[pull] master from ghostunnel:master

.github/workflows/compile.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Set up buildx command
@@ -30,7 +30,7 @@ jobs:
     name: Build (Linux)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
         os: [ubuntu-22.04, ubuntu-24.04]
     runs-on: ${{ matrix.os }}
     steps:
@@ -39,12 +39,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 100
           fetch-tags: true
@@ -56,12 +56,12 @@ jobs:
           CGO_ENABLED=1 GOARCH=arm64 CC=aarch64-linux-gnu-gcc make ghostunnel
           mv ghostunnel ghostunnel-linux-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-linux-amd64-${{ matrix.os }}
           path: ghostunnel-linux-amd64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-linux-arm64-${{ matrix.os }}
           path: ghostunnel-linux-arm64
@@ -70,16 +70,16 @@ jobs:
     name: Build (MacOS)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: macos-latest
     steps:
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 100
           fetch-tags: true
@@ -92,17 +92,17 @@ jobs:
           mv ghostunnel ghostunnel-darwin-arm64
           lipo -create -output ghostunnel-darwin-universal ghostunnel-darwin-amd64 ghostunnel-darwin-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-amd64
           path: ghostunnel-darwin-amd64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-arm64
           path: ghostunnel-darwin-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-universal
           path: ghostunnel-darwin-universal
@@ -111,23 +111,23 @@ jobs:
     name: Build (Windows)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: windows-latest
     steps:
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 100
           fetch-tags: true
       - name: Build binary
         run: make ghostunnel
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-windows-amd64
           path: ghostunnel

.github/workflows/docker.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Set up emulation

.github/workflows/lint.yml

@@ -10,12 +10,12 @@ jobs:
     name: Lint
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
       - name: golangci-lint

.github/workflows/release.yml

@@ -10,20 +10,20 @@ jobs:
     name: Build (Linux)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: ubuntu-22.04
     steps:
       - name: Set up cross toolchain
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Build binary
@@ -34,12 +34,12 @@ jobs:
           CGO_ENABLED=1 GOARCH=arm64 CC=aarch64-linux-gnu-gcc make VERSION=$GITHUB_REF_NAME ghostunnel
           mv ghostunnel ghostunnel-linux-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-linux-amd64
           path: ghostunnel-linux-amd64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-linux-arm64
           path: ghostunnel-linux-arm64
@@ -48,16 +48,16 @@ jobs:
     name: Build (MacOS)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: macos-latest
     steps:
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Build binary
@@ -69,17 +69,17 @@ jobs:
           mv ghostunnel ghostunnel-darwin-arm64
           lipo -create -output ghostunnel-darwin-universal ghostunnel-darwin-amd64 ghostunnel-darwin-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-amd64
           path: ghostunnel-darwin-amd64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-arm64
           path: ghostunnel-darwin-arm64
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-darwin-universal
           path: ghostunnel-darwin-universal
@@ -88,24 +88,24 @@ jobs:
     name: Build (Windows)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
     runs-on: windows-latest
     steps:
       - name: Set up toolchain
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Build binary
         run: |
           make VERSION=$GITHUB_REF_NAME ghostunnel
           mv ghostunnel ghostunnel-windows-amd64.exe
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ghostunnel-windows-amd64.exe
           path: ghostunnel-windows-amd64.exe
@@ -118,7 +118,7 @@ jobs:
       upload_url: ${{ steps.create_release.outputs.upload_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Create release
@@ -147,11 +147,11 @@ jobs:
         - { os: 'darwin', arch: 'universal' }
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: ghostunnel-${{ matrix.target.os }}-${{ matrix.target.arch }}
           path: dist
@@ -175,11 +175,11 @@ jobs:
         - { os: 'windows', arch: 'amd64' }
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: ghostunnel-${{ matrix.target.os }}-${{ matrix.target.arch }}.exe
           path: dist

.github/workflows/test.yml

@@ -12,17 +12,17 @@ jobs:
     name: Unit tests
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
         os: [ubuntu-22.04, ubuntu-24.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Build binary
         run: make ghostunnel
       - name: Run tests
@@ -32,12 +32,12 @@ jobs:
     name: Integration tests (Linux)
     strategy:
       matrix:
-        version: [1.24]
+        version: [1.25]
         os: [ubuntu-22.04, ubuntu-24.04]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Run tests 
         run: GO_VERSION=${{ matrix.version }} make docker-test
       - name: Codecov upload
@@ -56,23 +56,23 @@ jobs:
     name: Integration tests (Darwin)
     strategy:
       matrix:
-        version: [1.24.x]
+        version: [1.25.x]
         os: [macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.version }}
         id: go
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11.x'
       - name: Install gocovmerge
         run: go install github.com/wadey/gocovmerge@latest
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Run tests
         run: make test
       - name: Codecov upload

Dockerfile-alpine

@@ -6,7 +6,7 @@
 # To run ghostunnel from the image (for example):
 #     docker run --rm ghostunnel/ghostunnel --version
 
-FROM golang:1.24-alpine AS build
+FROM golang:1.25-alpine AS build
 
 # Dependencies
 RUN apk add --no-cache --update gcc musl-dev libtool make git

Dockerfile-debian

@@ -6,7 +6,7 @@
 # To run ghostunnel from the image (for example):
 #     docker run --rm ghostunnel/ghostunnel --version
 
-FROM golang:1.24-bookworm AS build
+FROM golang:1.25-bookworm AS build
 
 # Dependencies
 RUN apt update && apt install -y gcc libtool make git

Dockerfile-test

@@ -6,7 +6,7 @@
 # Run integration tests:
 #     docker run -v /dev/log:/dev/log -v $PWD:/go/src/github.com/ghostunnel/ghostunnel ghostunnel/ghostunnel-test
 
-ARG GO_VERSION="1.24"
+ARG GO_VERSION="1.25"
 
 FROM golang:${GO_VERSION}
 

README.md

@@ -355,4 +355,4 @@ this option.
 
 ### Landlock Support
 
-Ghostunnel can use [Landlock](https://landlock.io) to limit process privileges on Linux. Landlock can be enabled using the `--use-landlock` flag. When enabled, Ghostunnel will limit its access to files and sockets based on the flags passed at startup. Note that this functionality is still experimental, and does not work with PKCS#11 modules.
+Ghostunnel can use [Landlock](https://landlock.io) to limit process privileges on Linux. Landlock is enabled by default (in best-effort mode) on v1.9.0 or later. On Ghostunnel v1.8.x, Landlock can enabled using the `--use-landlock` flag. When enabled, Ghostunnel will limit its access to files and sockets based on the flags passed at startup. Note that Landlock does not work with PKCS#11 modules and is disabled if PKCS#11 is used (as PKCS#11 modules are opaque to us we can't craft workable Landlock rules for them).