Skip to content

sealr 0.1.0-alpha.1: ZIP boundary preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 03:22
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.1
78c407a

sealr 0.1.0-alpha.1

This is the first public development preview of sealr's ZIP boundary. It is intended for evaluation, development, and adversarial testing. It is not ready to protect a production host from arbitrary hostile archives.

Included

  • Classic ZIP32 inspection for Store and Deflate members.
  • Exact agreement checks across central-directory, local-header, end-of-central-directory, and data-descriptor structures.
  • Fail-closed path, topology, quota, encryption, layout, overlap, and ambiguity handling.
  • Per-component no-follow staged materialization with native no-replace publication, atomic Windows stage acquisition, and fail-closed Unix parent checks.
  • Structured allow and reject views plus unsigned receipts that bind source, policy, view, tool, environment, and materialization evidence.
  • A deterministic public CI gate over all 5,927 pinned ZipDiff constructions and 14 ambiguity classes.
  • Native preview archives built and tested on standard GitHub-hosted Ubuntu, Windows, and macOS runners.

Important limitations

  • Only classic ZIP32 with Store and Deflate members is supported. ZIP64, TAR, compressed TAR, gzip, zstd, and 7z are rejected or unsupported.
  • Non-ASCII legacy names fail closed while CP437 decoding and portable Unicode normalization remain unfinished.
  • The compressed archive is buffered in memory within the configured input cap. Expanded members stream.
  • Reduced-authority process isolation is not implemented.
  • The materialization destination parent must already exist. Unix support requires trusted owner, mode, sticky semantics, and on Apple platforms no extended ACL. Richer filesystem ACL semantics are not yet supported.
  • Windows stage creation and publication retain the relevant directory handles, but the stage inherits its parent's ACL. Any principal granted child-mutation rights by that DACL can alter staged content. Callers need a restrictive parent until a private ACL and reduced-authority worker are implemented.
  • Receipts are unsigned and are not yet canonicalized with RFC 8785 JCS.
  • There is no external security audit or stable compatibility promise.

Read README.md, SECURITY.md, and ROADMAP.md from this tagged revision for the complete boundary and release status.

Verify an archive

Download the native archive for your platform and SHA256SUMS from this release, then verify its SHA-256 digest.

On Linux:

sha256sum --check --ignore-missing SHA256SUMS

On macOS:

shasum --algorithm 256 --check SHA256SUMS

On Windows PowerShell:

$expected = (Select-String -Path SHA256SUMS -Pattern 'sealr-.*-windows-.*\.zip$').Line.Split(' ')[0]
$archive = Get-ChildItem -File 'sealr-*-windows-*.zip' | Select-Object -First 1
$actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $archive.FullName).Hash.ToLowerInvariant()
if ($actual -ne $expected) { throw 'SHA-256 verification failed' }

GitHub also records build provenance for every native archive. With a current GitHub CLI:

gh attestation verify sealr-0.1.0-alpha.1-NATIVE-TARGET.ARCHIVE-EXTENSION --repo blisspixel/sealr

Provenance links an archive to its source commit and release workflow. It is not a claim that the program is free of vulnerabilities.

The published prerelease is immutable and carries GitHub's release attestation. Verify it with:

gh release verify v0.1.0-alpha.1 --repo blisspixel/sealr
Assets 7
Loading