dcosnet
/
sorcery-go
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
sorcery-go/CHANGELOG.md

5.8 KiB
Executable File
Raw Blame History

Changelog

All notable changes to Sorcery-Go are documented here. The format follows Keep a Changelog, and the project adheres to Semantic Versioning.

[Unreleased]

Added

  • BTC 0.4.0 multi-arch cross-compilation support (pkg/toolchain/btc.go)
    • BTCManifest struct for structured manifest JSON parsing
    • BTCForge extended with CrossMode, TargetID, TargetTriple, TargetMarch, CLib, Family, Manifest fields
    • loadManifest() reads {SYS_LABEL}-manifest.json sidecars
    • ListTargets() enumerates all available golden images with manifest data
    • BuildEnv() uses manifest CFLAGS/triple when available; falls back to legacy derivation. Handles musl targets, cross-compiler naming ({triple}-gcc), and --sysroot rewriting for extracted toolchains
    • rewriteSysroot() helper replaces build-time sysroot paths with the actual extraction path
    • StampBinary() uses cross-assembler ({triple}-as) when available
    • ISA flag table for AVX512, AVX2, SSE4_2, NEON, MIPS32, TILE
    • SSE4_2 ISA tier added for Intel Atom and AMD APU targets that lack AVX
    • 19 cross-compilation targets: Intel HEDT/Server (5), AMD Ryzen/EPYC (4), AMD APU (4: apu-zn1 through apu-zn4), Intel Atom (4: silvermont, goldmont, tremont, sierraforest), embedded (mipselr2, armv7, tilegx)
    • New env vars: BTC_TARGET_ID, BTC_CROSS, BTC_CLIB, BTC_TARGET_TRIPLE
  • Shared CAS client (pkg/cas/) — content-addressable store client for the sorcery-go <-> Fester shared artifact cache
    • CheckArtifact — DAG-aware cache check before build dispatch
    • PushFile / PushArtifact — store .svb bundles and build outputs
    • RetrieveArtifact / RetrieveArtifactToFile — fetch cached artifacts
    • Stats — cache hit rate, utilization, artifact count
    • Auto-initialized when Fester integration is active
  • BTC.sh toolchain integration (pkg/toolchain/btc.go)
    • Probe() — detect BTC.sh golden images at /opt/BTC
    • BuildEnv() — return BTC-aware CC/CXX/CFLAGS/LDFLAGS
    • VerifyStamp() — read .note.BTC ELF note and xattr stamps
    • StampBinary() — apply forensic stamps (ELF note, xattr, debug symbols)
    • Pipe-delimited format matching BTC.sh and Fester
  • Cauldron.BundleAndCache — one-call bundle + CAS push method
  • Scheduler.Dispatch now CAS-aware — checks shared CAS before dispatching to Fester; skips builds for cached artifacts
  • FesterClient.CAS field — shared CAS client embedded in the Fester HTTP client, available to all cluster operations
  • Deterministic task IDs — replaced crypto/rand with atomic counter + nanosecond timestamp (sync/atomic + time.Now().UnixNano()). No cryptographic randomness dependency remains in the codebase.

Changed

  • Security model: Firewall-first architecture replaces mTLS. Transport security delegated to network boundary (OPNsense / IPFire). No application- layer TLS certificates, key management, or CRL propagation required.
  • eBPF security replaces AppArmor as primary enforcement mechanism
    • tomb_guard.bpf.c — LSM hooks for file/inode protection
    • sorcery_filter.bpf.c — cgroup filters for device/network whitelisting
    • AppArmor profiles retained as fallback
  • License changed from GPL-3.0 to AGPL-3.0-or-later
  • Fester cluster integration — full delegation of distributed build scheduling, node telemetry, and build dispatch to Fester
  • NVD API v2 client with SQLite WAL cache replaces hardcoded CVE data
  • Sovereign Bundle (.svb) format with ed25519 signatures and per-file SHA-256 MANIFEST.txt
  • Port: Fester default port changed from 8080 to 8181 to resolve conflict with sorcery-go.

Removed

  • All crypto/rand usage — removed from pkg/web/server.go and cmd/sorcery/commands.go. Zero active crypto/rand, crypto/tls, or crypto/x509 code paths remain in default builds.
  • pkg/warding/keys.go — dead code gated behind //go:build mtls build tag. Contained CA key generation logic that is no longer used.
  • FesterTLS config field and SORCERY_GO_FESTER_TLS env var — no longer needed with firewall-first model.
  • TLSConfig() method on the Fester client — transport security is now handled by the network boundary.

Fixed

  • Added missing bytes import to state.go (compile failure).
  • Added defer mutex unlock in Banish() (deadlock on panic).
  • Fixed BTC.sh SHA-256 checksum ordering (was computed before tarball creation).
  • Added cycle detection to dependency solver (stack overflow on circular graphs).
  • Fixed ELF note type mismatch in BTC stamp format (7 -> 1, now matches BTC.sh NT_VERSION).

[1.0.0] — 2026-03-17 — "The Sovereign Coven"

Added

  • The Cauldron — Go build engine with OverlayFS sandbox isolation
  • The Tablet — ACID BoltDB journal for y/n configuration persistence
  • The Tomb — content-addressable Merkle-tree storage for Essences
  • The Warding — security layer with eBPF + OpenSnitch/Portmaster integration
  • The Coven — firewall-isolated cluster with Fester-scheduled builds
  • Gaze — reverse-path inventory query engine
  • Legal Sentinel — license compliance with three posture templates
  • ICE — Interactive Configuration Engine preserving the y/n query UX
  • Cauldron Portable Bin — static ELF generation for standalone tools
  • Emergency Kit — curated static bundle (busybox, gdisk, e2fsck, etc.)
  • Coven Mirror WebUI — Cockpit-integrated dashboard
  • Bubble Tea TUI — tmux-style build dashboard
  • Multi-arch support — --target x86_64|aarch64 and --matrix
  • Sub-Depends solver — feature-aware DAG with Re-Forge triggers
  • Disaster Recovery Tome — restore the entire Coven from backup
  • Toolchain Validator — smoke-tests GCC/LLVM for SSP, PIE, LTO