[ANNOUNCE] nvme-cli v3.2

[Daniel Wagner]

Hi,

The v3.0 release was about getting the libnvme API sorted out, while
v3.2 focused on cleaning up and refactoring nvme-cli itself.

The command-line parsing and NVMe commands are now fully(*) tested and
fuzzed. This has resulted in a massive bug-fixing effort.

On the NVMe-oF side, discoverd and keysd are bringing NVMe-oF management
into this century. There are certainly still some rough edges to smooth
out, but the fundamentals should be solid.

Cheers,
Daniel

(*) the vendor plugins are not yet fully tested. Either these get fixed
or the get removed:

https://github.com/linux-nvme/nvme-cli/blob/master/CONTRIBUTING.md#what-is-expected-of-a-vendor-plugin-maintainer

Highlights:

- nvme-discoverd by default. The NVMe-oF discovery daemon is now built
  and installed by default, and it replaces the legacy udev/systemd
  autoconnect. Discovery controllers stay connected (--persistent=auto)
  and get a keep-alive timeout, so the host reacts to discovery AENs.
  Discovery over mDNS (TP8009) is optional.

- FreeBSD support. nvme-cli and libnvme build and run on FreeBSD for
  PCIe devices.

- Stricter, more consistent command line. The command line is parsed
  without getopt, so every C library behaves the same. Numbers are
  parsed strictly, and global options mean the same for every command.
  Usage errors are short and name the bad option. Some old spellings are
  no longer accepted; see Incompatible changes in NEWS.md.

- Register commands reworked. show-regs, get-reg, set-reg and the
  property commands use the register names of the specification, have
  one JSON format, and handle fabrics controllers correctly.

- Security hardening.

  - A root command injection in the WDC and SanDisk plugins is fixed.
  
  - Vendor plugins no longer run external tar/zip/dmesg; they use
    libarchive instead.
    
  - Many decoders that read past their buffers on malformed device data
    are fixed; fuzzing found them.
    

- Technology previews, disabled by default. These may change, or be
  removed again.

  - Privilege separation and a decoder sandbox. Under sudo, nvme-cli
    drops root and sends its device commands through a small root
    helper. The decoders of device data run in a sandboxed child
    process.
    
  - nvme-keysd. It loads NVMe/TCP TLS keys from encrypted systemd
    credentials into the kernel keyring.
    

- Monitoring. nvme top -o json writes the I/O statistics and the error
  and failover counters as one JSON document. A new MCP server,
  scripts/mcp/nvme-mcp, builds on that output to watch multipath I/O.

See https://github.com/linux-nvme/nvme-cli/blob/master/NEWS.md for the
full list of changes, including the incompatible ones.