Move the staged changelog entries under a 0.5.3 heading dated
2026-10-16, marked provisional in the heading itself, and leave an empty
Unreleased section above it. The topic groups follow the order the 0.5.2
section uses, and fixes that described one mechanism in several entries
now read as one: the gateway's virtual IP handling, the macOS sending
threads, the transport counters, the forged and unreadable SessionMsg3
and SessionSetup cases, and the same-epoch msg1 handling. No entry's
detail was dropped.
Add the release notes and mirror them byte for byte to RELEASE-NOTES.md,
with every link absolute and each paragraph on one line. They lead with
who should upgrade and what to do first: the SSH rule and gateway
forwarding before an OpenWrt upgrade, the farthest-first order for
routers reached over an 802.11s mesh, the Windows installer's stop on a
key left in \etc\fips, the refusal of a config that configures nothing,
the gateway's LAN-only translation and pool checks, and the changed
fips.nft, including what the systemd tarball does with an edited copy.
The upgrade steps say to restart fips after the network reload on an
OpenWrt mesh or gateway router, since a running daemon does not form
links over a recreated interface, and give the upgrade, reload and
restart as one detached command for a router reached over SSH. The
FreeBSD restart after the package upgrade is required, because pkg ends
the daemon the package starts. On Windows, a key moved out of \etc\fips
needs node.identity.persistent: true beside it and the old fips.yaml
deleted, and a service registered by hand is checked with sc.exe qc
first. On Debian, the steps cover each answer at the fips.nft prompt, an
upgrade run without a terminal, and masking fips-dns on a host that
renamed the TUN, which fips-dns does not support. A gateway on a VLAN
device on a bridge is affected only when br_netfilter passes bridged
IPv6 to the firewall, and only for clients whose traffic enters the
bridge untagged; the notes say how to check and what the workaround
costs, and that hosts off gateway.lan_interface lose .fips access.
They state the wire-format comparison and what it does not cover, the
limits that remain, the advisories accepted with the release including
RUSTSEC-2024-0449, that no crate was added to the lockfile, the
fips-mesh crate name and how a dependent names it, what was measured
and what was not, and the contributors.
The README's status badge, release-notes link and status paragraphs
follow the release, without naming a branch.
Correct documentation that no longer matches the release:
- The fips and configuration references say the Windows \etc\fips
config probe is deprecated, that the daemon warns when it loads a
config from there, and that from v0.6.0 the search no longer looks
there.
- Getting started no longer says there is no cargo install path, since
the crate is published; it says cargo install fips-mesh installs only
the binaries and is not how to install the daemon.
- The reachability how-to names its probe placeholder as a substitution,
and the gateway port-forward recipe marks its example mesh address as
the one to replace.
- The mesh firewall how-to says the systemd tarball keeps an edited
fips.nft and writes the new one as fips.nft.template.
- The gateway design document and the configuration reference state the
bridge netfilter condition under which a VLAN device on a bridge does
not serve its clients.
- The FreeBSD package README no longer says the package restarts the
services on upgrade, and says to restart them by hand.
- The OpenWrt package README's mesh upgrade order adds the fips restart
after the reload, as a detached command.
Architectural and protocol-level explanations for FIPS — the why
and the how behind the wire and the system. For wire formats and
configuration keys, see reference/. For task
recipes, see how-to/. For end-to-end lessons, see
tutorials/.
Reading Order
Start with fips-concepts.md for the
novice-friendly framing of what FIPS is and why, then move to
fips-architecture.md for the protocol stack,
identity model, and two-layer encryption walkthrough. From there,
follow the protocol stack from bottom to top. After the stack,
fips-mesh-operation.md explains how the
pieces work together at runtime. Cross-cutting and supporting
documents cover specific subsystems in detail.
Johnathan Corgan
37196604d7