Skip to content

v0.9.0

Latest
Latest

Choose a tag to compare

View all tags
@ErenAri ErenAri released this 03 Jul 13:04
v0.9.0
dcd6128
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cross-kernel enforcement hardening, on-hardware trust evidence, and supply-chain CI hygiene — 146 commits since v0.8.0.

Fixed — Cross-kernel enforcement

  • Starts and enforces on kernels < 6.1 (#265) — the verifier-gated handle_exit tracepoint was aborting all enforcement on 5.4/5.10/5.15; the attach now honors the autoload gate.
  • Resilient BPF object load (#266) — a single verifier-fragile optional hook can no longer take down core enforcement.
  • handle_inode_copy_up verifies on all kernels (#267) — fixed a non-monotonic 6.8 verifier rejection via the barrier_var() + clamp idiom, restoring overlay copy-up enforcement with zero degradation.
  • Net: clean load + enforcement across the 5.15 → 6.17 LTS range.

Added — Trust evidence (reproducible, on-hardware)

  • Free cross-kernel enforcement matrix (5.15/6.1/6.8/6.17 via qemu/KVM) (#265).
  • Red-team alternate-read-path battery — io_uring / open_by_handle_at / openat2 (#263).
  • Backpressure-saturation battery — enforcement holds when telemetry drops (#264).
  • Enforcement-grade canary + red-team soak evidence (#241, #242).
  • Pilot evidence contract + validation test (#252).

Added — Security posture & CI supply-chain hardening

  • Least-privilege GITHUB_TOKEN across all workflows (#268) — cleared all OSSF Scorecard Token-Permissions alerts.
  • Future-LSM / next-gen BPF posture (#245); trusted-key-lookup hardening (#243); default-off policy authoritative mode (#240).
  • KPI-threshold, degraded-mode, rollback-failure, and e2e-matrix coverage contracts.
  • ~20 pinned GitHub Action dependency bumps.

Changed — Docs

  • Categorized documentation index (docs/README.md) + docs-tree consolidation (#271).

Note on artifacts: this release was published directly from the tag. The signed release pipeline (release.yml) — Sigstore signatures, SBOM, build-provenance attestations, .deb/.rpm, and the GHCR image — runs on self-hosted bpf-lsm/perf runners, which were offline at tag time. Re-run the Release workflow for v0.9.0 once those runners are online to attach signed artifacts.

Full changelog: v0.8.0...v0.9.0

Assets 2
Loading