Skip to content

v0.14.0

Choose a tag to compare

View all tags
@emiliano-go emiliano-go released this 26 Aug 02:51
· 49 commits to master since this release
v0.14.0
This tag was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.
05175fe
This commit was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.

TL;DR

Thirty-seven commits since v0.13.1 harden the inspection pipeline, add seven new detection rules and features, renumber all code-emitted heuristic ids into a dense H namespace so the prefix tells you how a rule works, reorganise the test suite, and close audit evasion gaps found during adversarial testing.

Changed

  • Rule ids now say how a rule works: R is a regex, H is a heuristic. The ninety-five programmatic ids are renamed to H001-H089. The thirty-two regex rules keep their R prefix. The mapping is derived from the catalog by scripts/rule_id_mapping.py and frozen into trustsight.rule_id_history. Stored ids are migrated on first open; retired ids are reserved and never recycled. Weights, severities, thresholds and behaviour are unchanged.

  • Security Model and Rules promoted to dedicated top-level nav sections. Previously nested under Overview and Reference respectively.

Added

  • Orphan hijacking detection (H086-H088). Detects a package adopted from orphan, then its recipe rewritten with no upstream change, plus an unpinned build fetch.

  • Build-install IOC campaign matching. Matches packages against signed, federated IOC baselines from the release channel; reported in the IOC tier, outside the heuristic score.

  • AUR snapshot TTL refresh. Automatically refreshes the AUR snapshot on a TTL and reviews dependencies first.

  • Version-comparison verdict. Named verdict for version-comparison findings; renderer honesty checks.

  • Setuid rule. New rule detecting setuid-related patterns, with aligned review output.

  • Review workload profiles. Configurable profiles (quiet, strict, default) controlling which packages enter the review queue.

  • Rule taxonomy and generated reference index. Generated index of all 171 rules across 6 scoring namespaces.

Fixed

  • Subprocess tests are environment-independent. Tests that spawn subprocesses now inject PYTHONPATH to locate the package, instead of requiring a system-wide install.

  • Audit evasion gaps closed. Rules and tokenizer patched to close previously undetectable evasion paths. Execution and redirect regexes kept inside the adversarial regex budget.

Security

  • Pipeline hardened against crafted input.
  • Resource and parser boundaries tightened.

Stats

  • 37 commits since v0.13.1
  • 270 files changed, +33,573 / -4,924
  • 3,617 tests, all passing
  • 65/65 security gates, 10/10 calibration gates
  • 171 scoring rules across 6 namespaces
  • Package version 0.14.0
Assets 2
Loading