v0.5.0

Lariska 0.5.0 adds negotiated installation-aware inventory and signed, recoverable native updates.

• Inventory v2 preserves side-by-side installations with endpoint-scoped identities and per-source completeness. Compatible Shapoclyack retains degraded source inventory instead of manufacturing removals; older servers use the conservative v1 fallback.
• Native updates require Ed25519-signed manifests, administrator-owned local trust and a signed rollback seed. Bounded downloads, anti-rollback and replay protection are enforced by both the endpoint and an independent privileged watchdog.
• The watchdog installs through the native package manager and requires authenticated new-version health; failed health restores the protected previous package while preserving endpoint identity and spool.
• Documentation now covers schema negotiation, native enrollment, certificate trust, recovery and mixed-fleet migration.

Downloads: Linux x86_64/aarch64 DEB and RPM, Windows x86_64 MSI, macOS Intel/Apple Silicon PKG; five binary archives, SHA-256 checksums, signed native manifests and a CycloneDX SBOM.

Deploy compatible Shapoclyack (PR #519, migrations 0080/0081) before enabling inventory v2 in a fleet. Archive installations must migrate to native packaging before managed updates can be enabled. MSI/PKG use explicitly trusted self-signed platform certificates; macOS packages are not Apple notarized. Archive binaries are unsigned. Signed manifests expire after 30 days and must be refreshed by the publisher before later fleet rollout.

Validation: local formatting, strict locked Clippy, all 158 tests and release build; GitHub CI across Linux/Windows/macOS; native install/update/failed-health rollback on all seven platform/package combinations. A multi-day soak has not been performed.

Managed delivery: Shapoclyack migration 0081 stores DEB/RPM variants separately. Upgrade all API replicas before publishing multiple installer formats. This Lariska release relies on unambiguous accepted Linux package inventory for format selection; missing inventory or both package databases blocks an offer. Endpoints refuse a package kind that differs from local configuration. Legacy clients without signed native update support require manual migration.

v0.4.0

What's Changed

• feat: enforce APEX Architecture Contract v1 by @onixus in #16
• perf: make endpoint inventory faster, safer and more accurate by @onixus in #17
• fix: never publish partial endpoint inventory by @onixus in #18
• perf: bound spool memory and decompression by @onixus in #19
• perf: stagger inventory and reduce battery impact by @onixus in #20
• docs: make README match the agent's real behavior by @onixus in #21
• fix: validate managed settings before applying by @onixus in #22
• perf: cache unchanged inventory collectors by @onixus in #23
• perf: decouple inventory collection from delivery by @onixus in #24
• docs: refresh README, Russian guide, wiki and roadmap by @onixus in #25
• release: v0.4.0 by @onixus in #26

Full Changelog: v0.3.1...v0.4.0

v0.3.1

What's Changed

• Windows agent: bring-up, remote management, and the collection gaps it exposed by @onixus in #14
• docs: describe remote management, and record the 0.3.1 fixes by @onixus in #15

Full Changelog: v0.2.0...v0.3.1

Release v0.2.0

Changelog

All notable changes to the Lariska endpoint inventory agent will be documented in this file.
The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.2.0] - 2026-08-23

Added

• PATH-Hijacking Hardening & Safe Path Resolution:
  • Implemented find_trusted_binary restricting executable lookups to trusted system locations (/usr/bin, /bin, /usr/sbin, /sbin, /opt/homebrew/bin, /usr/local/bin) with path traversal (../) prevention.
• Deep Inventory & Shadow IT Runtime Package Collectors:
  • Python: Direct filesystem metadata parser for site-packages / dist-packages *.dist-info/METADATA extracting package names, versions, and authors without spawning python interpreters.
  • Node.js: Global npm package scanner parsing root and scoped (@org/pkg) package.json files.
  • Java: Automatic JVM / JDK detector parsing release metadata (JAVA_VERSION, IMPLEMENTOR, OS_ARCH).
• Environment & Virtualization Classifier:
  • Auto-detection for containers (Docker /.dockerenv, Podman /run/.containerenv, Kubernetes KUBERNETES_SERVICE_HOST, containerd cgroups) and hypervisors/clouds (KVM/QEMU, VMware, VirtualBox, Hyper-V, AWS Nitro/EC2, GCP).
  • Automatically enriches agent labels with env.type, env.container_engine, env.hypervisor, env.cloud_provider.
• E-Core Pinning & Heterogeneous CPU Scheduling (QoS):
  • macOS: PRIO_DARWIN_BG (0x1000) and QOS_CLASS_BACKGROUND routing execution strictly to Apple Silicon Efficiency cores (E-cores).
  • Linux: CPU affinity locking via sched_setaffinity on Intel Atom E-cores (/sys/.../types/cpu_atom/cpus), AMD Zen 4c / Zen 5c compact cores (via ACPI CPPC highest_perf), and ARM big.LITTLE (cpu_capacity).
  • Windows: Windows 11 / 10 EcoQoS via ProcessPowerThrottling (PROCESS_POWER_THROTTLING_EXECUTION_SPEED) and IDLE_PRIORITY_CLASS.
• Battery & Power Awareness:
  • Cross-platform battery power detection (is_on_battery()) tagging host.power_source (battery / ac).
• Crash Recovery & Panic Hook:
  • Structured panic capture via init_panic_hook, saving sanitized diagnostic reports (crash_report.json) in state_dir, with automatic recovery, logging, and archiving upon agent restart.
• Data Compression & Delta Synchronization:
  • Local spool storage in .json.zst format with backward compatibility for uncompressed entries.
  • Transparent HTTP compression sending Content-Encoding: zstd.
  • In-memory InventorySnapshot::diff() engine computing added, removed, and modified software deltas.
• CI/CD Pipeline in Jenkins:
  • Declarative Jenkins pipeline (Jenkinsfile) running in rust:1-bookworm with Cargo caching, code formatting check, strict Clippy linter, 53 unit/contract tests, release binary compilation, and artifact archiving.

[0.1.3] - 2026-07-28

• Refresh dependencies and publish release binaries.

[0.1.2] - 2026-07-27

• Fix the Windows archive output path so the .zip and checksum are attached to the GitHub release.
• Fail the release build when a platform produces no uploadable artifacts.

[0.1.1] - 2026-07-27

• Publish the initial cross-platform Lariska agent release.
• Build archives for Linux x86_64/aarch64, Windows x86_64, and macOS x86_64/Apple Silicon.
• Generate SHA-256 checksum files and a CycloneDX SBOM.
• Fix release checksums on Windows runners by using Python's portable standard-library implementation.

Full Changelog: v0.1.3...v0.2.0

v0.1.3

What's Changed

• Add installation and Shapoclyack connection guide by @onixus in #10
• Harden endpoint agent security and durable delivery by @onixus in #11
• Use strict TOML configuration parsing by @onixus in #12
• Release v0.1.3 by @onixus in #13

Full Changelog: v0.1.2...v0.1.3

v0.1.2

What's Changed

• Fix Windows release archive path by @onixus in #9

Full Changelog: v0.1.1...v0.1.2