v0.1.2

• Release pipeline: .github/workflows/release.yml builds x86_64 and
  aarch64 Linux binaries on GitHub's runners, runs the full test suite on
  each, and publishes them with an OpenSSH-signed MANIFEST.txt (Ed25519,
  public key in release-signing-key.pub / allowed_signers), a CycloneDX
  1.5 SBOM per binary, an OpenVEX document and the verifier script. cargo audit --deny warnings gates the release. Verify steps in RELEASING.md.
• No tracer or verifier changes.

Verify

Every asset is listed with its SHA-256 in MANIFEST.txt, and the manifest is signed
with the Ed25519 key in release-signing-key.pub (OpenSSH signature, namespace file).
From a clone of this repository, with the assets downloaded into release/:

ssh-keygen -Y verify -f allowed_signers -I effect-tracer-release -n file \
  -s release/MANIFEST.txt.sig < release/MANIFEST.txt
(cd release && sha256sum --ignore-missing -c MANIFEST.txt)

Details, including the key fingerprint, in RELEASING.md.

Assets

0fdfea38de4bc273eef61a0bcf95d2e94b6388a20afa5997d8f5c6d08a626775  allowed_signers
8903e324b3b31fc3356fc44598f995971f8e30e00336dfdb5edf99418d886d09  effect-tracer-v0.1.2-aarch64-unknown-linux-gnu.cdx.json
180e55832c7f5570ee0924e4012eb8d03ec742861508fa09f715d08cdf784d89  effect-tracer-v0.1.2-aarch64-unknown-linux-gnu.tar.gz
58fd549240d4351530046a6923d22a4b155dbcebfd797a5edd3c32eab5cb6a6b  effect-tracer-v0.1.2-x86_64-unknown-linux-gnu.cdx.json
b8323df9863eda11d9c6da77694fb5e1cf3da3ddee7fa595608b42724d349622  effect-tracer-v0.1.2-x86_64-unknown-linux-gnu.tar.gz
f0fb3750691414c0c9fe3046ea1aefd07072878289a98c28e49e65a993b7f13a  release-signing-key.pub
3b55e0f20153b4fc8f07a2a21f7977af11beb0f869b0fc412cc2c62e4aebde35  verify_ledger.py
a5f8336c3bc72a5e5207ffe6907be52a935a1cdc14eb18e48aeb4178800f9e41  vex.openvex.json

v0.1.1: netlink sockets are named, not a coverage gap

Bug fix release.

• Fixed: glibc's getaddrinfo opens socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) to list interfaces. v0.1.0 treated every SOCK_RAW socket as a raw-socket coverage.gap, so any traced program that resolved a hostname through glibc ended with coverage partial and verifier exit 3. Such sockets are now socket.netlink events named by protocol family (route), with detail.protocol; netlink addresses render as netlink instead of af16. Raw and packet sockets are still gaps. Integration test added.
• Added: an animated terminal demo in the README, recorded from a real run in an arm64 Debian container, with the exact transcript in assets/demo-transcript.txt.
• Added: SECURITY.md with private vulnerability reporting.
• Docs: CI sentence brought up to date (the workflow runs on GitHub's ubuntu-24.04 runners); the eBPF roadmap entry points at the m3-ebpf branch; changelog section.

Install: cargo install --git https://github.com/YusefSyed/effect-tracer --tag v0.1.1 --locked

v0.1.0: ptrace backend, signed ledger, stdlib verifier

First release.

• Tracer (Rust, ptrace): records a Linux process tree's file writes, creates, deletes, renames, links, metadata changes, shared writable mmaps, socket connects, binds, listens, sends, DNS questions, execs, forks and exits into events.jsonl, one canonical JSON line per event, each chained by SHA-256 to the previous one.
• Two modes: --mode full stops at every syscall; --mode seccomp traps only the effect syscalls (1.2x to 1.7x overhead on the four benchmark workloads, against 5x to 311x for full ptrace).
• Signed checkpoint (Ed25519) over the chain head; coverage verdict (complete, partial, failed) recorded inside the chain with every reason.
• verifier/verify_ledger.py: 300-line standard-library Python verifier with its own Ed25519, exit codes 0 intact, 1 tampered, 2 unreadable, 3 intact but incomplete coverage; tamper suite covers edit, delete, insert, reorder, truncate and re-signing with a foreign key.
• Benchmarks in bench/: 20 of 20 seeded bypasses caught in full mode (19 of 20 in seccomp mode, where io_uring is denied but not logged), 0 undeclared events over 30 clean runs of a toy agent, overhead tables. All published runs are aarch64 Linux in a container.
• Known limits are listed in the README (mmap stores, mount namespaces, inbound connections, fd passing, xattrs, DNS over TCP).

Install: cargo install --git https://github.com/YusefSyed/effect-tracer --tag v0.1.0 --locked