vrr/amneziawg-installer
2
0
Fork 0
mirror of https://github.com/bivlked/amneziawg-installer.git synced 2026-10-19 05:03:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

release: v5.30.0 (#248)
Some checks are pending
Docs consistency / docs-consistency (push) Waiting to run
Details
ShellCheck / Lint and syntax check (push) Waiting to run
Details
Tests / unit-tests (push) Waiting to run
Details

Browse source 
Install and update commands move to releases/latest/download, so a copied line
no longer goes stale with the next release and serves a signed asset. Four pins
stay on purpose and the docs guard now explains which and why.

A guard against oversized I1-I5, which make the interface dump loop forever
upstream. Adding it exposed the same mistake in four neighbouring places: the
guard sets a flag and the code after it kept building positive claims from the
empty string left behind. diagnose said "I1=absent" at the moment the guard
fired because I1 was oversized, and with a carrier profile turned that into a
green tick; list, given a timeout in this same branch but no failure handling,
turned a visible hang into a complete and entirely wrong table. All eighteen
interface calls across the four scripts are bounded now, timeouts are named
separately from other failures, and the honest states survive.

The size parser no longer returns zero with a success status for input it did
not parse, since zero means "no masking packets" and switches the protection
off.

ADVANCED gains a client generation matrix answering which generation a client
speaks, with the weaker rows marked as inferences. Nine claims that did not
match the code or the world were corrected.
This commit is contained in:
Ivan Bondarev 2026-09-01 12:20:49 +03:00 • committed by GitHub
parent c9ce1c77a6
commit 013d3c012e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
21 changed files with 1354 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/RELEASE_PROCESS.md
View file

@ -259,8 +259,12 @@ signs bytes that then change, and the tag fails verification. The trusted
comment names the tag, so signatures cannot be carried over from the previous
release; re-sign every time.
Because the workflow has never run for a tag that was not there before, the
first time is worth doing on a throwaway tag: a semver pre-release suffix
(`vX.Y.Z-rc1`) publishes as a pre-release and does not displace Latest. Delete
the pre-release and its tag afterwards. Design and threat model:
`docs/SIGNING_DESIGN.md`.
The signing path has run on a real tag since this was first written:
v5.29.0 on 30 August 2026 published thirteen assets, six of them signatures.
A release is therefore no longer the first execution of untested code. A
throwaway tag stays the cheap way to rehearse a change to the workflow itself,
which cannot be exercised any other way because only a tag push triggers it: a
semver pre-release suffix (`vX.Y.Z-rc1`) publishes as a pre-release and does
not displace Latest. Delete the pre-release and its tag afterwards.
Design and threat model: `docs/SIGNING_DESIGN.md`.