Agent

Version 2.0.2

• Released July 29, 2026

Fixed

• Fixed tray start-up failure on Windows 11. Resulted in a dialog box with a stack trace that ends with following error:

  AttributeError: 'NoneType' object has no attribute 'split'
  

Version 2.0.1

• Released July 27, 2026

Fixed

• Fixed tunnel start-up failure on Ubuntu 25.04 and newer. Resulted in error message like the following in the crux-wg@crux0 service log:

  /usr/bin/wg-quick: line 40: /etc/crux/crux0.conf: Permission denied
  

Version 2.0.0

• Released July 20, 2026

Added

• Windows UI via system tray icon. Icon shows status of Crux tunnels. Right-click icon to show more detailed information, and to start and stop tunnels.
• Windows installer option to automatically copy a downloaded setup file to the Crux configuration directory.
• Linux env vars file at /etc/default/crux-agent.
• NOTICE file in release packages with information about each bundled third-party library and its license.

Changed

• Rebranded from Crux VPN to just Crux, renaming all files, directories, and services that previously had cruxvpn in their names to crux; plus some additional name changes detailed below. The Windows installer and Linux install script will automatically make all necessary name changes when upgrading from 1.x to 2.x. Docker upgrades need to follow steps in the Docker 2.0 Upgrade documentation.
• WireGuard tunnel and driver now bundled with the agent on Windows (no longer need to separately install WireGuard for Windows).
• Now uses the system trust store by default (instead of the bundled Certifi trust store) to verify TLS certificates (except on Python 3.9, which still uses Certifi). New CRUX_CA_BUNDLE environment variable allows specifying an alternate CA bundle, via one of the following values:
  • system (default): System trust store.
  • certifi: Certifi trust store.
  • Path to CA cert bundle file (eg /etc/ssl/cert.pem).
• Upgraded Python runtime from 3.12 to 3.14 on Windows.

Fixed

• Fixed install script to install the required libsodium package on openSUSE Leap 16.

Renaming Crux VPN to Just Crux

Following are the principal name changes on each platform; see the Upgrade the Agent platform-specific documentation for full details:

• All platforms:
  • Agent config file name changed from cruxvpn.conf to crux-agent.conf
  • Agent credentials file name changed from cruxvpn-credentials.conf to crux-credentials.conf
  • Agent setup file name changed from cruxvpn-setup.conf to crux-setup.conf
  • SKA-P registration file name changed from cruxvpn-registration.conf to crux-registration.conf
  • Main binary file name changed from cruxvpn-agent to crux-agent
  • SKA-P registration binary file name changed from cruxvpn-register to crux-register
  • Environment variable prefix changed from CRUXVPN_* to CRUX_*
• Docker only:
  • Image name changed from ghcr.io/siriuscomputer/cruxvpn-agent to ghcr.io/siriuscomputer/crux-agent-ska
  • Image config directory changed from /etc/cruxvpn/ to /etc/crux/
• Linux only:
  • Agent service name changed from cruxvpn-agent to crux-agent
  • Tunnel service name changed from cruxvpn-wg@crux0 to crux-wg@crux0
  • Config directory changed from /etc/cruxvpn/ to /etc/crux/
  • Root program directory changed from /opt/venvs/cruxvpn-agent/ to /opt/crux-agent/
• Windows only:
  • Agent service name changed from cruxvpn-agent-service to crux-agent-service
  • Tunnel service name changed from WireGuardTunnel$crux0 to CruxTunnel$crux0
  • Agent config directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\cnf\ to C:\ProgramData\Crux\cnf\
  • Tunnel config directory changed from C:\Program Files\WireGuard\Data\configurations\ to C:\ProgramData\Crux\cnf\
  • Log directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\log\ to C:\ProgramData\Crux\log\
  • Root program directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\ to C:\Program Files\Crux\

Version 1.18.0

• Released April 19, 2026

Added

• Added Windows code signing to MSI package (as well as to all EXE, DLL, and PS1 scripts in the MSI package).
• Added Sigstore signatures to artifact downloads.
• Added "inbound" and "all" options to MSS clamping script.

Changed

• Upgraded to Arqit SKA-Platform™ SDK version 26.01.
• Upgraded other dependencies to latest versions (that still support Python 3.9).
• Individual SKA API endpoint settings (such as UserAuth, Dscc, etc) have been completed replaced by Domain and Use TLS settings (configurable via SKA-Platform admin page in Crux web UI).

Fixed

• Fixed a potential race condition when deleting empty deviceMetadata.json files, now deleting them only when more than 2 minutes old. Failed SKA-P device registration can create an empty deviceMetadata.json file; but this file may also be emptied temporarily by the backround SKA authentication thread.
• Prevent connectivity-check pings from keeping a tunnel active when no other traffic has been sent through it for more than 2 minutes.
• Allow agent to start up in reduced-functionality mode when SKA libs are missing.

