v0.6.5 - Audit Hardening, Fail-Closed Enforcement & Verification Hardening

What's Changed in v0.6.5

Fail-Closed Server Enforcement & Git Plumbing

• Hardened server-side pre-receive enforcement to fail closed on missing master keys or corrupted payloads, querying Git trees directly via low-level Git plumbing.

Transactional Rekey Recovery Verification

• Propagated all restoration errors during rekey recovery; backups and WAL journals are preserved until post-rollback repository consistency is cryptographically verified.

Escaped .gitattributes Whitespace & Tokenization

• Hardened .gitattributes parsing with robust tokenization respecting escaped whitespace, quotes, comments, and directory boundaries (/).

Release Workflow & Platform Test Verification

• Restored comprehensive multi-target integration test suites on macOS and Windows CI runners.
• Hardened Windows release artifact checksum and provenance verification in automated release workflows.
• Corrected verification matrix test paths and clarified security boundaries for hosted CI environments.

Full Changelog: v0.6.0...v0.6.5

v0.6.0 - Format v1 Freeze, Server Enforcement & Sigstore Provenance

What's Changed in v0.6.0

Format Version 1 Specification Freeze

• Finalized and froze the repository format version 1: envelopes, recipient manifests, WAL journals, and deterministic HMAC cache indexing.

Server-Side Push Protection (git-agecrypt check --pre-receive)

• Native pre-receive hook enforcement rejecting unencrypted secrets, foreign recipient keys, or corrupted ciphertexts on Git servers before acceptance.

Diagnostic & Interoperability Tools (inspect, export-age)

• Added git-agecrypt inspect to inspect ciphertext headers, recipient lists, and metadata without full decryption.
• Added git-agecrypt export-age to export native age-compatible encrypted files for off-platform sharing.

Fail-Closed Rekey Recovery

• Validated atomic transactional rollback during rekeying operations, ensuring keys and journals remain intact until state consistency is verified.

Sigstore Provenance & Release Attestations

• Releases include cryptographically signed provenance attestations and build checksums.

Full Changelog: v0.5.0...v0.6.0

v0.6.0-rc.3 - Release Candidate 3: Interop Stripping & Advisory Fixes

What's Changed in v0.6.0-rc.3

External Age CLI Interoperability

• Enhanced envelope comment stripping to guarantee seamless decryption interoperability with external upstream age CLI tools.

Advisory Resolution & Security Hardening

• Resolved cargo-deny security advisories and hardened process dumpability verification across Linux and macOS.

Full Changelog: v0.6.0-rc.2...v0.6.0-rc.3

v0.6.0-rc.2 - Release Candidate 2: OS File Locking & Concurrent Recovery

What's Changed in v0.6.0-rc.2

OS File Locking

• Replaced custom advisory lock files with robust operating system file locking (fs2) across Unix and Windows.

Concurrent Recovery Hardening

• Strengthened race condition handling during multi-process crash recovery and ring verification under stress.

Full Changelog: v0.6.0-rc.1...v0.6.0-rc.2

v0.6.0-rc.1 - Release Candidate 1: Format Freeze & Server Enforcement

What's Changed in v0.6.0-rc.1

Format Version 1 Freeze

• Stabilized storage layouts, key envelope definitions, and journal structures for the v0.6.0 release series.

Server Pre-Receive Hook & Inspection Tools

• Added git-agecrypt check --pre-receive for server-side push validation and introduced inspect / export-age diagnostic utilities.

Prerelease CI & Distribution Hardening

• Integrated prerelease automated builds with cross-platform artifact packaging and SHA-256 checksum generation.

Full Changelog: v0.5.0...v0.6.0-rc.1

v0.5.0 - SIGKILL Crash Injection, Shadow Model-Checking & Regression Corpus

What's Changed in v0.5.0

Real SIGKILL Crash Injection

• Added real OS-level crash injection testing (test_sigkill_crash_injection.rs) validating that state recovery succeeds even when processes are killed mid-syscall.

Shadow Model-Checking

• Developed a formal shadow reference model (tests/common/shadow_model.rs) running in parallel with the stateful harness to continuously verify implementation behavior against mathematical expectations.

Continuous Fuzzing & Regression Corpus

• Added cargo-fuzz targets for age ciphertext parsing, .gitattributes evaluation, merge parser, and WAL journal decoding, backed by a persistent regression test corpus.

