sealr 0.1.0-alpha.5: bounded immutable input preview

sealr 0.1.0-alpha.5

This fifth development preview closes the bounded immutable input increment planned for Alpha.5. It replaces whole-archive path buffering with a private file-backed snapshot, routes archive work through checked random access, strengthens source-change detection, adds native resource evidence, and defines a bounded capability-oriented worker protocol with pinned fuzzing.

It remains a preview. Sealr still runs parsing and materialization in the caller process, has no enforced worker or process sandbox, does not recognize Python wheels as a consumer type, does not provide stable signed locks, and does not claim production qualification against arbitrary hostile archives.

Highlights

• Successful path ingest opens the caller path once, copies and hashes it under the source cap through a fixed 64 KiB buffer, and retains a Sealr-owned private file. The spool is reopened read-only, its filename is removed, and every later parse, verification, materialization, and VerifiedArchive read uses the retained handle.
• Magic detection, EOCD discovery, central and local metadata, descriptors, covering audit, Store and Deflate verification, and later verified-member reads use checked u64 exact reads or range-limited streams. Central-directory allocation follows the metadata cap, and member payloads are not exposed as whole slices.
• Private-file and borrowed-memory snapshots produce byte-identical IR, findings, preview semantic roots, and verified-member bytes for the same source.
• Required CI applies physically sparse valid 1 MiB and 128 MiB ZIP32 inputs in isolated child processes. It bounds tracked heap allocation, peak resident memory, and both size-related deltas independently of the accepted source size.
• The monthly and manual native matrix applies an exact 3 GiB sparse valid fixture on Ubuntu, macOS, and Windows. The implementation run passed on all three systems.
• The non-published sealr-worker-protocol crate has no dependencies or unsafe. Version 1 uses a fixed 212-byte start frame, a 4 MiB whole-frame cap, out-of-band source and stage capability slots, nonzero operation correlation, canonical result manifests, bounded findings, typed errors, and fallible allocation.
• Protocol regressions cover valid inspect and materialize round trips, complete and rejected results, every truncation point, malformed headers and state, capability and correlation confusion, inconsistent counts, invalid strict-ASCII paths, canonical ordering, and three mutations at every byte position.
• A separately locked libFuzzer target pins nightly-2026-08-01, cargo-fuzz 0.13.2, and libfuzzer-sys 0.4.13. The source-controlled digest manifest binds every seed and dictionary by path, size, and SHA-256. The bounded AddressSanitizer campaign caps input, time, per-input timeout, RSS, jobs, and retained reproducer output.

Security and correctness fixes

• Hostile snapshot ranges are checked in u64 before allocation or platform-size conversion.
• Short positional reads are retried exactly; truncation, growth, interrupted copy, incomplete source, and payload I/O failures remain distinguishable.
• A partial capped copy never receives the digest of a prefix as though it covered the complete source.
• Windows excludes concurrent write sharing while copying the caller source. An existing writer causes admission to fail closed.
• Unix compares device, inode, mode, length, modification time, and change time before and after the copy. Deterministic same-length mutation is rejected as source I/O failure.
• Caller path deletion or replacement cannot redirect later parsing or verified-member reads.
• Snapshot I/O failures during interpretation remain indeterminate rather than being mislabeled as malformed archive syntax. Deflate and later member reads preserve source-I/O identity instead of reporting an integrity disagreement.
• Protocol v1 rejects oversized, truncated, trailing, count-inconsistent, noncanonical, uncorrelated, and semantically incoherent frames before archive or filesystem effect.
• Fuzz dependencies now receive the same cargo-deny and Dependabot review as the shipping workspace. Corpus byte attributes prevent cross-platform line-ending conversion from invalidating seed digests.
• A failed or closed stdout stream no longer prevents the CLI from attempting the independent receipt on stderr. Completed inspection or materialization semantics are preserved, and the process returns an operational failure if either output stream cannot be written.

Resource and fuzz evidence

The required 1 MiB versus 128 MiB resource regression caps tracked heap allocation at 8 MiB and its size-related delta at 1 MiB. It caps absolute peak resident memory at 256 MiB and the size-related delta at 64 MiB. The recorded Windows run used 210,367 tracked heap bytes for both inputs and approximately 7.3 MiB peak resident memory for each.

The exact 3 GiB local Windows probe used 131,072 allocated source bytes and 210,427 tracked heap bytes. The three-platform scheduled matrix passed the same ignored regression on Ubuntu, macOS, and Windows.

The first manually dispatched exact-main protocol campaign executed 18,277,565 units in 601 seconds, averaged 30,411 executions per second, reached 503 MiB peak RSS under the 1,024 MiB limit, and produced no reproducer. Coverage-guided fuzzing is heuristic evidence, not an exhaustive proof of decoder safety.

Verification

The required CI workflow verifies format and workflow syntax, Clippy with warnings denied, debug and release tests, optimized builds, warning-free Rustdoc, documentation and fuzz-manifest contracts, identity conformance, the wheel-report verifier, the extracted-package consumer, native macOS and Windows tests, the i686 Windows ABI, 5,927 ZipDiff constructions, cargo-deny policy for both Cargo graphs, and deterministic third-party license bundles.

Release promotion now requires successful protected-main CI and a successful on-demand protocol-fuzz job on the exact release commit. Release archives contain the native CLI, README, changelog, Apache-2.0 license, and target-specific third-party notices. SHA256SUMS and GitHub build provenance accompany all three native archives.

Protocol v1 is deliberately not the final worker semantic contract. It carries a reduced staged-member manifest, not a complete ArchiveIR, and its single operation status does not preserve every public semantic and effect axis independently. Alpha.6 must resolve IR ownership and revise the protocol or split the operation into explicit phases before process isolation freezes.

Next

Alpha.6 first resolves semantic ownership and outcome-axis transport beyond protocol v1. It then creates the same-binary Linux worker, transfers only immutable source and stage capabilities, validates and closes inherited descriptors, installs a measured no_new_privs and Landlock boundary before the first archive read, treats the worker result as hostile, and keeps staged-tree audit and no-replace publication in the supervisor.