Version 1.17.0

• Released March 4, 2026

Added

• Collect connectivity issues and send them to Crux API.
• New connectivity checks for individual WireGuard peers, including attempting to send traffic through connections with a recent WireGuard handshake (disable by setting CheckWgPeerPingTimeout = 0 in the agent config).
• Collect host inventory properties and send them to Crux API.
• Send SKA DUID to Crux API.

Changed

• Now exponentially backs off Crux API requests after encountering 4 consecutive error responses, up to the point of 1 request every 1-2 hours (downside is it may take an hour or two for an agent to start communicating with the Crux API again after a connectivity issue has been fixed). This back-off does not apply to communication with SKA API or peers.
• Changed the formatting of connectivity checks on agent start.
• Changed systemd service to not drop CAP_NET_RAW capability, allowing the agent to make true ICMP ping requests.
• No longer tries to de-register & re-register with SKA-P on terminal authentication failure; instead propagates error as connectivity issue to Crux API, allowing Crux API to factory-reset device (if so configured).
• Handle device-policy verification errors by deleting devicePolicy.json config file (which should be replaced on next device-policy update).

Version 1.16.1

• Released February 1, 2026

Changed

• During agent set-up, config settings from cruxvpn-setup.conf now override any settings from an existing cruxvpn.conf file (but settings not overridden by cruxvpn-setup.conf are preserved).
• Allow set-up process to run even when ReadOnly = true setting in agent config.
• More logging for Crux API calls.

Version 1.16.0

• Released January 17, 2026

Changed

• Agent now pulls its own configuration from Crux API by default, overwriting manual cruxvpn.conf settings (see Agent Configuration documentation for details).
• Agent now pulls SKA-P registration settings from Crux API if available and cruxvpn-registration.conf not supplied (see SKA-P Registration documentation for details).
• Agent now can use use single cruxvpn-setup.conf file for set-up.

Version 1.15.1

• Released December 9, 2025

Fixed

• Fixed Linux install script download of pre-built liboqs when using older versions of curl; previously would error with this message:

  curl: option --no-clobber: is unknown
  

Version 1.15.0

This release fixes a DNS-resolution issue that will prevent the agent from working properly with its default DNS settings after December 15, due to an incompatibility between its previously default DNS resolver (Quad9, aka 9.9.9.9) and the way it resolves DNS by default (using DNS-over-HTTPS, aka DoH, with HTTP 1.1).

• Released December 7, 2025

Added

• Ability to re-provision device after SKA Device Recovery action is invoked.

Changed

• Made host system's own DNS resolver the default; new default is the same as this cruxvpn.conf setting:

  [Cruxvpn]
  Dns = off
  

• Updated default settings to use new SKA version 25.9 URLs and PaaS region as default; new defaults are the same as these cruxvpn.conf settings:

  [SKA]
  Region = ska
  Domain = ska.quantum.cloud
  [SKA.API]
  UserAuth = https://api.ska.quantum.cloud
  

• Updated default settings for SKA update intervals; new defaults are the same as these cruxvpn.conf settings (intervals in seconds):

  [SKA]
  HeartbeatInterval = 120
  DevicePropertiesInterval = 3600
  DevicePolicyInterval = 600
  

• Enabled cruxvpn.conf file to use [SKA] and [SKA.API] sections, and enabled cruxvpn-registration.conf file to use [SKA.Registration] section, in place of PQC prefixed sections (but PQC sections will still work as before for the time being).
• Renamed SKA-related modules and logging to use "ska" identifier in place of "pqc".

Fixed

• Fixed DNS errors querying default DNS server after December 15.
• Fixed initiators to not wait until next scheduled interval to agree on new keys after re-registration.

Version 1.14.0

• Released November 11, 2025

Changed

• Upgraded Arqit SDK to version 25.12-alpha1.
• Python 3.9 is now the minimum required version of Python.

Fixed

• Fixed documentation URLs in logging and help files.

Version 1.13.2

• Released November 3, 2025

Fixed

• Avoid skipping some changes when multiple queued changes are applied at the same time.
• Avoid breaking the tunnel for queued changes that include/require a restart of the interface.

Version 1.13.1

• Released October 24, 2025

Changed

• Changed canonical OCI image name from ghcr.io/crux-comms/cruxvpn-agent to ghcr.io/siriuscomputer/cruxvpn-agent.
• Disabled cosign build signing temporarily (until other infrastructure pieces are moved into place).

Version 1.13.0

• Released October 19, 2025

Changed

• Break the tunnel to a device when it is quarantined, de-registered, or removed from all security groups in common (when belonging to an organization that requires a common security group to agree on a key).
• Optionally break the tunnel to a device when the time since its last symmetric key rotation exceeds the configured max TTL.
• Save keys agreed with unknown SKA-P devices.
• Upon learning a WireGuard peer is a SKA-P device, either apply its saved key, or generate a dummy key to prevent the tunnel to it from being used until the first secret key is agreed.
• Start initiating symmetric key agreements right after SKA-P registration, instead of waiting 90 seconds for device UIDs to propagate.
• Pause SKA initiators in a 25-second "blackout" window around the expected WireGuard handshake.
• Enable a "rotate now" command from the web UI to force immediate symmetric key rotation.

