v0.8.0-beta.7

Release v0.8.0-beta.7

Fixed

• Retained successful local key-generation and certificate-request milestones
  in the identity transcript so later terminal redraws cannot erase them.
• Removed blank QR-code quiet-zone rows above identity payment instructions.
• Welcome-service guidance now tells users to add themselves to the required
  local service group before reloading pishoo: dhttp on Linux and _www on
  macOS.
• Scoped Linux-only device-name parsing to Linux builds, avoiding unused-code
  warnings on other platforms.

Components

• genmeta v0.8.0-beta.7
• genmeta-identity v0.4.0-beta.7
• All other gmutils workspace member versions are unchanged from v0.8.0-beta.6.

Release surfaces

• crates.io: genmeta-identity v0.4.0-beta.7 and genmeta v0.8.0-beta.7
• Preview DEB, RPM, Homebrew, and Scoop packages
• GitHub prerelease and packaged release assets

Authentication and provenance

• Tag: v0.8.0-beta.7
• Annotated tag object: a58086d82ec1834bfa51d8d34abb8c7860f96a1c
• Target commit: fad6565c7ab87fef387ff96d99dee7dca4e1bc4b
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/29902394551
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.6

genmeta v0.8.0-beta.6

Changed

• Reorder paid identity checkout guidance so the payment deadline and action appear before the indented QR code, with the copyable payment link shown last.
• Retain checkmarked local secp384r1 key generation, CSR request, and committed installation or renewal milestones in both interactive and non-interactive identity flows.
• Mount newly generated welcome services at /welcome. Immediately after default-identity selection, print a compact, consistently indented block containing the platform-specific pishoo reload command (sudo brew service reload pishoo on macOS or sudo systemctl reload pishoo elsewhere), followed by the copyable genmeta curl command for the new identity.

Components

• genmeta v0.8.0-beta.6
• genmeta-identity v0.4.0-beta.6
• Other gmutils workspace member versions are unchanged from v0.8.0-beta.5.

Release surfaces

• crates.io: genmeta-identity v0.4.0-beta.6 and genmeta v0.8.0-beta.6
• Preview DEB, RPM, Homebrew, and Scoop packages
• GitHub prerelease and packaged release assets

Authentication and provenance

• Tag: v0.8.0-beta.6
• Annotated tag object: 12b6ab26812bf6c1b8f803346cf2d29bc2bd9614
• Target commit: 7b07585c3276e23a595ecbaa159e8fb83ad817b3
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/29629780179
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.5

genmeta v0.8.0-beta.5

Changed

• Retain only local key generation and locally generated CSR completion on
  interactive terminals; keep non-interactive progress silent.
• Generate channel-aware Scoop checkver metadata for preview and stable
  package channels.

Fixed

• Reject certserver-invalid email structures before network requests.
• Preserve certserver business messages while displaying the original numeric
  or symbolic wire error code.
• Finalize progress output before subsequent command results and interactive
  prompts.

Dependencies

• Use genmeta-xtask-release v0.2.0-beta.9 for channel-aware Scoop metadata.

Components

• genmeta v0.8.0-beta.5
• genmeta-identity v0.4.0-beta.5
• Other gmutils workspace member versions are unchanged.

Release surfaces

• crates.io: genmeta-identity v0.4.0-beta.5 and genmeta v0.8.0-beta.5
• Preview DEB, RPM, Homebrew, and Scoop packages
• GitHub prerelease and packaged release assets

Authentication and provenance

• Tag: v0.8.0-beta.5
• Annotated tag object: 0e59d97b055dfb7c9e101f535e413f11c67c19ed
• Target commit: b6f6b65f82851fdd63b0a7b4e1ea62a567cb9f1e
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/29523518277
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.4

genmeta v0.8.0-beta.4

Added

• Add the visible genmeta id alias and a unified identity create-or-update workflow.
• Add certificate lifecycle audit records for committed identity material.

Changed

• Discover all online SSH primary sequences, preserve server ranking, and connect through the first online sequence unless a selector is explicit.
• Harden identity replacement, renewal, rollback, and non-interactive lifecycle boundaries.

