v0.5.0

What's Changed

• fix(spawn): resolve executables from PATH, never the current directory by @bindreams in #137
• fix(elevation): refuse an interior NUL instead of letting Win32 truncate it by @bindreams in #148
• ci: run a Windows canary on the path facts the batch gate models by @bindreams in #159
• test(resolve): stop mutating the shared test process's cwd by @bindreams in #164
• ci: lint cfg(windows) code with clippy by @bindreams in #161
• ci: turn on feature-powerset clippy for Lint and darwin/arm64 by @bindreams in #163
• fix(windows_raw): compare env keys as Windows and std do by @bindreams in #162
• feat(command): add raw_executable and distinguish it from executable by @bindreams in #138
• test(windows_raw): prove an argv-only fd>=3 command reaches the raw backend by @bindreams in #166
• feat(containment): report which cgroup setup step failed when containment degrades by @bindreams in #155
• fix(spawn): refuse every spelling Windows resolves to a .bat or .cmd by @bindreams in #146
• fix(resolve): classify, join and complete Windows paths by one rule, and run a raw spawn in one effective cwd by @bindreams in #173
• feat(elevation): run pkexec with --keep-cwd, refusing one not shown to be polkit 121 or later, and run0 with -D . by @bindreams in #170
• ci: run the test suite with cargo-nextest by @bindreams in #179
• fix(child): kill_on_drop(false) and detach must both stop the containment resource killing the tree by @bindreams in #157
• feat(dev): add devvm.py, throwaway VM provisioning for local system-affecting tests by @bindreams in #169
• fix(child): stop searching the app directory when resolving a bare Windows program name by @bindreams in #183
• test(windows): add dispatch-only ShellExecuteEx and elevation-route probes by @bindreams in #160
• fix(child): own fd-mapping pre_exec; refuse out-of-range and negative fds (I14) by @bindreams in #191
• fix(containment): wait for the leaf to drain after an explicit kill_tree() before rmdir by @bindreams in #195
• test(fd_map): rename self-mapping test to what it actually observes by @bindreams in #198
• test: read/close runtime-chosen fds portably so dash accepts fd >= 10 by @bindreams in #197
• test(cgroup): make the overflow test's disk use independent of the host's max_queued_events by @bindreams in #203
• test(resolve): prove the Windows fail-closed search against a real ACL by @bindreams in #206
• fix: stop deduplicating degrade and abandoned-spawn log lines by @bindreams in #217
• fix(test): create leaf_tests's terminate-survivor pipe with std::io::pipe by @bindreams in #216
• docs: state cosca's design principles by @bindreams in #209
• fix(test): guard fork_running's child with a pidfd-based KillOnDrop by @bindreams in #205
• docs(principles): state how conditional tests are enabled and consented by @bindreams in #236
• fix(cgroup): wait on the caller's deadline, not a precomputed duration by @bindreams in #231
• build(clippy): forbid libc::pipe in favour of close-on-exec pipes by @bindreams in #238
• fix(test): open the elevation pty probe's fds close-on-exec by @bindreams in #244
• fix(test): wire the remaining fork_running callers into the guard's protection by @bindreams in #208
• test(marker_eof): prove deadline and no-spin properties structurally by @bindreams in #240
• test(graceful): prove the TreeWalk fast path grants no grace window once the backend has reaped by @bindreams in #239
• test(cgroup): prove wait_drained's wait at its own wait site, sync and async by @bindreams in #207
• docs: state the deadline contract by @bindreams in #233
• test(marker_eof): prove the low-water-clamp precondition instead of racing a timeout by @bindreams in #215
• fix(wait): never report a Windows deadline expired before it truly has by @bindreams in #246
• fix(tokio,child): log a warning when a failed password write's tree teardown fails by @bindreams in #251
• test: replace timed-lifetime fixtures with fixtures that block until killed by @bindreams in #213
• fix(wait): arm timeout_at with the caller's deadline instant, not a precomputed duration by @bindreams in #249
