chore: retarget upstream portal-tunnel v2.4.1 #91

Merged

gofix merged 9 commits from codex/release-v2.4.1-20260911T162141Z-v2.4.1 into master 2026-09-11 16:57:14 +00:00

Conversation 1 Commits 9 Files changed 49 +5885 -266

gofix commented 2026-09-11 16:51:24 +00:00

Owner

Copy link

Summary

• Supersede #90 with the reviewed protocol-9/IVNP ancestry retargeted to exact upstream v2.4.1 (c644d4b37b0a70c2e7b045ca92ce0de3b42e4299).
• Port v2.4.1 discovery behavior so directly contacted protocol-incompatible relays stay informationally visible for the upstream retention window without entering the routable pool or accruing health failures.
• Retarget workspace/docs/fixtures and current-version smoke defaults to v2.4.1, preserve full official-client v2.4.0 interoperability and scoped v2.3.8 direct-token/protocol-8 compatibility, and update Go fixtures for the upstream internal package move.
• Add a native fallback to the Go-issued JWT compatibility harness for build hosts without Docker.

Upstream assessment

Upstream v2.4.1 retains tunnel/discovery protocol 9. Relay-scope changes are protocol-mismatch visibility and the compose pull-policy fix; the latter does not apply to this repository’s source-build reference Compose file. The keyless signer mismatch self-test and reverse-endpoint diagnostics are client-side and are exercised by the official v2.4.1 client gate. Embedded DNSSEC behavior, internal package refactors, and plugin packaging remain out of relay scope.

Checks

• cargo fmt --all -- --check
• cargo test --locked — 189 passed, 0 failed, 3 ignored
• cargo clippy --locked --all-targets -- -D warnings
• go test ./... and go test -race -count=1 ./... in the IVNP helper
• static linux/arm64 IVNP helper cross-build
• shell syntax and release-tag/Compose policy tests
• exact v2.4.1 Go overlay capability verified by Rust
• exact v2.4.1 Go-issued lease JWT verified by Rust
• official Go v2.3.8 direct token admitted only by the scoped legacy path

Release audit trail

• Target production tag: v2.4.1+rs.1 / image v2.4.1-rs.1.
• Dev counters consumed: none yet. The next counter must be selected from both Forgejo tags and registry state after merge.
• Required post-merge gates: target-branch CI; tag-triggered ARM64 image build; deployment-host authenticated registry preflight; live dev deploy; official v2.4.1 and retained-window Axis A checks; canonical private portal-axis-b-rly-middle Axis B gate; matching production client rollout and service reattach; production promotion/deploy/sanity; cleanup; release-note publication.
• No image push, tag, deploy, production client mutation, or release publication has occurred in this PR.

Release note draft

Retargets the Rust relay to upstream portal-tunnel v2.4.1 while retaining protocol-9 compatibility with v2.4.0 and the documented scoped v2.3.8 paths. Adds upstream-compatible discovery visibility for directly observed protocol-incompatible relays without routing through them. Published image identity after promotion: code.rly.best/gofix/portal-tunnel-rs:v2.4.1-rs.1.

## Summary - Supersede #90 with the reviewed protocol-9/IVNP ancestry retargeted to exact upstream v2.4.1 (`c644d4b37b0a70c2e7b045ca92ce0de3b42e4299`). - Port v2.4.1 discovery behavior so directly contacted protocol-incompatible relays stay informationally visible for the upstream retention window without entering the routable pool or accruing health failures. - Retarget workspace/docs/fixtures and current-version smoke defaults to v2.4.1, preserve full official-client v2.4.0 interoperability and scoped v2.3.8 direct-token/protocol-8 compatibility, and update Go fixtures for the upstream internal package move. - Add a native fallback to the Go-issued JWT compatibility harness for build hosts without Docker. ## Upstream assessment Upstream v2.4.1 retains tunnel/discovery protocol 9. Relay-scope changes are protocol-mismatch visibility and the compose pull-policy fix; the latter does not apply to this repository’s source-build reference Compose file. The keyless signer mismatch self-test and reverse-endpoint diagnostics are client-side and are exercised by the official v2.4.1 client gate. Embedded DNSSEC behavior, internal package refactors, and plugin packaging remain out of relay scope. ## Checks - `cargo fmt --all -- --check` - `cargo test --locked` — 189 passed, 0 failed, 3 ignored - `cargo clippy --locked --all-targets -- -D warnings` - `go test ./...` and `go test -race -count=1 ./...` in the IVNP helper - static `linux/arm64` IVNP helper cross-build - shell syntax and release-tag/Compose policy tests - exact v2.4.1 Go overlay capability verified by Rust - exact v2.4.1 Go-issued lease JWT verified by Rust - official Go v2.3.8 direct token admitted only by the scoped legacy path ## Release audit trail - Target production tag: `v2.4.1+rs.1` / image `v2.4.1-rs.1`. - Dev counters consumed: none yet. The next counter must be selected from both Forgejo tags and registry state after merge. - Required post-merge gates: target-branch CI; tag-triggered ARM64 image build; deployment-host authenticated registry preflight; live dev deploy; official v2.4.1 and retained-window Axis A checks; canonical private `portal-axis-b-rly-middle` Axis B gate; matching production client rollout and service reattach; production promotion/deploy/sanity; cleanup; release-note publication. - No image push, tag, deploy, production client mutation, or release publication has occurred in this PR. ## Release note draft Retargets the Rust relay to upstream portal-tunnel v2.4.1 while retaining protocol-9 compatibility with v2.4.0 and the documented scoped v2.3.8 paths. Adds upstream-compatible discovery visibility for directly observed protocol-incompatible relays without routing through them. Published image identity after promotion: `code.rly.best/gofix/portal-tunnel-rs:v2.4.1-rs.1`.