Dependencies

• Use dhttp v0.6.0-beta.4, dyns v0.7.0-beta.2, h3x v0.6.0-beta.4, dquic v0.7.0-beta.4, and dshell v0.6.0-beta.3.

Components

• genmeta v0.8.0-beta.4
• genmeta-curl v0.7.0-beta.4
• genmeta-ssh v0.7.0-beta.4
• genmeta-access v0.4.0-beta.3
• genmeta-identity v0.4.0-beta.4
• genmeta-proxy v0.4.0-beta.3
• genmeta-discover v0.4.0-beta.3
• genmeta-doctor v0.4.0-beta.3
• genmeta-nat v0.5.0-beta.3
• genmeta-nslookup v0.5.0-beta.3

Authentication and provenance

• Tag: v0.8.0-beta.4
• Annotated tag object: 2ae07c2040b0e77c46d10d835ff7fd875aad69df
• Target commit: 3bfdfc9250425789797eab2ebe69161dc41fe332
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/29486645895
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.3

gmutils v0.8.0-beta.3

Changes

• genmeta access supports explicit DHTTP identity shorthand in access-rule patterns through the dhttp access facade.
• Access-control integration now consumes access APIs and feature activation through the dhttp facade instead of direct dhttp-access dependency wiring.
• CLI progress integration remains opt-in so ordinary output stays stable.
• Release workflows upload package assets from publish reports instead of broad local artifact globs.
• genmeta discover mDNS suffix tests now respect the configured release mDNS service name.

Release surfaces

• Product/package release: gmutils v0.8.0-beta.3 preview channel.
• Rust crates: genmeta v0.8.0-beta.3, genmeta-curl v0.7.0-beta.3, genmeta-ssh v0.7.0-beta.3, genmeta-access v0.4.0-beta.2, genmeta-identity v0.4.0-beta.3, genmeta-proxy v0.4.0-beta.2, genmeta-discover v0.4.0-beta.2, genmeta-doctor v0.4.0-beta.2, genmeta-nat v0.5.0-beta.2, genmeta-nslookup v0.5.0-beta.2.
• Package manager surfaces: DEB/RPM, Homebrew preview, Scoop preview.

Dependencies

• dhttp v0.5.0-beta.3, dhttp-home v0.4.0-beta.1, dhttp-identity v0.3.0-beta.1, dyns v0.6.0-beta.3, h3x v0.6.0-beta.3, dquic v0.7.0-beta.2, dshell v0.6.0-beta.2, rankey v0.2.1.
• Release tooling: genmeta-xtask-release v0.2.0-beta.8.

Verification

• cargo +nightly fmt -- --check
• cargo test with temporary local patches for same-wave upstreams
• cargo clippy --all-targets --all-features -- -D warnings with temporary local patches for same-wave upstreams

Registry gate

• Final readiness requires same-wave upstream versions visible on crates.io and Cargo.lock regenerated without path-resolved upstream sources.
• Scoop preview currently has an open old gmutils v0.8.0-beta.2 PR that should be merged, closed, or explicitly superseded before final Scoop publication.

Authentication and provenance

• Tag: v0.8.0-beta.3
• Annotated tag object: a4ac29f6f87b5450459e386a0f4335372b0bf519
• Target commit: 1a06e469d24a6cd54268a7ec042e333ebab0e391
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/29002483541
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.2

gmutils v0.8.0-beta.2

Changes

• Add HTTP/3 verbose metadata, redirect/upload verbose output, progress coordination, streamed response handling, and --fail flag clusters to genmeta curl.
• Reject unsupported redirect schemes and invalid redirect locations in genmeta curl.
• Preserve verbose markers while decoding and send headers before upload bodies.
• Show QR checkout codes and enrich generated device names in genmeta identity.
• Choose the SSH primary sequence before connecting in genmeta ssh.
• Refresh Linux packaging Zig/cargo-zigbuild tooling for DEB/RPM builds.
• Update DHTTP stack dependency contracts for the beta.2 line.

Published crates and packages

• genmeta v0.8.0-beta.2
• genmeta-curl v0.7.0-beta.2
• genmeta-ssh v0.7.0-beta.2
• genmeta-identity v0.4.0-beta.2

Unchanged gmutils workspace crates remain on their existing published versions.

