Skip to content

varve v0.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Aug 12:17
· 1 commit to main since this release
v0.13.0
This tag was signed with the committer’s verified signature.
avrabe Ralf Anton Beier
SSH Key Fingerprint: 5yELJMbRldVoXWU2u9E8p8a9GUJCyQLyinKHfADgAOE
Verified
Learn about vigilant mode.
677352b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

varve v0.13.0 — adversarial inputs

REQ-FUZZ-001 + REQ-PROP-001 + REQ-MATRIX-001 verified.

  • Fuzzing (fuzz/, fuzz.yml — PR smoke + nightly): five cargo-fuzz targets on the untrusted-input parsers — layer-id grammar, layer-manifest JSON, DSSE envelope, varve.toml, varve-realms.toml. It found a real bug on the first run: the layer-id grammar accepted leading-zero patches, so 2026.07.052 and 2026.07.52 were two pin strings for one identity — a genuine hazard in a digest-is-identity system. Fixed, regression-seeded, re-fuzzed clean past 1.6M runs.
  • Property tests (proptest): the core laws over the whole input space — layer-id parse/Display round-trip, rollback verdict monotonicity (accept iff counter ≥ mark), advance-never-lowers, platform-match totality + wasm universality.
  • Matrix: CI now tests linux AND macos (was ubuntu-only while releasing four platforms), pins an MSRV (1.89) build, and publishes cargo-llvm-cov coverage as advisory evidence.
  • Kani proofs of the same invariants are tracked honestly as REQ-KANI-001 (v1.0, advisory→required) — not claimed here.

Verify: varve self-verify --archive varve-v0.13.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json. This machine self-updated through the old-verifies-new chain.

Assets 13
Loading