Skip to content

v0.2.0 — fail-closed trust

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 13:04
· 190 commits to master since this release
v0.2.0
5bd7b89

Ashlar 0.2.0 — fail-closed trust.

Full notes: CHANGELOG.md, 0.2.0.

Upgrading from 0.1.x — read this first

  • CertificationVerifyOptions.Default and .Strict now fail closed. Both require an Ed25519 signature and a schema floor. A record your 0.1.x deployment produced HMAC-only, or under schema v1, is refused after upgrading. Legacy is the named opt-out and is insecure by design. Requiring a signature is not trusting one: pin TrustedEd25519PublicKeys.
  • Signed gate records (SPEC-006 S-6, S-7). A removed gate-record signature is treated as corruption, and a signed record names the store it belongs to — older readers cannot read it.
  • CLI. Progress and diagnostic markers moved from stdout to stderr. --format-json is refused by commands that have no JSON rendering. rag index requires --sensitivity; rag search without --max-sensitivity searches at Public.
  • API surface. 41 types in Ashlar.Infrastructure, and UnitTestFrameworkBridge, are no longer public.

Security

  • A package could forge a refused admission row into an admitted one through its formatVersion. Fixed; sender-chosen text on refusal lines is now escaped and length-bounded.
  • The mesh serve daemon read .ashpkg files outside the bounded read — an arbitrary file read. Every .ashpkg read path is now bounded, symlinked packages are refused, and one planted file can no longer deny every package in a pkg pull.
  • OutputPathSandboxed approved <root>-evil as inside <root>. Containment is now one helper, Ashlar.Abstractions.Paths.PathContainment.
  • The commercial Fleet.Host served Swagger unauthenticated in every environment. It is now Development-only unless Ashlar__Api__EnableSwagger=true.
  • Missing data-sensitivity information now fails closed: an omitted clearance means the floor, an unlabelled record is the most restrictive, a sanitizer with no filter blocks, and an agent with no exfiltration policy gets the restrictions its level implies.

Artifacts

  • NuGet: 22 Ashlar.* packages at 0.2.0 on nuget.org (Ashlar.Hosting.Bundle is the usual entry point). Each .nupkg is attached with its SHA-256, plus nuget-publish-manifest.json; the release checked the bytes nuget.org serves against that manifest.
  • Images: ghcr.io/ianfrelinger/nexo-cli:0.2.0 (index sha256:56827bbcf74d8bc1a9589915afa6dd822925de411cf27e5a8d662fd8562230c5, linux/amd64 + linux/arm64) and ghcr.io/ianfrelinger/nexo-api:0.2.0 (index sha256:7c0c25c649a63e5577d470f74f67b064f60b754258c8ac003aa187967d090e34).

How this release was verified

  • Rehearsed against the live feed as 0.2.0-rc1 and 0.2.0-rc2; rc2 was built from the release commit itself, and every post-push check passed — including the SHA-256 comparison and restores from nuget.org.
  • The readiness gate reported VERIFIED for release commit 5bd7b893: every platform lane group ran and passed (scripts/release/readiness-verdict-for-sha.sh).
Assets 52
Loading