Authentication and provenance

• Tag: v0.8.0-beta.2
• Annotated tag object: 9fd1f6531ba33701337c3b74c2626398e0be3f3c
• Target commit: 2c1ad9a8ad0d0b5aaacb22c23dcda2e720fd1ac4
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/28785522723
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.8.0-beta.1

gmutils v0.8.0-beta.1

Changes

• Prepare the Genmeta CLI workspace for the DHTTP beta dependency line.
• Update the CLI family to the current beta transport, DHTTP, DNS, DShell, and access-control dependency graph.
• Publish product packages through stable/preview-aware release destinations for DEB, RPM, Scoop, and Homebrew.
• Pin the shared release tooling through the reproducible genmeta-xtask-release release tag.

Fixes

• Improve genmeta identity apply and create flows for owner-email mismatch recovery and missing target identity handling.
• Create welcome service files after newly saved local identities are registered.
• Accept the current certificate server V2 quota and error response shapes.

Components

• genmeta v0.8.0-beta.1
• genmeta-curl v0.7.0-beta.1
• genmeta-ssh v0.7.0-beta.1
• genmeta-access v0.4.0-beta.1
• genmeta-identity v0.4.0-beta.1
• genmeta-proxy v0.4.0-beta.1
• genmeta-discover v0.4.0-beta.1
• genmeta-doctor v0.4.0-beta.1
• genmeta-nat v0.5.0-beta.1
• genmeta-nslookup v0.5.0-beta.1

Release surfaces

• crates.io workspace packages
• DEB preview packages
• RPM preview packages
• Scoop preview package
• Homebrew preview formula

Authentication and provenance

• Tag: v0.8.0-beta.1
• Annotated tag object: 9b2006d547bc73acf841df920ce292a0e11878e6
• Target commit: 75382053b8f0287e6bf254474768203fe62be25f
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/28675102649
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

v0.7.0

gmutils v0.7.0

This release updates the Genmeta CLI family for scoped dhttp home workflows and the current DHTTP endpoint stack.

Added:

• CLI tools now support scoped dhttp home selection across identity, access, curl, nslookup, NAT, proxy, and SSH flows.
• Identity onboarding can create a welcome service template for newly saved identities when the selected dhttp home supports it.

Changed:

• Identity flows now use explicit apply targets, replacement-aware default prompts, and selected-home local state handling.
• Product package generation now uses the manifest-first package contract for DEB, RPM, Homebrew, Scoop, and S3/R2 package metadata.
• Release package metadata uses the canonical dhttp download layout.

Fixed:

• Identity default and renew commands now report missing selected-home state through user-facing business errors instead of raw filesystem or profile-path errors.
• macOS identity builds avoid Linux-only group enumeration when checking welcome-service eligibility.
• crates.io publishing validates only publishable crate candidates and skips already-published versions.

Dependencies:

• Release dependencies now target h3x 0.5.0, dhttp 0.4.0, dhttp-access 0.3.0, dshell 0.5.0, dyns 0.5.0, and rankey 0.2.1.

Component versions:

• genmeta 0.7.0
• genmeta-curl 0.6.0
• genmeta-ssh 0.6.1
• genmeta-access 0.3.0
• genmeta-identity 0.3.0
• genmeta-proxy 0.3.0
• genmeta-discover 0.3.1
• genmeta-doctor 0.3.1
• genmeta-nat 0.4.0
• genmeta-nslookup 0.4.0

Authentication and provenance

• Tag: v0.7.0
• Annotated tag object: 81f226fee9675904382d3ed21fe01c8b6db616ea
• Target commit: 55ff22fcf55fc07c17ce74672cd56e8090bb015e
• Product release workflow run: https://github.com/genmeta/gmutils/actions/runs/28227579359
• crates.io Trusted Publishing workflow run: https://github.com/genmeta/gmutils/actions/runs/28227579358 (attempt 2)
• Homebrew tap PR: genmeta/homebrew-stable#4
• Published by: GitHub Actions Release and Publish crates.io workflows
• Published crates:
  • https://crates.io/crates/genmeta/0.7.0
  • https://crates.io/crates/genmeta-curl/0.6.0
  • https://crates.io/crates/genmeta-ssh/0.6.1
  • https://crates.io/crates/genmeta-access/0.3.0
  • https://crates.io/crates/genmeta-identity/0.3.0
  • https://crates.io/crates/genmeta-proxy/0.3.0
  • https://crates.io/crates/genmeta-discover/0.3.1
  • https://crates.io/crates/genmeta-doctor/0.3.1
  • https://crates.io/crates/genmeta-nat/0.4.0
  • https://crates.io/crates/genmeta-nslookup/0.4.0

v0.6.0

Initial public release of the Genmeta CLI family for the DHTTP release wave.