• fix(child): warn instead of debug_assert on a real teardown-mechanism failure in Drop by @bindreams in #268
• fix(test): make fork_running take spawn_lock across its fork by @bindreams in #250
• fix(wait): report a reaped process-group leader as exited on Linux < 6.16 by @bindreams in #258
• fix(tokio): warn instead of debug_assert when a parent pipe end fails tokio conversion by @bindreams in #283
• fix(test): drop outer spawn_lock around fork_running (re-entry deadlock) by @bindreams in #314
• test(resolve): make the undeterminable-candidate fixture uid-independent by @bindreams in #200
• fix(child): recheck the real deadline before trusting a std-backend wait_deadline None by @bindreams in #265
• fix(test): stop spawn_control's accept from hanging forever if the target dies first by @bindreams in #232
• test: make the tree-kill tests independent of the host's uid and cgroup by @bindreams in #306
• fix(test): kill-then-block RAII seams so fail_closed/end_child/reap_unadopted no-kill mutants fail fast by @bindreams in #267
• ci: add a root and capability-drop lane for resolve_base_tests/exact_posix_tests by @bindreams in #218
• fix(wait): arm grace_wait's Windows watch from a deadline captured before spawn_blocking by @bindreams in #245
• test(windows_raw): end the runas teardown tests' child by a real kill, not a ping timer by @bindreams in #287
• fix(wait): verify /proc describes the target's pid namespace before trusting a bare-pid read by @bindreams in #261
• build(clippy): ban raw tokio timers so every async deadline goes through arm_at by @bindreams in #333
• test(wait): fail a frozen-clock re-arm with no advance in all three re-arm loops by @bindreams in #313
• fix(test): watch the child's death in testbin's own ack accepts by @bindreams in #303
• fix(test): replace the remaining sleep/ping fixtures with held-stdin blockers whose kill is asserted by @bindreams in #278
• fix(cgroup): read a spawned child's state only through the checked /proc view by @bindreams in #329
• fix(cgroup): read a leaf member's cgroup only through a checked /proc dirfd by @bindreams in #262
• test: convert the remaining hang-as-detector tests to fail fast by @bindreams in #292
• test(tokio): fix a stale ping comment and assert the identity-mismatch child stays alive by @bindreams in #340
• test(macos): add a tested debugger-helper for tracer tests by @bindreams in #310
• fix(test): make fault_observer thread-local, relayed across spawn_blocking by @bindreams in #264
• test: take spawn_lock around every raw std/tokio spawn in the lib tests by @bindreams in #286
• test: enforce the no-chdir rule with clippy disallowed-methods instead of a text guard by @bindreams in #175
• docs: state the Linux platform requirements (5.6, pidfd) by @bindreams in #336
• test(elevation): prove payload death by socket EOF instead of a timed sleep or pid tracking by @bindreams in #214
• ci: fall back to an uncached build when the sccache backend fails by @bindreams in #369
• test(fd_map): run the fd-2-closing tests in a process of their own by @bindreams in #304
• docs(clippy): state that the bans guard against accidents, not local FFI declarations by @bindreams in #385
• fix(wait): clamp macOS kevent timeouts so a far deadline does not fail with EINVAL by @bindreams in #368
• test: contain the report-then-exit trees so their orphaned grandchild cannot LEAK by @bindreams in #370
• fix(identity): read a pid's start token and liveness only through the checked /proc view by @bindreams in #325
• fix(wait): answer Unsupported when pidfd_open is refused with EPERM or ENODEV by @bindreams in #337
• refactor(test): one generic relayed probe behind armed_probe, read_probe and fault_observer by @bindreams in #362
• test(spawn_io,tokio_io): run the fd- and rlimit-mutating tests in a process of their own by @bindreams in #305
• fix(group): list a process group only from the checked /proc view by @bindreams in #326
• fix(containment): resume a Windows child's initial threads only after proving they are its own by @bindreams in #408
• test(fd_map): make the below-fd-3 relocation test fail fast instead of hanging by @bindreams in #338
