Skip to content

Releases: nsergej/EnvWitness

Release list

EnvWitness v1.0.1

EnvWitness v1.0.1 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 22:07
v1.0.1
d18bff1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

EnvWitness v1.0.1

EnvWitness v1.0.1 is a maintenance release that restores reliable CodeQL
automation and refreshes pinned CI dependencies.

Fixed

  • CodeQL init and analyze now use the same immutable v4.37.3 revision,
    preventing configuration-version mismatches.
  • The local API reports the package version from the canonical
    envwitness.__version__ value.

Updated

  • actions/checkout to v7.0.1.
  • actions/setup-python to v7.0.0.
  • Supported Rich versions through the next major release.
  • Development support for mypy 2.x.

The release workflow builds and tests the wheel and source distribution,
generates an SPDX SBOM and SHA-256 checksums, and publishes GitHub build
provenance attestations.

Assets 6
Loading

EnvWitness v1.0.0

EnvWitness v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 23:42
v1.0.0
bc55dfd

EnvWitness 1.0.0

EnvWitness 1.0.0 introduces proof-carrying, privacy-first bug reports for comparing working and failing developer environments.

Highlights

  • Capture a command and its relevant environment evidence into one .evw file.
  • Review deterministic redaction before sharing.
  • Verify archive and fact integrity without extracting files.
  • Compare two machines by semantic evidence keys.
  • Extend collection through language-neutral process plugins.
  • Inspect evidence through CLI, JSON, Markdown, REST, or the local dashboard.

Install

pipx install https://github.com/nsergej/EnvWitness/releases/download/v1.0.0/envwitness-1.0.0-py3-none-any.whl

First Comparison

envwitness capture --output working.evw -- python -m pytest
envwitness capture --output failing.evw -- python -m pytest
envwitness compare working.evw failing.evw

Security

Telemetry and automatic updates are disabled by default. API mutation requires a bearer token, the API is loopback-only, plugins are opt-in, and .evw readers enforce strict archive limits.

The release also hardens executable discovery against current-directory hijacking, bounds subprocess streams before buffering, terminates descendant processes on timeout or cancellation, redacts command and project metadata, validates Host headers against DNS rebinding, verifies the embedded Markdown projection, and neutralizes Markdown and Unicode display-control injection.

The release workflow attaches the wheel, source distribution, SPDX JSON SBOM, and SHA256SUMS. GitHub build provenance attestations are recorded for the release artifacts and can be verified with gh attestation verify. The tag is not described as cryptographically signed, and capsule digests do not provide proof of origin.

Loading