Skip to content

sealr 0.1.0-alpha.2: hardened materialization preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 16:40
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.2
d29b857
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

sealr 0.1.0-alpha.2

This second development preview strengthens staged materialization and its evidence on Windows while preserving the native Linux and macOS boundaries. It is intended for evaluation, development, and adversarial testing. It is not ready to protect a production host from arbitrary hostile archives.

Included

  • Everything in the first ZIP32 Store and Deflate preview, including the deterministic 5,927-case ZipDiff gate.
  • Exact single-stream DEFLATE consumption. Trailing bytes, concatenated streams, and invalid stream syntax fail with dedicated codec findings.
  • Windows parent admission limited to non-remote, writable NTFS volumes that report persistent ACL support.
  • Atomic Windows stage creation with the effective token user as object owner and one protected inheritable allow ACE for that SID.
  • Handle-based verification of the stage owner and exact DACL before member writes, plus native tests of descendant DACL inheritance.
  • Retained-handle cleanup on setup failure and native no-replace publication on Linux, macOS, and Windows.
  • Materialization receipt v2 with explicit, non-sensitive Windows storage and stage-ACL evidence.
  • Dedicated findings for unsupported Windows filesystems and unverified stage security.
  • Documentation contract checks for local links, finding codes, materialization primitives, version metadata, and licensing.
  • Apache-2.0 licensing for this release and later contributions.
  • Target-specific third-party license bundles generated from the locked Linux, macOS, and Windows release dependency graphs and verified before packaging.

Platform boundary

  • Linux creates mode-0700 stages through retained directory capabilities and publishes with RENAME_NOREPLACE.
  • macOS adds retained-descriptor ACL rejection and publishes with RENAME_EXCL.
  • Windows supports only a non-remote, writable NTFS parent with persistent ACLs. ReFS, FAT-family filesystems, remote shares, read-only volumes, and ambiguous volume queries fail closed before staging.
  • Other operating systems fail closed for materialization.

Important limitations

  • Only classic ZIP32 with Store and Deflate members is supported. ZIP64, TAR, compressed TAR, gzip, zstd, and 7z are rejected or unsupported.
  • Non-ASCII legacy names fail closed while CP437 decoding and portable Unicode normalization remain unfinished.
  • The compressed archive is buffered in memory within the configured input cap. Expanded members stream.
  • Reduced-authority process isolation is not implemented. Other processes running as the same user remain outside the containment claim.
  • Crash recovery, directory syncing, and power-loss durability are not implemented. The default policy is flush-only.
  • Receipts are unsigned and are not yet canonicalized with RFC 8785 JCS.
  • There is no external security audit or stable compatibility promise.

Read README.md, SECURITY.md, and ROADMAP.md from this tagged revision for the complete boundary and release status.

Verify an archive

Download the native archive for your platform and SHA256SUMS from this release, then verify its SHA-256 digest.

On Linux:

sha256sum --check --ignore-missing SHA256SUMS

On macOS:

shasum --algorithm 256 --check SHA256SUMS

On Windows PowerShell:

$expected = (Select-String -Path SHA256SUMS -Pattern 'sealr-.*-windows-.*\.zip$').Line.Split(' ')[0]
$archive = Get-ChildItem -File 'sealr-*-windows-*.zip' | Select-Object -First 1
$actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $archive.FullName).Hash.ToLowerInvariant()
if ($actual -ne $expected) { throw 'SHA-256 verification failed' }

GitHub also records build provenance for every native archive. With a current GitHub CLI:

gh attestation verify sealr-0.1.0-alpha.2-NATIVE-TARGET.ARCHIVE-EXTENSION --repo blisspixel/sealr

Provenance links an archive to its source commit and release workflow. It is not a claim that the program is free of vulnerabilities.

The published prerelease is immutable and carries GitHub's release attestation. Verify it with:

gh release verify v0.1.0-alpha.2 --repo blisspixel/sealr
Assets 7
Loading