gofix added 9 commits 2026-09-11 16:51:25 +00:00

chore: retarget upstream portal-tunnel v2.4.0 a5b5f35615

feat: add protocol-9 IVNP relay interoperability 29dfdd5445

fix: close v2.4.0 release blockers b46e8bc5f2

fix: harden v2.4.0 IVNP release gate e429a0292d

ci: install Windows cross compiler bd0ce70dd4

docs: keep Axis B proof release-gated 845c8ab4e7

fix: make ARM64 container smoke bootable 68f26d85eb

ci: run ARM64 image smoke on host runner b50e91a08c

chore: retarget upstream portal-tunnel v2.4.1 73fbcd5fcd

gofix referenced this pull request 2026-09-11 16:51:41 +00:00

chore: retarget upstream portal-tunnel v2.4.0 #90

gofix merged commit 0fa0f21612 into master 2026-09-11 16:57:14 +00:00

gofix deleted branch codex/release-v2.4.1-20260911T162141Z-v2.4.1 2026-09-11 16:57:14 +00:00

gofix referenced this pull request from a commit 2026-09-11 16:57:15 +00:00

chore: retarget upstream portal-tunnel v2.4.1 (#91)

ada referenced this pull request 2026-09-11 17:59:55 +00:00

test: make v2.4.1 Axis B IVNP gate deterministic #92

gofix commented 2026-09-11 18:11:42 +00:00

Author

Owner

Copy link

Release audit update (2026-09-12):

• PR CI and post-merge master CI passed at 0fa0f21612.
• Dev tags v2.4.1+rs.1-dev.1, .2, and .3 were built and published as linux/arm64 images. All counters are consumed because each candidate reached relay mutation.
• Dev 1 and dev 2 were automatically rolled back after deployment-validator defects (argument placement, then health JSON shape); neither indicated a relay crash.
• Dev 3 passed registry realm/authenticated-pull preflight, local/public relay health, expected wire version, official v2.4.1 client checksum/install, and all eight production expose-service endpoint checks (7 HTTP 200, 1 expected protected 403).
• The required canonical live Axis B helper is still protocol-8-specific. It stopped in preflight when the protocol-9 Rust middle was encountered, before any request reached the middle. Fixture logs were preserved; this is not evidence of a candidate relay failure.
• Relay and all eight official clients were rolled back to the prior production versions. Public relay health, all endpoints, and the registry tunnel were reverified.
• No production tag or release was created.

Needs human/private-ops remediation: replace or update the canonical live Axis B helper for the current protocol-9 IVNP topology. The next gating attempt must use immutable dev tag v2.4.1+rs.1-dev.4.

Release audit update (2026-09-12): - PR CI and post-merge master CI passed at 0fa0f216124cfc6d01ebce23430d2d67b9093225. - Dev tags v2.4.1+rs.1-dev.1, .2, and .3 were built and published as linux/arm64 images. All counters are consumed because each candidate reached relay mutation. - Dev 1 and dev 2 were automatically rolled back after deployment-validator defects (argument placement, then health JSON shape); neither indicated a relay crash. - Dev 3 passed registry realm/authenticated-pull preflight, local/public relay health, expected wire version, official v2.4.1 client checksum/install, and all eight production expose-service endpoint checks (7 HTTP 200, 1 expected protected 403). - The required canonical live Axis B helper is still protocol-8-specific. It stopped in preflight when the protocol-9 Rust middle was encountered, before any request reached the middle. Fixture logs were preserved; this is not evidence of a candidate relay failure. - Relay and all eight official clients were rolled back to the prior production versions. Public relay health, all endpoints, and the registry tunnel were reverified. - No production tag or release was created. Needs human/private-ops remediation: replace or update the canonical live Axis B helper for the current protocol-9 IVNP topology. The next gating attempt must use immutable dev tag v2.4.1+rs.1-dev.4.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gofix/portal-tunnel-rs!91

No description provided.