# scuttle — Changelog ## v0.4.0 — Verification + Audit Exporters + Signing + Firmware Erase (2026-08-04) Fourth tagged release. Combines the v0.5 (Verification and Audit) and v0.6 (Firmware Erase) milestones from `docs/MANIFEST.md` §15. ### Added #### v0.5 Layer 6 — Extended Verification (`scuttle-verify`) - **Spot verification** (`verify_static_pattern_spot`): reads N% of blocks at pseudorandom offsets and compares against the expected pattern. Default 5%. - **Block verification** (`verify_static_pattern_blocks`): reads fixed-size blocks (e.g. 1 MiB) for large devices where sector-by-sector is too slow. - **Statistical verification** (`compute_statistics`, `verify_statistical`): - Shannon entropy (bits per byte, 0.0–8.0). - Chi-square statistic for uniform distribution (256 buckets). - Chi-square p-value (Wilson-Hilferty approximation, 255 degrees of freedom). - Byte frequency max deviation. - **Failure mapping** (`FailedRange`): tracks LBA start/end + expected/actual hex for each mismatch. - `VerifyResult` now carries `failed_ranges: Vec` and `stats: Option`. - 5 new unit tests (statistics on zeros, statistics on random, spot verify pass, spot verify mismatch, block verify). #### v0.5 Layer 7 — Audit Exporters + Merkle Tree (`scuttle-audit`) - **XML exporter** (`to_xml`): well-formed XML with sorted keys, CDATA-escaped text. - **CSV exporter** (`to_csv`): single-row flat format with all key fields. - **HTML exporter** (`to_html`): self-contained HTML page with embedded CSS, styled result (green/red), and a `
` block with the full JSON.
- **YAML exporter** (`to_yaml`): via serde_yaml.
- **Merkle tree** (`MerkleTree`): builds a SHA-256 Merkle tree over per-block hashes of the wiped device. Supports `from_leaves` and `from_data`. Pads to power-of-two.
- **NIST SP 800-88 compliance report** (`ComplianceReport`): maps the audit record's NIST class (Clear/Purge/Destroy) to compliance evidence. Serializable to JSON.
- `VerifyResultJson` now carries `stats: Option`.
- 9 new unit tests (Merkle single/two/three/from_data, XML/CSV/HTML/YAML export, compliance report).

#### v0.5 Layer 7 — Signing (`scuttle-signing`)

- **`scuttle-signing` crate**: Ed25519 digital signatures for audit records.
  - `sign_ed25519(record, key)` → `SignatureResult` (algorithm, signature_hex, key_fingerprint, signed_payload_hash).
  - `verify_ed25519_with_key(record, sig, public_key)` → `bool`.
  - `load_ed25519_key(path)` — load a 32-byte seed from file.
  - `generate_ed25519_keypair()` — for testing.
  - `key_fingerprint(public_key)` — SHA-256 of the public key, hex-encoded.
  - `SignerBackend` trait + `Ed25519Signer`, `OpenPgpSigner` (stub), `X509Signer` (stub).
  - `SignatureJson` for embedding in the audit record.
- 8 unit tests (sign+verify roundtrip, wrong-key failure, signature changes with record, OpenPGP/X.509 stubs return NotImplemented, signer backend trait, key load rejects wrong length, key load 32 bytes).