Version 1.12.1

• Released September 26, 2025

Fixed

• Fixed missing log output on Windows.
• Avoid doing client-side DNS resolution for API calls when using an HTTP proxy.

Version 1.12.0

• Released August 1, 2025

Changed

• Change the agent's core monitoring logic to:
  1. Ignore interfaces outside of the configured WireGuard directory (previously would report on all WireGuard interfaces)
  2. Report on down interfaces (previously would ignore them)
• Flip IPv6/IPv4 preference if connectivity check to API fails, and try it with the other address family.
• Run DNS queries to secondary DNS servers in parallel, if primary takes too long to respond.
• If custom DNS servers specified, query them with UDP by default (unless the URL or hostname with which they can be queried with DoH is also specified via the Doh setting; or unless the DNS servers are from well-known DoH providers).

Fixed

• Fixed ReadOnly setting to block changes from being applied on client.

Version 1.11.2

• Released July 25, 2025

Changed

• Send custom application name, version, and developer name to device properties API (eg "Crux Linux Agent 1.11.2 by Sirius").

Fixed

• Don't automatically retry registration if 1st attempt fails. Now if registration fails, an administrator must correct the issue, and then manually restart the agent.
• Fix registration mode to always use uppercase values (eg QKEY).
• Better error messages when missing required registration config settings (such as Realm).
• Fixed pre-built liboqs download logic in install.sh script to ignore minor OS versions when checking for available downloads.
• Fixed install.sh to run ldconfig only if a library path was added.
• Don't try to load agent conf files from /etc/wireguard.
• Avoid writing deviceProperties.json when no props have changed.

Version 1.11.1

• Released July 6, 2025

Added

• Allow custom SKA-P domain to be configured in agent conf via Domain setting, as a shorthand for setting each individual SKA-P API endpoint.
• Allow QKey and QKeyId settings in agent registration conf.
• Allow agent conf settings to be specified as base64; eg: PasswordBase64 = cGFzc3dvcmQgIyAxMjM=.

Fixed

• Allow # characters in Password setting of agent registration conf.
• Fix startup sequence to not miss DUID updates that occurred while agent was not running.

Version 1.11.0

• Released June 14, 2025

Added

• Connectivity checks for Arqit SKA-Platform™ (SKA-P).
• "Offline" mode for non-essential SKA-P endpoints; engaged via the following /etc/cruxvpn/cruxvpn.conf settings:

  [PQC.API]
  MonitorHeartbeat = offline
  MonitorProperties = offline
  Policy = offline
  

Changed

• Bundle Arqit SKA-Platform™ SDK into agent tarball.

Fixed

• Enable communication with Crux API even when no SKA-P connectivity; and enable SKA-P peering and communication with SKA-P endpoints even when no Crux API connectivity.

Version 1.10.0

• Released May 30, 2025

Added

• Agent MSI builds via GitHub Actions.
• Liboqs DLL builds via GitHub Actions.

Changed

• Download liboqs.so if pre-built version available (rather than always build it from source) on install.
• Default the location of device*.json files to the same directory as the cruxvpn.conf file (rather than always /etc/cruxvpn) if not explicitly specified.

Version 1.9.3

• Released May 29, 2025

Added

• "Offline" mode for interacting with the API server, where the agent will not attempt to connect to the API server if you change its /etc/cruxvpn/cruxvpn.conf Api setting to this:

  Api = offline
  

Version 1.9.2

• Released May 18, 2025

Added

• Tarball and container image builds via GitHub Actions.

Fixed

• Fixed agent name in crux0.conf comment.
• Fixed install.sh "wg-quick service definition not found" error on Debian Buster.
• Fixed liboqs build on Alpine Linux for 32-bit ARM (eg Raspberry Pi).

Version 1.9.1

• Released May 8, 2025

Added

• Automatically install iptables package (required for packet forwarding).

Changed

• Try to install newer Python on RHEL 8 variants on clean install (RHEL 8 default is Python 3.6; Python 3.8 or newer is required).

Fixed

• Clean up de-register/re-register cycle to avoid this error: No such file or directory: '/etc/cruxvpn/deviceProperties.json'

Version 1.9.0

• Released May 3, 2025

Added

• Use Arqit SKA-Platform™ to generate WireGuard preshared keys.
• Automatically register device with SKA-Platform if not yet registered.
• Automatically start SKA-Platform peering socket receiver and initiators based on settings in WireGuard config.
• Build and install liboqs as part of install script.
• Option to redact preshared keys only.

Changed

• Use /etc/cruxvpn directory to consolidate all config files.
• Define and use cruxvpn-wg systemd service in place of wg-quick service.
• Improve handling of interrupt/terminate signals to shut down faster.
• Use versioningit plugin to calculate agent version number.

Removed

• Remove support for Python versions older than 3.8.
• Remove old Windows EXE installer (deprecated by new MSI-based installer).

Fixed

• Explicitly set root log level to override log settings from libraries.

Version 1.8.0

• Initial Release