Skip to content

sealr 0.1.0-alpha.3: semantic identity preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 17:13
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.3
c110337
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

sealr 0.1.0-alpha.3

This third development preview gives the ZIP boundary an effect-independent interpretation object and separate semantic identities. It also makes outcome reporting more precise and adds a same-process audit of the staged tree before publication. It is intended for evaluation, development, and adversarial testing. It is not ready to protect a production host from arbitrary hostile archives.

Included

  • Everything in the alpha.2 ZIP32 Store and Deflate boundary, including native no-replace materialization and the deterministic 5,927-case ZipDiff gate.
  • One versioned sealr.archive-ir.v1 built from a named immutable SourceSnapshot. Inspect and materialize consume that IR without reparsing the archive.
  • A codec-free covering audit over the local-record prefix, central directory, EOCD, comment, member headers, payloads, and optional data descriptors.
  • Receipt v2 outcome axes for interpretation, admission, verification, effect, and view completeness. The compatibility verdict remains present, while CLI exit 3 distinguishes an admitted archive whose requested destination effect failed.
  • Typed policy compilation before source ingestion, integer ratio enforcement, checked security counters, and fail-closed reserved fields.
  • Separate source, interpretation-profile, layout, content-tree, and invocation identities. The preview sealrTreeV1 roots have cross-platform golden vectors.
  • A staged-tree audit that streams file hashing through a fixed 64 KiB buffer and verifies exact paths, implicit directories, member sizes, and content digests before publication.
  • Deterministic tests for destination appearance, directory-component substitution, staged-content mutation, malformed directory entries, invalid identity input, and partial-view reporting.
  • A parallel ZipDiff classifier using bounded standard-library threads and optional SEALR_JOBS, with no new runtime dependency.

Compatibility notes

  • Policy.max_ratio is now Option<u64>. Some(100) means 100:1, None disables the ratio check, and Some(0) does not.
  • Receipts use sealr.receipt.v2. The inspectable view retains sealr.view.v1 and now includes the same outcome axes.
  • The CLI exits 0 for admitted inspect or committed materialization, 2 when admission did not succeed, and 3 when admission succeeded but a requested effect failed.
  • Layout and content roots are preview encodings. Consumers must not treat them as stable locks or authenticated claims.

Platform boundary

  • Linux creates mode-0700 stages through retained directory capabilities and publishes with RENAME_NOREPLACE.
  • macOS adds retained-descriptor ACL rejection and publishes with RENAME_EXCL.
  • Windows supports only a non-remote, writable NTFS parent with persistent ACLs, creates a protected effective-TokenUser stage, and publishes through retained handles with no replacement.
  • Other operating systems fail closed for materialization.

Important limitations

  • Only classic ZIP32 with Store and Deflate members is supported. ZIP64, TAR, compressed TAR, gzip, zstd, and 7z are rejected or unsupported.
  • Non-ASCII legacy names fail closed while CP437 decoding and portable Unicode normalization remain unfinished.
  • The compressed archive is buffered in memory within the configured input cap. Expanded members and the staged-tree audit stream through bounded buffers.
  • Reduced-authority process isolation is not implemented. Other processes running as the same user remain outside the containment claim.
  • Crash recovery, directory syncing, and power-loss durability are not implemented. The default policy is flush-only.
  • Receipts and tree roots are unsigned. Receipt JSON is not yet canonicalized with RFC 8785 JCS.
  • There is no external security audit or stable compatibility promise.

Read README.md, SECURITY.md, and ROADMAP.md from this tagged revision for the complete boundary and release status.

Verify an archive

Download the native archive for your platform and SHA256SUMS from this release, then verify its SHA-256 digest. Runnable platform-specific commands are in docs/release-verification.md at this tag.

GitHub also records build provenance for every native archive. With a current GitHub CLI:

gh attestation verify sealr-0.1.0-alpha.3-NATIVE-TARGET.ARCHIVE-EXTENSION --repo blisspixel/sealr

Provenance links an archive to its source commit and release workflow. It is not a claim that the program is free of vulnerabilities.

The published prerelease is immutable and carries GitHub's release attestation. Verify it with:

gh release verify v0.1.0-alpha.3 --repo blisspixel/sealr
Assets 7
Loading