• Move the genmeta launcher and CLI crates onto the published DHTTP endpoint stack.
• Add certificate server V2 identity flows in genmeta-identity, including create, apply, renew, staged email verification, identity/email approval paths, and certificate-chain summaries.
• Move genmeta-ssh onto the dshell WebTransport conversation API while preserving the user-facing DShell CLI.
• Add manifest-based release packaging and dry-run/publish workflows for DEB/APT, RPM, Scoop, and Homebrew S3/R2 surfaces.
• Configure product S3/R2 publishing for Cloudflare R2-compatible upload checksums.
• Add crates.io publishing workflow coverage for all publishable gmutils workspace crates except xtask.
• Improve NAT diagnostics with deterministic bootstrap STUN selection, typed failure reporting, streamed interface reports, and clearer summaries.
• Normalize bare DHTTP authorities in genmeta-curl before request construction.
• Converge release dependencies to crates.io: dhttp 0.2.0, dhttp-access 0.2.0, h3x 0.4.0, dyns 0.4.0, dshell 0.4.0, and rankey 0.2.1.
• Complete Apache-2.0 crate and package metadata for crates.io, DEB, RPM, Scoop, and Homebrew surfaces.

This is an initial release for all gmutils public/package surfaces.

• genmeta 0.6.0

• genmeta-curl 0.5.0

• genmeta-ssh 0.6.0

• genmeta-access 0.2.0

• genmeta-identity 0.2.0

• genmeta-proxy 0.2.0

• genmeta-discover 0.3.0

• genmeta-doctor 0.3.0

• genmeta-nat 0.3.0

• genmeta-nslookup 0.3.0

• DEB/APT packages

• RPM packages

• Scoop manifest and archives

• Homebrew formula and archives

Because this is the first gmutils release on these surfaces, first publication uses the merged release commit as the source of truth. The crates.io packages were published after the release PR merged and before the final v0.6.0 tag; product package publication is tracked from the final tag CI.

Release-prep PR CI passed for:

• crates.io dry-run publish
• Linux DEB/APT package and S3/R2 dry-run
• Linux RPM package and S3/R2 dry-run
• Linux Scoop package and S3/R2 dry-run
• Homebrew package and S3/R2 dry-run

Authentication and provenance

• Tag: v0.6.0
• Annotated tag object: c01d861bc573ee12f55a84d7f7aa784677b85717
• Target commit: 7041df2b5a1b6a3ddd8f6dbd9735fb149c08b961
• Workflow run: https://github.com/genmeta/gmutils/actions/runs/27670130711
• Workflow attempt: 1
• Published by: GitHub Actions Release workflow

gmutils v0.5.0

[0.5.0] - 2026-04-20

Major release following the workspace-wide migration to the h3x
ecosystem and the introduction of the dhttp-home identity model.
Compared to v0.4.2, identity management, the DNS stack, several CLI
shapes, and the crate layout have all changed.

