Skip to content

a3s-sandbox v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@ZhiXiao-Lin ZhiXiao-Lin released this 18 Oct 01:57
· 1 commit to main since this release
v0.3.0
0f2bb18

a3s-sandbox 0.3.0

This release makes native lifecycle guarantees explicit, bounds observer and
cancellation cleanup, and tightens Windows AppContainer filesystem grants.

Migration

NativeSandbox::probe() now returns CapabilityReport. Wrappers returning
Result<()> can use .map(|_| ()). Hosts that require full descendant and
host-exit containment must call report.require_lifetime_containment().
Launcher availability alone does not establish either guarantee.

The bridge's probe response includes the full report with
runtime_probed=true. Initialize and static capability reports use false.
The Go SDK adds ProbeReport; its existing error-only Probe remains valid.

Fixes

  • Bound live and completion observers; preserve typed cancellation,
    observer-timeout and unknown-settlement failures.
  • Retain execution ownership while a caller is cancelled, including before
    the execution owner first polls.
  • Stop Unix process groups after root exit while draining inherited pipes.
  • Create Windows processes atomically inside a kill-on-close Job.
  • Give independent Windows sandboxes distinct AppContainer SIDs and revoke
    their grants from the current ACL instead of restoring stale descriptors.
  • Replace ineffective package-SID denials with restricted grants, restore
    inheritance, and remove parent delete-child rights over protected entries.
  • Coordinate Windows ACL mutations with a host-global mutex and bounded waits.
  • Preserve signal failures as nonzero CLI exits.
  • Keep Go SDK close idempotent after forced bridge termination or a pipe-close race.
  • Preserve the Go SDK, bridge, runtime-probed Linux cgroup quota support,
    credential hardlink checks and bubblewrap executable discovery.

Qualified scope

Windows requires Windows 10 / Server 2016 or newer and PowerShell 7. Linux
requires bubblewrap and usable unprivileged namespaces. Requested cgroup
quotas refuse when the host does not delegate the required controls.

macOS detached descendants and host-exit cleanup remain unqualified. Windows
host-exit admission remains unavailable until cross-host workspace ownership
and durable ACL/device/profile recovery are qualified. These restrictions
remain visible through the capability report. This release does not certify
new WSL2 or enterprise GA claims, and mediated network remains opt-in.

Native CI logs, source identities, SHA-256 checksums, signatures and an SBOM
accompany the release artifacts.

Install

cargo add a3s-sandbox@0.3.0
go get github.com/A3S-Lab/Sandbox/sdk/go@v0.3.0

The Go module is tagged separately as sdk/go/v0.3.0 on the same source commit.

Artifact identity and verification

  • Source: 0f2bb18dc4f16a1ebe12bc282db5c1499ad5fe05
  • Native qualification: https://github.com/A3S-Lab/Sandbox/actions/runs/39087183495
  • Native archives: Linux x86_64, macOS arm64, Windows x86_64; each contains the CLI, relay and machine bridge.
  • GPG signing fingerprint: CA2EC11396B6DFA259EB60C807C58356C3CD841F.
  • SHA256SUMS.asc authenticates the complete asset manifest. Each native archive also carries its own detached signature and GitHub Sigstore provenance bundle.
  • sbom.cdx.json, provenance.json, EVIDENCE.md and raw native CI logs accompany this release.
gpg --import RELEASE_SIGNING_KEY.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

gh attestation verify a3s-sandbox-v0.3.0-aarch64-apple-darwin.tar.gz \
  --bundle a3s-sandbox-v0.3.0-aarch64-apple-darwin.tar.gz.sigstore.json \
  --repo A3S-Lab/Sandbox \
  --signer-workflow A3S-Lab/Sandbox/.github/workflows/ci.yml \
  --source-digest 0f2bb18dc4f16a1ebe12bc282db5c1499ad5fe05 \
  --deny-self-hosted-runners
Assets 29
Loading