• ci: run plain cargo test on Linux and macOS by @bindreams in #339
• test: one consent-gated setuid group, run in the Linux and macOS root lanes by @bindreams in #423
• fix(enumerate): snapshot processes only from the checked /proc view by @bindreams in #328
• fix(child): skip kills named by the root's number in Drop once it is reaped, and warn by @bindreams in #384
• test(process): migrate to the skuld harness by @bindreams in #211
• ci: bound hangs per step, fail on leaked processes, and print the process table on failure by @bindreams in #427
• refactor(tokio)!: remove the reaper pool so async Child::drop does bounded work only by @bindreams in #343
• build: bump skuld to 0.5.0 by @bindreams in #439
• fix(test): the tracer never loops forever on a lost PT_CONTINUE at S4 by @bindreams in #411
• test(process): redesign foreign_kill_surfaces_permission_denied as a root-precondition skuld test by @bindreams in #204
• refactor(child): replace shared_child with cosca's own SharedChild by @bindreams in #344
• test(macos): arm NOTE_EXIT before the far-timeout probe's child can exit by @bindreams in #444
• test(macos): narrow the tracer helper to a debugger's contract and assert its preconditions by @bindreams in #377
• build: add Renovate config and pin GitHub Actions by digest by @bindreams in #436
• test(child): SharedChild against a child this process traces by @bindreams in #346
• build: depend on skuld 0.6.0 by @bindreams in #454
• fix(cgroup): let the cmsg length casts follow the target's field types so musl builds by @bindreams in #452
• test(child): SharedChild against a child traced by a non-parent process, Linux by @bindreams in #448
• fix(test): pass variadic ptrace and prctl args at full width by @bindreams in #453
• test(cgroup): stop fixture_leaf_no_proc leaking a directory per run by @bindreams in #473
• test: give every identity-changing re-exec a writable skuld DB directory by @bindreams in #461
• test: build every re-exec'd test child through one scrubbing builder, with --nocapture by @bindreams in #460
• ci: bump cargo-nextest to 0.9.146 so concurrent macOS spawns stop inheriting capture pipes by @bindreams in #485
• fix(test): hold the frozen clock in the macOS await_reapable deadline tests by @bindreams in #490
• test(identity): find the record helper's marker wherever libtest's banner leaves it by @bindreams in #471
• test: replace every #[ignore] with a COSCA_TEST_ gate by @bindreams in #480
• fix(test): convert the remaining accept() call sites to accept_or_die by @bindreams in #256
• chore: add the skuld-rewrite migration tool (plan E, unit W) by @bindreams in #458
• fix(test): let the death-watch harness see a target's exit without reaping it by @bindreams in #477
• refactor: use rustix's typed fcntl, ioctl, prctl and pidfd_open wrappers by @bindreams in #475
• fix(spawn): never leave a Linux child without a pidfd (pre-fork probe and pre_exec handshake) by @bindreams in #389
• ci: add a guard against libtest test attributes, with a self-test by @bindreams in #457
• refactor(spawn): rustix typed calls in the pidfd handshake child by @bindreams in #496
• fix(test): clippy::unnecessary_cast on aarch64 Linux in test_stdio_tests by @bindreams in #498
• fix(tracer): take an exiting tracee's stop record for its kill by @bindreams in #465
• fix(testbin): connect the grandchild pid report before spawning the grandchild by @bindreams in #499
• fix(spawn): the sync finish_elevated does not claim a kill of a child it never signalled by @bindreams in #508
• fix(spawn): leave a child alone when macOS cannot read its identity by @bindreams in #502
• fix(tokio): keep the child's pidfd and send kill through it by @bindreams in #420
• ci: pin the disallowed-methods fixture lockfile and show its compile errors by @bindreams in #515
• ci: run tests with nextest only and keep JUnit results by @bindreams in #455
• fix(tokio): reap the child through its pidfd and forget it after a foreign reap by @bindreams in #424
• feat(devvm): add a Tart-based macos-arm64 guest by @bindreams in #493
• test: run the lib's tests under skuld (plan E, P1) by @bindreams in #517
