Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Apr 18:54
· 75 commits to main since this release
v0.2.0
1f09bb1

[0.2.0] - 2026-04-10

Security and hardening release.

Security

  • Signing secret key files are now written with restricted permissions (0600 on Unix)
  • HTTP depot tag reads are bounded to 1 MiB
  • HTTP depot blob reads are bounded to 512 MiB
  • HTTP depot error-body reads are bounded to 64 KiB
  • dispatch secret set now supports --value-stdin to avoid exposing secrets in argv and shell history
  • Local tools no longer inherit HOME from the host environment
  • Parcels declaring NETWORK rules are rejected until courier enforcement is implemented
  • Secret stdin input via --value-stdin is capped at 1 MiB

Changed

  • Replaced direct libc calls with nix wrappers for Unix process operations; only the pre_exec detach closure retains raw libc for async-signal-safety
  • Secret store temp-file writes use unique per-process paths to prevent collisions
  • Detached-run liveness checks now use process-group liveness when a distinct stored process group ID is tracked
  • Signing key writes use atomic temp-file paths with per-process uniqueness
Assets 10
Loading