Skip to content

v2.3.5 - CI/CD Stability & Security Hardening

Choose a tag to compare

View all tags
@doublegate doublegate released this 31 Jan 08:53
· 49 commits to main since this release
v2.3.5
1b14cf0

v2.3.5 - CI/CD Stability & Security Hardening

Patch release focused on CI/CD pipeline reliability, security hardening from CodeQL analysis, documentation updates, and a new ROE signing tool.

CI/CD Pipeline Fixes

  • docs.yml: Replaced deprecated lychee --exclude-mail flag with --exclude '^mailto:', fixing documentation link-checking workflow failures
  • wraith-crypto/src/ratchet.rs: Fixed clippy collapsible_if warning that caused CI lint failures
  • wraith-core transfer/session.rs: Fixed unclosed HTML tags in doc comments that broke cargo doc builds
  • wraith-files chunker.rs: Fixed unclosed HTML tags in doc comments that broke cargo doc builds
  • wraith-crypto/src/ratchet.rs: Added missing key_commitment field in test struct initialization
  • wraith-crypto/src/elligator.rs: Increased timing test tolerance from 75% to 100% for CI stability on variable-speed runners
  • Cargo.toml: Excluded fuzz directory from workspace members, fixing Fuzz workflow build failures

Security Hardening (PR #57, PR #60)

  • Resolved 58 CodeQL code scanning alerts across the entire codebase
  • Added SAFETY documentation for all FFI pointer access patterns in wraith-ffi, satisfying CodeQL unsafe code audit requirements
  • Eliminated cleartext logging of sensitive peer IDs in wraith-cli (replaced with truncated hashes)
  • Added security annotations for cryptographic test vectors to suppress false-positive "hardcoded credential" alerts
  • 49 remaining false-positive alerts dismissed via GitHub API with documented justifications

Documentation

  • Benchmark Analysis v2.3.4 (docs/testing/BENCHMARK-ANALYSIS-v2.3.4.md): Comprehensive criterion-based performance analysis with optimization proposals
  • RedOps Gap Analysis v8.0.0 (docs/clients/wraith-redops/GAP-ANALYSIS-v2.3.4.md): Updated audit confirming Operator Client frontend expansion (1,558 to 3,608 lines, 13 to 27 files, 33 typed IPC wrappers)
  • Raw Benchmark Data: Archived full criterion output for wraith-core, wraith-crypto, wraith-files, and wraith-obfuscation

ROE Signer Tool

  • New tool (tools/roe-signer/): Standalone Ed25519 signing utility for WRAITH-Recon Rules of Engagement JSON documents
  • Supports keygen, sign, and verify subcommands
  • Replicates the exact signing_data() byte layout from wraith-recon for guaranteed signature compatibility
  • Self-contained build (excluded from Cargo workspace)

Build & Infrastructure

  • Fuzz directory excluded from workspace to prevent build conflicts with nightly-only fuzz targets
  • Timing test tolerance increased for reliable CI on shared infrastructure runners

Full Changelog: v2.3.4...v2.3.5

Assets 14
Loading