• test(quote,resolve): spell skuld tests as #[skuld::test] (plan E, L1) by @bindreams in #522
• test(lib): spell skuld tests as #[skuld::test] (plan E, L3) by @bindreams in #523
• test(elevation,identity): spell skuld tests as #[skuld::test] (plan E, L2) by @bindreams in #524
• test(wait): spell skuld tests as #[skuld::test] (plan E, L5) by @bindreams in #528
• fix(child): read the root's own reap from the handle's locked state (plan A, A0) by @bindreams in #519
• test(test_support): spell skuld tests as #[skuld::test] (plan E, L4) by @bindreams in #527
• test: check re-exec'd children through skuld's JSON suite events (plan E, P2) by @bindreams in #521
• test(containment): spell skuld tests as #[skuld::test] (plan E, L6) by @bindreams in #529
• test(windows targets): run under skuld (plan E, T2) by @bindreams in #533
• test(block_on_socket, elevation, graceful, ...): run under skuld (plan E, T1) by @bindreams in #535
• test(lifecycle, linux_pidfd_refused): run under skuld (plan E, T4) by @bindreams in #538
• test(child): spell skuld tests as #[skuld::test] (plan E, L7) by @bindreams in #530
• fix(ci): wake the forwarder tests' commands through the signal wakeup fd by @bindreams in #542
• test(namespaces): one group declaration, selected by label (plan E, K1) by @bindreams in #543
• ci: type-check, not build, the libtest guard's test targets by @bindreams in #545
• test(drive_mapping): one group declaration, selected by label (plan E, K5) by @bindreams in #547
• test(group_teardown_setuid, linux_pidfd_wait, macos_fdmarker, ...): run under skuld (plan E, T3) by @bindreams in #540
• fix(spawn): read the spawn-time identity under the child's own handle (plan A, A1c1) by @bindreams in #531
• test(setuid): one group declaration, selected by label by @bindreams in #559
• test(root): one group declaration, selected by label by @bindreams in #549
• test(tokio): spell skuld tests as #[skuld::test] (plan E, L8) by @bindreams in #560
• test(spawn_io, tokio_io, tokio_control): run under skuld (plan E, T5) by @bindreams in #558
• test(tokio): keep cat alive through the stdin-close test's one wait poll by @bindreams in #567
• ci: run the libtest guard in each Test job by @bindreams in #555
• test(windows probes): one group declaration each, selected by label (plan E, K6) by @bindreams in #550
• refactor(spawn): share the pre_exec fd-channel skeleton between hooks (plan A, A1c1b prep) by @bindreams in #568
• test(cgroup): one group declaration each, selected by label by @bindreams in #573
• test: drop the test of the test-enablement helper and use the lib's check_group (plan E, T6) by @bindreams in #571
• test: drop the macro_use nets by @bindreams in #583
• test(tracer, uid_switch): one group declaration each, selected by label by @bindreams in #582
• docs: describe the skuld harness, labels and the libtest guard by @bindreams in #587
• fix(spawn): the child reports its own unique id before exec on macOS (plan A, A1c1b) by @bindreams in #539
• feat(elevation): the elevation shim's wire protocol by @bindreams in #599
• feat(elevation): compute the shim-wrapped elevated argv (F7) by @bindreams in #603
• fix(elevation): kill() on an uncontained wrapper-elevated child is Unkillable, not Ok (part of #14) by @bindreams in #580
• fix(spawn): attach the tree with the identity read under the child's handle by @bindreams in #600
• fix(cgroup): wait for the placement verdict on the child's own pidfd by @bindreams in #611
• test(elevation): one group declaration, selected by label, with lanes that elevate by @bindreams in #552
• feat(elevation): a private directory for the shim channel (plan F, F2) by @bindreams in #598
• feat(elevation): cosca's end of the elevation shim channel (plan F, F3) by @bindreams in #607
• feat(elevation)!: remove the run0 backend by @bindreams in #614
• fix(elevation): kill a contained elevation front through its cgroup (part of #14) by @bindreams in #595
• feat(spawn)!: a spawn error says whether the program may have started, and what became of the child (closes #142) by @bindreams in #613
• build: publish 0.5.0 to crates.io by @bindreams in #628

Full Changelog: v0.4.0...v0.5.0