succeeded.
• Exact dev image v2.5.0-rs.1-dev.7 passed the production-shaped relay/client gate and the strict protocol-current Axis B candidate/control gate.
• Production tag v2.5.0+rs.1 points to the same commit; production image workflow 1064 succeeded.
• Production image v2.5.0-rs.1 and latest resolve to digest sha256:8c22c309fe0d12f3a202d06923e4d227b2c3897bcc4a6bc74acb7340d909ee64.
• Production reports protocol 10 / v2.5.0+rs.1. All nine checksum-verified official v2.5.0 expose services reattached; endpoint checks returned eight HTTP 200 and one expected HTTP 403.
• Earlier dev counters were consumed by verifier, convergence, or gate retries and were not promoted.

### Final release trail - Promotion-gate tag: `v2.5.0+rs.1-dev.7` at merged commit `45ff7746eeb0031639e0710add5009e7f129d4a8`; image workflow 1063 succeeded. - Exact dev image `v2.5.0-rs.1-dev.7` passed the production-shaped relay/client gate and the strict protocol-current Axis B candidate/control gate. - Production tag `v2.5.0+rs.1` points to the same commit; production image workflow 1064 succeeded. - Production image `v2.5.0-rs.1` and `latest` resolve to digest `sha256:8c22c309fe0d12f3a202d06923e4d227b2c3897bcc4a6bc74acb7340d909ee64`. - Production reports protocol 10 / `v2.5.0+rs.1`. All nine checksum-verified official v2.5.0 expose services reattached; endpoint checks returned eight HTTP 200 and one expected HTTP 403. - Earlier dev counters were consumed by verifier, convergence, or gate retries and were not promoted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gofix/portal-tunnel-rs!96

No description provided.