chore: retarget upstream portal-tunnel v2.3.7 #87

Merged

gofix merged 1 commit from codex/release-v2.3.7-20260817T120927Z-v2.3.7 into master

2026-08-17 12:44:37 +00:00

gofix commented

2026-08-17 12:42:15 +00:00

Owner

Summary

retarget the Rust relay compatibility baseline from upstream v2.3.6 to v2.3.7
implement the new public GET/HEAD /llms.txt relay connection guide with configured relay URL substitution
retarget fixtures and official-client/API/JWT smoke defaults to v2.3.7
preserve the existing protocol and multi-hop compatibility window; upstream changed no relay wire shapes in this release

Upstream

release: https://github.com/gosuda/portal-tunnel/releases/tag/v2.3.7
tag commit: 2c07a6a97e0e6a7852f8ced9d7c9847651861834
compared range: v2.3.6...v2.3.7
relay-server delta: /llms.txt endpoint and embedded connection-guide content

Verification

cargo fmt --check
cargo test --locked (147 passed, 3 ignored)
cargo clippy --locked --all-targets -- -D warnings
Go v2.3.7 vs Rust API shape/content comparison, including /llms.txt GET/HEAD/405 parity
Go v2.3.7 issued lease JWT verification in Rust
official v2.3.7 client HTTP expose smoke
official v2.3.7 client 45-second renew/unregister lifecycle smoke
official v2.3.7 client raw TCP smoke
official v2.3.7 client UDP smoke

Release audit trail

target production tag: v2.3.7+rs.1
dev counter trail: none yet; tagged dev deploy is created from the post-merge revision
dev/production image digests: pending tag builds
live verification: pending tagged dev deploy
release note: pending promotion

Upstream packaging note

The checksummed v2.3.7 linux/arm64 release asset currently prints v2.3.6 from its version command. The asset was downloaded from the v2.3.7 release, verified against its published sha256 file, and passed all HTTP/lifecycle/TCP/UDP compatibility smokes.

Tagged dev deploy

dev tag: v2.3.7+rs.1-dev.1
revision: 1b81484729
OCI tag: v2.3.7-rs.1-dev.1
manifest digest: sha256:2e34ebbeb1d2994685a5a56e4911291ff2b1a154e44efa0107207ccb9156b11c
tag image CI: passed in 5m00s
authenticated registry verification: both registry aliases expose the same digest
live verification: blocked before deployment; the relay Docker client is redirected to a Tailscale-only registry token realm that it cannot resolve
production promotion: not attempted

Resumed promotion attempt (2026-08-20)

authenticated relay pull verified the tagged dev image digest sha256:2e34ebbeb1d2994685a5a56e4911291ff2b1a154e44efa0107207ccb9156b11c
dev relay deployment reported v2.3.7+rs.1-dev.1 on both local Host-header and public version checks
the checksummed official upstream v2.3.7 linux/arm64 asset was installed for the full enabled production client inventory; all eight expose leases reattached and the direct HTTP plus private inventory health checks passed
the required private three-hop rly.best-middle Axis B fixture failed with exit 1, so the promotion gate did not pass
immediate rollback restored relay v2.3.5+rs.2, the previous official client binary for all eight services, eight ready leases, and passing private inventory health
verification-only multi-hop fixtures were stopped; relay container/image/builder cleanup completed; root filesystem usage was 23%
production tag, production image, deployment, and release note were not created

Completed promotion (2026-08-21)

dev.1 remained consumed after its earlier relay mutation and rollback
preserved dev.1 Axis B response proved the request traversed rly.best; the non-zero verdict came from a cleanup-status bug in the private verification helper
corrected private helper passed with immutable dev tag v2.3.7+rs.1-dev.2
dev.2 OCI digest: sha256:f2f293801140334875e61e2e85868c609757b2eb0aa06960c70b8fb67858cb80
production tag: v2.3.7+rs.1 at the exact dev.2 revision
production OCI digest: sha256:9fcfc74e2059cddaa53245c6007d46f54bcbe376174372aba5e2f38e5089d814
production and latest image identities match
relay reports v2.3.7+rs.1 locally and publicly
checksum-verified official v2.3.7 client asset installed; all eight production expose services reattached and passed endpoint checks
canonical protocol-8 Axis B gate, direct HTTP, relay API, /llms.txt, and private inventory health passed
runtime cleanup completed; root filesystem use 23%; rollback was not required

Release note: https://code.taile42665.ts.net/gofix/portal-tunnel-rs/releases/tag/v2.3.7+rs.1

