Skip to content

dcg v0.7.7 — fail-closed absolute hook paths

Choose a tag to compare

View all tags
@Dicklesworthstone Dicklesworthstone released this 29 Jul 03:32
v0.7.7
f46c6c2

Fail-closed absolute hook paths

v0.7.7 fixes the PATH-dependent hook registration reported in #240. Earlier
installations could register a bare dcg command that an interactive shell
could find but a noninteractive agent hook could not, silently leaving the
agent unguarded.

Built from annotated tag v0.7.7 at immutable source commit
f46c6c2f26af6f9ffad8459770b8d5798b7fe8fb.

Security fix

  • dcg install, dcg setup, and self-heal now register the resolved absolute
    path of the running dcg executable for Claude Code, Grok, and Antigravity.
  • Unix shell paths are safely quoted, including spaces and shell
    metacharacters. Windows hook commands use PowerShell's call operator and
    safely quote apostrophes in executable paths.
  • Existing bare or stale dcg entries are migrated in place while unrelated
    coexisting hooks are preserved.
  • Executable-resolution and non-UTF-8 path failures now fail closed instead of
    falling back to a hook that may not execute.
  • dcg doctor identifies PATH-dependent hooks as broken and repairs them with
    dcg doctor --fix.

Regression coverage includes clean/restricted-PATH hook execution for both safe
and destructive commands, migration/idempotency, coexisting hooks, Unix special
paths, and native Windows command rendering.

Platform archives

  • Linux x86_64: static PIE using musl
  • Linux ARM64: glibc-compatible through GLIBC 2.17
  • macOS x86_64
  • macOS Apple Silicon
  • Windows x86_64
  • Windows ARM64

The macOS binaries are signed with Developer ID Application: Jeffrey Emanuel (AU8V2Z6NKY), hardened runtime, and secure timestamps. Apple notarization
accepted both submissions with zero issues:

  • ARM64: 27f3d3ad-1a72-4d48-9d1f-90f9724a1f01
  • x86_64: 489c9cf6-07c7-485f-a0b9-634d7f2e4377

Supply-chain verification

Every platform archive includes:

  • a mandatory SHA-256 sidecar;
  • a Minisign signature under key ID 69B3955C8D2E62A8;
  • a Sigstore/cosign bundle under the published local-release key;
  • an in-toto SLSA provenance statement, independently Minisign- and
    cosign-signed.

The cosign public-key DER SHA-256 fingerprint is
0e6947743daf39d6413cb25f6c96601427e38885f3a756e9f98f37d66e6df7a4.
The aggregate SHA256SUMS file and both installer scripts are signed through
both trust paths.

Build provenance and verification

GitHub-hosted runners remained unavailable because of the documented
account-wide scheduling backlog, so this release used the repository's
fail-closed local DSR process. Windows and macOS builds ran in isolated
staged-source environments; Linux artifacts came from a separate clean checkout
of the same exact tag.

  • Full Rust format, check, Clippy, unit, integration, doctest, Windows
    cross-check, 374-case shell E2E, and installer/doctor E2E gates
  • Architecture and archive round-trip checks for all six binaries
  • Linux ARM64 symbol audit proving maximum imported version GLIBC 2.17
  • Native macOS ARM64 and Rosetta x86_64 signature, version, safe-command, and
    destructive-command smoke before packaging
  • Offline checksum, Minisign, cosign, and SLSA verification of the complete
    62-file release set
  • Tampered-artifact negative tests proving all four verification paths reject
    modified bytes
Assets 64
Loading