v0.1.3

What's Changed

• fix(release): publish cordon-run.sh — the sandbox itself shipped in no artifact by @lyubomir-bozhinov in #8

Full Changelog: v0.1.2...v0.1.3

v0.1.2 — security: sandbox can no longer plant host-executed content

Security release

cordon is the sandbox. Until this release, content written inside the container could be executed on the host — a container-to-host escape reachable through an ordinary git command.

Anyone using cordon to contain untrusted or model-authored work should take this release.

Fixed — planted .git/hooks executed on the host (#2)

The sandbox could write into .git/hooks/, and those hooks then ran on the host the next time git touched that worktree. The fix is to mount .git read-only.

The more interesting half of this release is that the tests around it proved nothing until three separate defects were corrected — worth spelling out, because each one made a passing suite look like evidence:

1. Both escape tests set an absolute core.hooksPath pointing at a container path. A relative hooksPath is resolved against the worktree root (git chdirs there before invoking hooks, per githooks(5)), but a container-absolute path is simply unresolvable on the host — so the test could never have fired, with or without the fix. Now relative.
2. The payload was likewise container-absolute. Now a relative touch PWNED_*.
3. The bindable_worktree probe shelled out to docker run directly instead of going through _run_cordon, which hid the fact that cordon could not run at all without coreutils. The suite reported "3 passed" while nothing had executed.

Assertion order was also inverted: execution is now asserted before the config/file check, so a failure reads "the hook ran" rather than pointing at a setup detail.

Verified non-vacuous end to end by reverting the .git:ro mount and observing the tests fail. Two regression tests were added to keep the vacuity from returning — including a positive control that needs no Docker.

Also in this release

• Bound the run with a real wall-clock timeout.
• Digest-pin the runtime image base (debian:bookworm-slim) (#1).
• SHA-pin every GitHub Action; pin the cosign binary release, and pin cosign to 2.6.4 (3.x dropped the detached .sig).
• Silence shellcheck SC2317 on the trap-invoked cleanup.
• CONTRIBUTING now encodes the family review & merge protocol (4 rules).

Upgrading

No interface change. .git is now mounted read-only — if you were relying on the sandbox writing into .git, that no longer works, which is the point.

docker pull ghcr.io/barnett-studios/cordon:0.1.2

Full changelog: v0.1.1...v0.1.2