TOCTOU Elimination & Proc Memory Protection

• Eliminated Time-of-Check to Time-of-Use race conditions across file operations and hardened child process memory snooping defenses.

Formal Guarantees Specification

• Published formal guarantees specification in docs/spec-guarantees.md.

Full Changelog: v0.4.0...v0.5.0

v0.4.0 - Generative State Machine Testing, Invariant Verification & Fault Injection

What's Changed in v0.4.0

High-Assurance Generative State Machine Testing

• Implemented randomized state machine harness (test_stateful_random_harness.rs) simulating thousands of randomized interleavings of lock, unlock, rekey, add-recipient, and commit operations.

Repository Invariant Verification Suite

• Introduced automated invariant assertions (tests/common/invariants.rs) verifying clean trees, ciphertext validity, key synchronization, and zero-plaintext leakage after every lifecycle step.

Fault Injection & SIGKILL Durability Testing

• Validated atomic crash resilience and WAL journal recovery under simulated sudden process termination during critical write sections.

Verification Matrix Documentation

• Published comprehensive verification matrix mapping threats, operational invariants, and test coverage in docs/verification-matrix.md.

Full Changelog: v0.3.0...v0.4.0

v0.3.0 - Ring Isolation, Hardened memfd Lifecycle & 15-Suite Test Harness

What's Changed in v0.3.0

Comprehensive 15-Suite Integration Test Harness

• Restructured test framework into 15 specialized integration test binaries covering durability, scoped rings, memory hygiene, concurrency, fuzz boundaries, headless clones, large files, and submodules.

Scoped Ring Isolation & Multi-Worktree Durability

• Hardened ring state isolation across concurrent repository operations and Git worktrees with atomic ring lock scoping.

Hardened memfd Lifecycle & Process Snooping Defenses

• Enforced Linux process dumpability restrictions (PR_SET_DUMPABLE=0) on child processes spawned during secret injection to defeat /proc snooping and ptrace inspection.

Fail-Closed Atomic Recovery

• Enhanced write-ahead logging (WAL) and rollback mechanics during interrupted rekey operations.

Full Changelog: v0.2.0...v0.3.0

v0.2.0 - Scoped Recipient Rings, Anonymous memfd Injection & Cache Verification

What's Changed in v0.2.0

Scoped Recipient Rings (--ring)

• Introduced independent access boundaries (e.g. --ring prod, --ring dev) with dedicated master keys, recipient sets, and .gitattributes filter bindings (filter=agecrypt-prod).
• Allows locking, unlocking, enrolling, and rekeying rings completely independently within a single repository.

Anonymous In-Memory Secret Passing (git-agecrypt run --fd)

• Added support for passing decrypted secrets via Linux kernel anonymous RAM descriptors (SYS_memfd_create), bypassing /proc/<pid>/environ inspection.

Cryptographic Cache Authentication

• Hardened HMAC-SHA256 ciphertext caching with authenticated in-RAM decryption before cache hits are accepted, with automatic eviction on corruption and complete cache purge on rekey.

Fail-Closed Durability

• Propagated I/O errors strictly across all filesystem operations, lock journals, and merge targets to prevent silent partial writes.

Full Changelog: v0.1.4...v0.2.0

v0.1.4 - Durability Hardening, Merge Conflict Guards & Documentation Architecture

What's Changed in v0.1.4

Durability & Media Sync Hardening

• Added explicit physical media synchronization (sync_all) before atomic renames in cache persistence, key storage, and merge drivers.
• Introduced dedicated untracked temporary disk spool buffer directory (.git/git-agecrypt/spool) with restricted 0o700 permissions.

Staged Index Integrity Verification

• Extended git-agecrypt check to detect corrupted, truncated, or malformed age ciphertexts staged in the Git index (such as from accidental interactive git add -p).

Merge Conflict Guards

• Hardened 3-way merge driver to detect standard Git conflict markers (<<<<<<<, =======, >>>>>>>) and fail with visible conflict exit codes rather than silently succeeding.

Documentation Disassembly

• Restructured repository documentation by disassembling the monolithic README into dedicated architectures: docs/internals.md and docs/security-model.md.

Full Changelog: v0.1.3...v0.1.4