v0.24.1

v0.24.1 - 2026-11-02

Added

• Zig-specific analysis of the runner's own code, which CodeQL and Semgrep cannot read: ZLint (pinned, checksum-checked) on every pull request ("Lint (ZLint)", with the rules that find bugs, runner/zlint.json); and a nightly analysis workflow that fuzzes each parser in runner/src/fuzz.zig with Zig's coverage-guided fuzzer, now including an image layer's tar, PAX and paths applied beside a directory it must never reach, image references and registry challenges, manifests and minisign signatures (each corpus kept in the Actions cache; a crash, failed check, leak or hang fails the job named after its target, with the input as an artifact), and runs every test under Valgrind's memcheck. zig build test runs the fuzz targets over their seed corpus every time; zig build test -Dllvm --fuzz fuzzes locally.

Fixed

• What ZLint's first run and the new fuzzing found: the database writer went on writing its whole queue after close gave up waiting for it (the cancel was swallowed), so a slow database held the runner's exit for a statement timeout per queued row; a runner held at the memory gate, or backing off after a failed registration, ignored the pool's cancel when another runner could not start, so the runner did not exit; and a workflow command the runner had no memory to carry out (set-output, save-state, set-env, add-path, add-mask, stop-commands) was dropped silently, where it now fails the step. hashFiles() with a pattern whose implicit descendants GitHub refuses (hashFiles('\.'), found by the new fuzzing) crashed the runner, every job on it included; it now fails as GitHub's does ("Relative pathing '.' and '..' is not allowed"). Unused declarations removed.
• The native backend on its first real host (razorbill: a Raspberry Pi with Tailscale): a root runner's jobs had no DNS when the host's resolver is not behind its default route (Tailscale's MagicDNS, 100.100.100.100 through tailscale0), so provisioning failed (Unable to locate package build-essential). Each job now gets a resolv.conf of its own, made from the host's as Docker makes a container's (no loopback or IPv6 nameservers, search domains and options kept, systemd-resolved's upstreams behind its stub, Google's public resolvers when nothing else is left, which "Set up job" then says), and the jobs' firewall lets UDP and TCP to port 53 of those nameservers out of whichever interface the host routes them by, and nothing else there; the rules follow the host's resolver when it changes. Native image pulls failed with HttpConnectionClosing once the process's HTTP client kept a connection Docker Hub had closed after a minute idle: a request on such a connection is now sent again on another, a bounded number of times. And a native set-up that fails before any step (the pull, provisioning, the base, the job's store, cgroup, slot or network) now sends the job to Dagger with the reason in "Set up job", as other unsupported cases do, instead of failing it; a cancelled job does not, and the memory gate measures the job on the engine again.
• The nightly OCI layer fuzz job runs 1M inputs instead of 3M: it took 27 of its 30 minutes as its kept corpus grew, and past 30 minutes zig-fuzz.sh reports a hang.

Security

• The release's binaries are hardened and gated: both are now static position-independent executables (-fPIE, and runner/build.zig's new pie option, on by default, so zig build, the image and the release still make the same binary), which the kernel loads at a random address instead of the fixed 0x1000000, with full RELRO, beside the non-executable stack and W^X segments they had. checksec 3.2 (slimm609/checksec, pinned by version and checksum, .github/scripts/checksec.sh) fails the release, and on pull requests "Release builds" and "Binaries (check)", on any binary without PIE, full RELRO, NX or W^X. A new check, "Release builds and tests (arm64)", builds the release on GitHub's arm64 runner, runs the aarch64 binary and the tests natively there (rootless and as root), so razorbill is no longer the first machine to execute an aarch64 build. PIE costs 0-3% on the runner's hot paths on the laptop (.github/scripts/hotbench.sh: expressions +2.9%, the hashFiles() glob +2.1%, YAML 4.2% faster) and nothing on the test suite (BENCHMARKS.md). Intel CET is not available: Zig 0.17 has no -fcf-protection for Zig code.