sigwood v0.1.1

[0.1.1] - 2026-07-11

Changed

• Source and development install instructions in the README now create a virtualenv
  first, so a pip install -e in a fresh clone doesn't hit the PEP 668
  externally-managed-environment refusal on Debian, Raspberry Pi OS, or Fedora.
• Splunk export now reports a TLS certificate-verification failure with an actionable
  message, naming the verify_tls = false setting under [export.splunk] for a
  self-signed certificate on a trusted network, instead of a generic connection error.
• Source distributions no longer bundle the test suite - it shipped without the support
  files needed to collect it, so it was unusable - and a release-time gate checks the
  sdist carries no tests.
• Package metadata now declares the license as the SPDX license = "MIT" expression with
  license-files, dropping the deprecated MIT license classifier, and sets the operating
  system classifier to POSIX.

Fixed

• The beacon detector no longer silently drops a genuine beaconing flow to a unicast host
  whose IPv4 address ends in .255 (a valid host in any network wider than a /24). Its
  pre-filter now classifies non-unicast destinations and sources with the standard-library
  ipaddress module rather than a string-prefix test, so multicast, link-local (including
  IPv4 169.254.0.0/16), and the 255.255.255.255 limited broadcast are still excluded
  before scoring while real unicast hosts are kept.
• Copy polish in the init wizard prompts.
• sigwood init no longer lets a source you explicitly skip during setup quietly come
  back. A skipped default source (Zeek or syslog) is now written as
  <key> = "" # disabled during setup, so the config merge cannot silently re-enable it;
  removing a source still reverts it to the shipped default.
• The --dry-run preview now counts Zeek logs in dated zeekctl layouts (the
  YYYY-MM-DD/ and current/ subdirectories) the way a real run discovers them, and shows
  (unreadable) for a directory it cannot read instead of a misleading (0 files).
• A closed downstream pipe (for example sigwood hunt | head) now exits quietly with
  Unix SIGPIPE semantics instead of printing a BrokenPipeError traceback.
• The loader no longer crashes at import on platforms without the POSIX grp/pwd
  modules; permission-denied diagnostics fall back to numeric owner and group ids there.

Security

• Output now strips terminal control bytes through a single sanitizer - including the
  surrogate-escaped bytes a non-UTF-8 filename decodes to - so a hostile file or directory
  name in a scanned tree can no longer inject terminal escape sequences, whether it reaches
  the analyst through a stderr diagnostic or a text, html, or csv report.
• That sanitizer now also covers the remaining command-line surfaces - the error boundary,
  digest narration, the --dry-run banner, and loader and export status messages - so a
  hostile file, directory, or configured path name cannot inject terminal escapes through
  any of them.