Added

• genmeta-identity crate — the sole entry point for managing
  identities (genmeta identity create | apply | renew | list | info | default). Talks to the certificate server over DHTTP/3 with TLS
  certificate pinning. Supports --captcha and the CERT_SERVER_URL
  environment variable for non-interactive enrollment and renewal.
  Displays key usage and extended key usage, and manages the default
  identity explicitly.
• dhttp-home as a first-class dependency — a DHTTP home holds
  many identity homes. genmeta identity is the only writer; every
  other tool discovers identities from the same home.
• Unified identity-lookup convention across every tool —
  -i/--id <name> accepts either a partial or fully qualified name
  (expanded via Name::try_expand_from), otherwise the default
  identity is used. --anonymous skips identity loading entirely.
  The GENMETA_HOME environment variable selects an alternate home.
• genmeta-proxy crate — a new HTTP/1.1 forward proxy. Routes
  .genmeta.net hosts over DHTTP/3, tunnels CONNECT over TCP,
  supports --daemon/--log, TCP keepalive, a connection cap, and a
  header read timeout. Defaults to dual-stack [::]:16080.
• genmeta-access crate — identity-scoped access rules persisted
  in SQLite (replaces the former standalone firewall-bin CLI).
• xtask crate — packaging pipeline using
  dpkg-buildpackage + debhelper, cross-compiling to multiple
  targets in parallel with mounted cargo caches. --sibling
  bind-mounts sibling workspaces for integrated builds.
• Dynamic interface rebinding in curl, ssh, nslookup,
  proxy, and discover via watch_bind_interfaces, stabilised by
  identity_key so stable endpoints survive interface churn.
• Minor CLI features — curl -4/-6 address-family selection;
  ssh native raw mode with SIGWINCH resize forwarding; genmeta nat resolves its STUN server via gmdns instead of a hard-coded
  address.

Changed

• Workspace-wide migration to the h3x ecosystem (Network +
  QuicEndpoint API), replacing the previous h3 / gm-quic stack.
  dquic is re-exported through h3x::dquic.
• Default DNS resolver: http → h3, with a system-resolver
  fallback.
• SSH URI scheme: ssh3:// → https://.
• Terminology sweep: HTTP/3 → DHTTP/3 across the codebase.
• Identity CLI flags: --domain/--domains → --suffix/--identities;
  the .genmeta.net suffix is hidden in display output.
• genmeta-common reorganised into bind / dns / id /
  h3-client features, with bon-based builder APIs for h3 client
  setup.
• A custom root CA (project root.crt) is merged with the system
  trust store instead of replacing it.
• Structured error types across curl, ssh, nslookup, nat,
  discover, and identity: Whatever replaced by named Error
  enums, with snafu::Report for consistent error rendering.

Removed

• genmeta-profile crate — identity modelling has moved into
  dhttp-home plus genmeta-identity.
• genmeta-ssh3 crate — renamed to genmeta-ssh alongside the
  URI-scheme change.
• The system DNS resolver helper in genmeta-common.
• The STUN_SERVER environment variable.
• The legacy buildx / Makefile packaging — superseded by xtask.

Fixed

• Certificate-server client now enforces TLS certificate pinning.
• Proxy: rewrites upstream HTTP/3 responses to HTTP/1.1 before
  forwarding; uses the low-level h3 API for correct stream
  lifecycle management.
• SSH: defers connection.close() while forwarding tasks are still
  active; moved stdin reads to a dedicated thread; PTY/flush fixes
  via updated genmeta-ssh-core.
• Removed panic risks from unwrap/expect on dynamic data paths.
• TTY detection gates ANSI colouring in tracing output so logs stay
  clean when redirected.

Dependencies

• All git dependencies are pinned to specific revisions: gmdns,
  rankey, firewall-base/-db/-migration, and genmeta-ssh-core.
• dhttp-home tracks branch = "main" to stay unified with the
  transitive usage from firewall-db; Cargo.lock still locks it
  to a specific commit.
• h3x is pulled once: the direct dependency tracks main over
  https://, with a [patch."https://github.com/genmeta/h3x.git"]
  redirect to ssh:// at a fixed revision. This unifies the direct
  dependency with transitive h3x uses from gmdns and
  genmeta-ssh-core, so exactly one copy is compiled.
• h3x is the only git dependency over https://; everything else
  uses ssh://.

Components

• genmeta v0.5.0
• genmeta-common v0.2.0
• genmeta-curl v0.4.0
• genmeta-discover v0.2.0
• genmeta-doctor v0.2.0
• genmeta-nat v0.2.0
• genmeta-nslookup v0.2.0
• genmeta-ssh v0.5.0 (formerly genmeta-ssh3)
• genmeta-identity v0.1.0 (new)
• genmeta-access v0.1.0 (new)
• genmeta-proxy v0.1.0 (new)

Policy

• Starting with v0.5.0, this CHANGELOG is written in English and
  follows Keep a Changelog.