release: develop → beta for 7.0.4-beta - #1009
Merged
Merged
Conversation
github-pages environment rejects beta/stable refs. Always dispatch deploy-website from develop after product releases. After mirroring VitePress *.html to dir/index.html, remove the sibling .html so GitHub Pages no longer serves a stale /download object.
…only fix(ci): Pages deploy from develop + unstick /download
Use VitePress base /titanium-web-proxy/ so CSS/JS resolve on justcoding121.github.io (CloudFront already serves that prefix on titaniumproxy.com). Spawn update helpers with absolute powershell.exe paths to clear new_security_rating (S4036).
…s4036 fix: github.io Pages base + Sonar S4036 update helpers
Root cause: removing sibling *.html after the cleanUrls mirror forced /download through a GitHub Pages trailing-slash 301 whose Location used justcoding121.github.io (Pages custom-domain CNAME not active on the CloudFront edge). That looked like a broken download page. Keep page.html + page/index.html, write CNAME, revert VitePress base to /, and point nav Download at /download/.
…root fix(website): stop titaniumproxy.com/download redirecting to github.io
DNS for titaniumproxy.com points at CloudFront, not GitHub Pages. Enabling a Pages custom domain caused http↔https redirect loops. Keep sibling *.html so /download is served without a host-rewriting 301.
…ront fix(website): remove Pages CNAME (CloudFront owns domain)
DashboardHost binds an ephemeral or explicit controlPlane.dashboardPort instead of port+1; EchoOrigin and tests retry HttpListener binds; Inspector supports BindPort 0 and assigns session IDs from 1 without breakpoint preview burns. Add Inspector-Stress spill tests and MsQuic setup on ui-portable Linux/macOS. Extend RPS saturation to macos-15-intel with nginx HTTP/3 + MsQuic + YARP peers and Mac Performance.md sections.
- Escape ${extra} in DYLD path (PowerShell drive-scope parse bug)
- HOMEBREW_NO_INSTALL_UPGRADE so openssl@3 bottles on macos-15-intel are not force-upgraded
- nginx/libmsquic install without brew update
Also harden macOS uname arch detection in ui-portable MsQuic step.
FileShare.None left an exclusive lock that File.Copy hit on macOS CI.
ForwardOverTcpFastAsync was passing ForwardHost (127.0.0.1) as SslStream.TargetHost. That works on Win/Linux but fails on macOS Network.framework against a localhost leaf, aborting every H3 stream with H3_INTERNAL_ERROR (Mac compare-product gate failure). Match H3 to H2/H3: SNI from OriginAuthorityHost, connect via ForwardHost. Add dual-listen regression test. Document Mac H3 peer/MITM floors.
Async ZipArchive Open/Serialize stalled ImportArchive on macOS CI (StatusText stuck on Importing archive). Match ExportHarAsync: sync FileStream + ZipArchive so RelayCommand StatusText updates on the same UI turn.
Add compare-product-smoke (gate-critical Lite/Full/Reverse arms + YARP H3 peers) and a runner_os matrix filter so we can verify CSV + validate-compare-product-gates on macos-15-intel in minutes while a full compare-product run continues.
VitePress cleanUrls SPA-navigates /api/*.html to a 404; open API docs in a new tab like the nav, publish /api/index from toc, and list Inspector downloads first per channel.
…rust Mac smoke still saw 100% H3_INTERNAL_ERROR on H3->HTTPS-H1 after SNI fix. Stop advertising http/1.1 ALPN for that origin TLS handshake, accept probe localhost leaf when CustomRootTrust Build fails on Network.framework, and capture TWP_H3_ERROR_LOG on ramp failure for the next smoke.
Mac H3->HTTPS-H1 still 100% H3_INTERNAL_ERROR after SNI/ALPN tweaks. YARP succeeds using SocketsHttpHandler SslOptions.RemoteCertificateValidationCallback (AcceptAny). Match that: move validation onto AuthenticateAsClientAsync options instead of the SslStream constructor callback (unreliable on Network.framework), AcceptAny for the probe CA, ForwardHost=localhost for MitmHttp3ToHttp1, and drop http/1.1 ALPN on the full H3->H1 forward path too.
Inbound QUIC stamps ClientConnection.SslProtocol=Tls13. TcpConnectionFactory copied that mask onto outbound SslStream, so H3->HTTPS-HTTP1 offered TLS 1.3 only. macOS SecureTransport cannot negotiate TLS 1.3, aborting every stream with H3_INTERNAL_ERROR while H2->HTTPS (inbound TLS 1.2) and YARP worked. When outbound would be Tls13-only, expand to SupportedSslProtocols (Tls12|Tls13).
SNI/ALPN/AcceptAny/SslOptions-callback changes were not the cause. Root cause remains expanding Tls13-only outbound after QUIC inbound. Restore ForwardHost SNI+http/1.1 ALPN, constructor cert callbacks, and probe CA Validate(). Keep the dual-listen H3->HTTPS-H1 regression test (renamed) documenting the real TLS version constraint.
Outbound HTTPS now always uses SupportedServerSslProtocols when set, otherwise SupportedSslProtocols (Tls12|Tls13). Stop seeding from ClientConnection.SslProtocol — that mirrored QUIC's mandatory Tls13 onto Tcp SslStream and broke macOS SecureTransport. No hot-path cost: EnabledSslProtocols remains a bitmask on the existing AuthenticateAsClientAsync; offering Tls12|Tls13 vs Tls13-only does not add allocations or round-trips. Update SupportedServerSslProtocols docs (None = use SupportedSslProtocols, not mirror client).
Editions alone miss a uniform Core slowdown; run compare-spot beside rps-publish-gate so NuGet still waits ~60m wall clock.
Mac smoke confirmed outbound TLS policy fix (H3->HTTPS-H1 0% errors). Remove TWP_H3_ERROR_LOG workflow upload and stream-path file append. Document H3->H1 TLS Full MITM floor 0.65 from smoke @ 2026da5.
Full matrix Mac leg failed H1 plain Full MITM (0.564) and H3->H1 TWP/YARP (0.587 median; high repeat variance). Keep Win/Linux defaults (0.70 / 0.95); macos-15-intel validate step passes 0.55 floors. TLS fix remains green.
Win+Linux green on 33480574506; Mac missed H3->H3 TWP/YARP by 0.004 (0.746). Mac-only peer floor 0.74; publish Performance.md tables from this run.
Reverting speculative Mac TLS experiments also restored ForwardHost as SslStream.TargetHost. That fails TestCertificateAuthority name checks (HttpClient_Http3_To_HttpsHttp1_ForwardHostIp) while RPS AcceptAny masks it. Match H3 to H2/H3: SNI from OriginAuthorityHost, connect via ForwardHost.
VersionPrefix/Assembly 7.0.4 / 7.0.4.0 so develop->beta publishes NuGet 7.0.4-beta and tags v7.0.4-beta (7.0.3-beta already shipped).
chore(release): bump to 7.0.4 for beta cut
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
develop(VersionPrefix 7.0.4).Publish expectations (on merge push to beta)
7.0.4-betav7.0.4-beta+release.ymlproduct assetsTest plan
.NET / build,ui-portable,RPS saturation / rps(compare-spot)