## Summary - retarget the Rust relay compatibility baseline from upstream v2.3.6 to v2.3.7 - implement the new public GET/HEAD /llms.txt relay connection guide with configured relay URL substitution - retarget fixtures and official-client/API/JWT smoke defaults to v2.3.7 - preserve the existing protocol and multi-hop compatibility window; upstream changed no relay wire shapes in this release ## Upstream - release: https://github.com/gosuda/portal-tunnel/releases/tag/v2.3.7 - tag commit: 2c07a6a97e0e6a7852f8ced9d7c9847651861834 - compared range: v2.3.6...v2.3.7 - relay-server delta: /llms.txt endpoint and embedded connection-guide content ## Verification - cargo fmt --check - cargo test --locked (147 passed, 3 ignored) - cargo clippy --locked --all-targets -- -D warnings - Go v2.3.7 vs Rust API shape/content comparison, including /llms.txt GET/HEAD/405 parity - Go v2.3.7 issued lease JWT verification in Rust - official v2.3.7 client HTTP expose smoke - official v2.3.7 client 45-second renew/unregister lifecycle smoke - official v2.3.7 client raw TCP smoke - official v2.3.7 client UDP smoke ## Release audit trail - target production tag: v2.3.7+rs.1 - dev counter trail: none yet; tagged dev deploy is created from the post-merge revision - dev/production image digests: pending tag builds - live verification: pending tagged dev deploy - release note: pending promotion ## Upstream packaging note The checksummed v2.3.7 linux/arm64 release asset currently prints v2.3.6 from its version command. The asset was downloaded from the v2.3.7 release, verified against its published sha256 file, and passed all HTTP/lifecycle/TCP/UDP compatibility smokes. ## Tagged dev deploy - dev tag: v2.3.7+rs.1-dev.1 - revision: 1b81484729b624bb51e2df8824d9c2eddb6d0405 - OCI tag: v2.3.7-rs.1-dev.1 - manifest digest: sha256:2e34ebbeb1d2994685a5a56e4911291ff2b1a154e44efa0107207ccb9156b11c - tag image CI: passed in 5m00s - authenticated registry verification: both registry aliases expose the same digest - live verification: blocked before deployment; the relay Docker client is redirected to a Tailscale-only registry token realm that it cannot resolve - production promotion: not attempted ## Resumed promotion attempt (2026-08-20) - authenticated relay pull verified the tagged dev image digest `sha256:2e34ebbeb1d2994685a5a56e4911291ff2b1a154e44efa0107207ccb9156b11c` - dev relay deployment reported `v2.3.7+rs.1-dev.1` on both local Host-header and public version checks - the checksummed official upstream v2.3.7 linux/arm64 asset was installed for the full enabled production client inventory; all eight expose leases reattached and the direct HTTP plus private inventory health checks passed - the required private three-hop rly.best-middle Axis B fixture failed with exit 1, so the promotion gate did not pass - immediate rollback restored relay `v2.3.5+rs.2`, the previous official client binary for all eight services, eight ready leases, and passing private inventory health - verification-only multi-hop fixtures were stopped; relay container/image/builder cleanup completed; root filesystem usage was 23% - production tag, production image, deployment, and release note were not created ## Completed promotion (2026-08-21) - dev.1 remained consumed after its earlier relay mutation and rollback - preserved dev.1 Axis B response proved the request traversed rly.best; the non-zero verdict came from a cleanup-status bug in the private verification helper - corrected private helper passed with immutable dev tag v2.3.7+rs.1-dev.2 - dev.2 OCI digest: sha256:f2f293801140334875e61e2e85868c609757b2eb0aa06960c70b8fb67858cb80 - production tag: v2.3.7+rs.1 at the exact dev.2 revision - production OCI digest: sha256:9fcfc74e2059cddaa53245c6007d46f54bcbe376174372aba5e2f38e5089d814 - production and latest image identities match - relay reports v2.3.7+rs.1 locally and publicly - checksum-verified official v2.3.7 client asset installed; all eight production expose services reattached and passed endpoint checks - canonical protocol-8 Axis B gate, direct HTTP, relay API, /llms.txt, and private inventory health passed - runtime cleanup completed; root filesystem use 23%; rollback was not required Release note: https://code.taile42665.ts.net/gofix/portal-tunnel-rs/releases/tag/v2.3.7+rs.1

gofix added 1 commit

2026-08-17 12:42:15 +00:00