0.42.0

Assetto Corsa Rally takes the SDK route. The registry listed it as plain
force feedback with nothing to do, and on a G PRO that gave nothing: with
raw HID off the game did not see the wheel, and with it on by hand the stock
Logitech library took the wheel and returned only its own damping
(#105). On a G923 Xbox edition with Logitech's files in
the prefix and raw HID on, its force feedback and TrueForce were confirmed
working (#83). The game now gets the same route as
Assetto Corsa EVO: logi-launch turns raw HID on, stages the proxy that
answers the SDK's rotation question and resets the wheel first, and the
app's Setup page offers the shim install for it.

Inertia no longer renders the encoder's grain, and the per-class levels
reach past 100. FF_INERTIA was fed the per-tick velocity difference,
which on a quantised encoder is an impulse train: a rim turning smoothly
read as a burst of full-count accelerations and came through as grain
(issue #89, where the author of TF4ALL had met the same
thing and suggested the cure). The estimate is now the gap between the
velocity and a 50 ms one-pole chasing it, which returns exactly the
acceleration under a steady one, so the effect's scale is unchanged, and
spreads a blip into a decaying bump instead of a spike. Covered by the
effect-math tests. The spring_level, damper_level and friction_level
scales accept up to 400 instead of 100, and inertia_level joins them,
because the engine's gains sit below the firmware's by amounts owners have
measured (0.61 for damper on a G923 Xbox edition, #87; 2.25x damper and 4x
spring on a G PRO, #89) and a cap of 100 left no way to try those numbers
without a rebuild. Defaults are unchanged.

Every release asset is signed, and the release carries provenance. The
signing job only ever covered the Arch packages and their repository
database, although the documentation said every asset; the Debian
packages, the telemetry helpers and the SBOMs went out unsigned. The
release workflow now ends by signing every asset that has no detached
signature yet, with the same key, and by attaching a SLSA build provenance
statement, release-assets.intoto.jsonl, that lists every asset by SHA-256
and is signed through Sigstore by the SLSA generic generator.
slsa-verifier can then confirm that an asset is the one this repository's
workflow published at that tag; the README shows how. The workflow accepts
a provenance-only dispatch that exercises the provenance jobs against an
existing release without uploading anything. The README and the assurance
document now say what was signed up to 0.41.0 instead of overstating it.

Reviewed dependency advisories are recorded where the scanners look. The
four RustSec notices against the GUI toolkit's font and image stack (bincode,
paste, rustybuzz, ttf-parser, all "crate is unmaintained", none a
vulnerability, none replaceable from this side) were already explained in
the VEX document, but osv-scanner and the OpenSSF Scorecard do not read VEX
and kept counting them. They are now also recorded in
userspace/logi-wheel/osv-scanner.toml, next to the lock file where both
tools pick the file up, each with its reason and an expiry date so that a
lapsed entry is reported again instead of being forgotten.

The dual clutch page is decoded, from a contributed listen. 0x8127
DUAL_CLUTCH sat in the feature matrix as present on every wheel and
understood on none. @fsfarmscaper decoded it on a G923 Xbox edition
(#97): the wheel sets the bite point and the paddle from
its own button combinations, fn2 reads the result and every change is an
unsolicited event; writes are acknowledged and applied nowhere. Recorded in
PROTOCOL_SPECIFICATION.md 12.6 and the feature matrix; nothing in the driver
changes yet, since a read-only attribute for it needs a wheel with a dual
clutch to verify against.

Workflow tokens are read-only unless a job says otherwise. The two
workflows without a top-level permissions block ran with the repository's
default token; both start read-only now, and only the release jobs that
attach assets ask for write access. A compiled test binary that had been
committed by accident is gone from the tree. GitHub's private vulnerability
reporting, which SECURITY.md has pointed at all along, is now actually
enabled on the repository. Force pushes to and deletion of master are
refused.

The project's rules are written down, and the release carries its bill of
materials. New at the top level: CONTRIBUTING.md (sign-off, tests with the
change, coding standards), GOVERNANCE.md (roles, access, continuity, the
secrets policy), CODE_OF_CONDUCT.md, docs/ROADMAP.md, and
docs/SECURITY_ASSURANCE.md with the threat model, the dependency policy and
its remediation thresholds; SECURITY.md now states the disclosure timetable,
reporter credit and exactly when a release stops receiving fixes;
security/openvex.json records the dependency advisories that do not affect
the project and why. The README says how to verify a release against the
signing key. CI measures the Rust workspace's test coverage on every push
(80% at the time of writing) and builds a CycloneDX SBOM per crate, and from
this release the SBOMs are attached to the release beside the binaries.
Secret-scanning push protection is on. Answers for the OpenSSF Best
Practices badge, all levels, live in .bestpractices.json.

Every parser that reads bytes from outside has a fuzz target. The relay
datagram, the PID report decoder behind logi-ffb, and the Codemasters,
Project CARS, WRC, BeamNG and F1 telemetry decoders each get a cargo-fuzz
target under userspace/logi-wheel/fuzz, kept out of the workspace so
ordinary builds do not need a nightly toolchain. A first run of each found
nothing; the point is that a game or a Wine process can hand the daemon or
the proxy any bytes at all, and a panic there ends the session.

Verifying this release

Every asset carries a detached .sig from the project's key, fingerprint
4B5B DD78 0272 3B28 9FA9 34CA CD77 C00A 443B 9E79, published here as
logitech-trueforce-signing-key.asc, and the release carries a SLSA
provenance statement, release-assets.intoto.jsonl, listing every asset
by SHA-256 and signed through Sigstore by the release workflow itself:

gpg --import logitech-trueforce-signing-key.asc
gpg --verify logi-wheel_0.42.0-1_amd64.deb.sig logi-wheel_0.42.0-1_amd64.deb
slsa-verifier verify-artifact logi-wheel_0.42.0-1_amd64.deb \
  --provenance-path release-assets.intoto.jsonl \
  --source-uri github.com/mescon/logitech-trueforce-linux-driver \
  --source-tag v0.42.0

A CycloneDX SBOM per binary is attached as <crate>-0.42.0.cdx.json.

Thanks

To the people whose reports and measurements made this release:
@fsfarmscaper for decoding the dual clutch page and coming back with the
power-cycle runs, @Mhytee for the inertia analysis and the gain table,
@purpleferret for the AC Rally report and the launcher log that showed the
wrong route, @WnDTech for the OLED descriptor readback, and @fenixadam and
@Ismael-Torresan for the continued measurements on the G923 Xbox edition.
See CREDITS.md.