#### v0.6 Layer 9 — Firmware Erase (`scuttle-firmware`)

- **`scuttle-firmware` crate**: firmware-level sanitization commands.
  - **ATA Secure Erase** (`ata_secure_erase`, `ata_secure_erase_enhanced`): via `hdparm --security-erase` / `--security-erase-enhanced`. Includes `ata_detect_secure_erase` and `ata_set_security_password`.
  - **NVMe Sanitize** (`nvme_sanitize`): supports Block Erase, Crypto Erase, Overwrite actions via `nvme-cli`. Includes `nvme_sanitize_status` polling (up to 1 hour timeout).
  - **NVMe Format NVM** (`nvme_format`): format namespace with block size + secure erase setting (None / UserDataErase / CryptographicErase).
  - **SCSI Sanitize** (`scsi_sanitize`): via `sg_sanitize --overwrite`.
  - **SCSI Format Unit** (`scsi_format`): via `sg_format --format --six`.
  - **TRIM** (`trim_discard`): direct `ioctl(BLKDISCARD)` over the entire device.
  - **FITRIM** (`fitrim`): direct `ioctl(FITRIM)` on a mounted filesystem.
  - **HPA/DCO detect + disable** (`detect_hpa_dco`, `disable_hpa`, `disable_dco`): via `hdparm -N` and `hdparm --dco-identify` / `--dco-restore`.
  - **High-level dispatch** (`run_firmware_erase`): takes a `PurgeMethod` + device path, runs the right command, returns `FirmwareResult`.
- Tools are detected at runtime; if absent, returns `FirmwareError::ToolNotFound`.
- 8 unit tests (which() finds known binaries, HPA/DCO parse helpers, ATA detect returns gracefully without hdparm).

#### v0.6 Policy engine integration (`scuttle-policy`)

- `WipePlan` now carries `firmware_erase: Option`.
- SSD policies set `firmware_erase = AtaSecureErase` (or `AtaSecureEraseEnhanced` if supported) for Purge/Enterprise/Forensic/Government/AirGap/Paranoid intents.
- NVMe policies set `firmware_erase = NvmeSanitizeCrypto` for the same intents.
- PMEM policy sets `firmware_erase = PmemCryptoErase` (returns Unsupported at runtime since ndctl integration is deferred to v0.7).
- HDD / virtual / freespace policies leave `firmware_erase = None`.
- 5 new tests verify the firmware_erase field is set correctly.

#### v0.6 Core wipe engine integration (`scuttle-core`)

- `JobOptions` now carries `firmware_erase: Option`.
- The wipe engine invokes `scuttle_firmware::run_firmware_erase` BEFORE the overwrite passes.
- Firmware erase failures are logged and recorded in `audit.notes` but do NOT abort the wipe — the overwrite passes still run as belt-and-braces.

#### CLI integration

- `--certificate` now accepts: `none`, `json`, `pdf`, `xml`, `csv`, `html`, `yaml`, `both` (json+pdf), `all` (all 6 formats).
- CLI overrides for `--rounds`, `--verify`, `--certificate`, `--noblank` are now correctly re-applied after the policy engine runs (previously the policy engine's profile defaults would overwrite CLI overrides).

### Tests

- **105 tests total** (was 70 in v0.3):
  - 5 new in `scuttle-verify` (spot/block/statistical).
  - 9 new in `scuttle-audit` (exporters + Merkle + compliance).
  - 8 new in `scuttle-signing` (Ed25519 sign/verify + stubs).
  - 8 new in `scuttle-firmware` (parse helpers + which).
  - 5 new in `scuttle-policy` (firmware_erase field).

### Known limitations

- Firmware erase requires `hdparm`, `nvme-cli`, and `sg3_utils` to be installed. If absent, the function returns `ToolNotFound` and the wipe continues with overwrite-only.
- PMEM crypto-erase requires `ndctl` (deferred to v0.7).
- OpenPGP and X.509 signing are stubs (deferred to v2.0).
- The Merkle tree is built but not yet signed or bound into the audit record (the signing happens over the canonical JSON, not the Merkle root — full Merkle-root signing arrives in v0.7).

---

## v0.3.0 — Modern Providers + Profiles/Policies + Freespace Mode (2026-08-04)

See git history for full v0.3.0 changelog. Summary: 5 modern PRNGs (BLAKE3-XOF, XChaCha20, SHAKE128, SHAKE256, Salsa20); Layer 16 benchmark framework; v0.4 modern profile TOML schema with policy_map + constraints; policy engine with 20 built-in policies; 11 modern profiles; `--freespace-only` mode; fixed MT19937 + ISAAC-64 KAT bugs.

---

## v0.2.0 — Legacy Compatibility (2026-08-04)

See git history. Summary: legacy profiles, legacy flag compatibility, PDF certificate exporter, nwipe symlink support.

---

## v0.1.0 — Architectural Bootstrap (2026-08-04)

See git history. Summary: Layers 1-7 + 13 implemented from scratch in Rust; 24 tests passing.