97 lines
5.4 KiB
Markdown
Executable File
97 lines
5.4 KiB
Markdown
Executable File
# Changelog
|
|
|
|
All notable changes to Sorcery-Go are documented here. The format follows
|
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project
|
|
adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [1.1.0] — 2026-07-12
|
|
|
|
### Added
|
|
- **BTC 0.4.0 multi-arch cross-compilation support** (`pkg/toolchain/btc.go`)
|
|
- `BTCManifest` struct for structured manifest JSON parsing
|
|
- `BTCForge` extended with `CrossMode`, `TargetID`, `TargetTriple`,
|
|
`TargetMarch`, `CLib`, `Family`, `Manifest` fields
|
|
- `loadManifest()` reads `{SYS_LABEL}-manifest.json` sidecars
|
|
- `ListTargets()` enumerates all available golden images with manifest data
|
|
- `BuildEnv()` uses manifest CFLAGS/triple when available; falls back to
|
|
legacy derivation. Handles musl targets, cross-compiler naming
|
|
(`{triple}-gcc`), and `--sysroot` rewriting for extracted toolchains
|
|
- `rewriteSysroot()` helper replaces build-time sysroot paths with
|
|
the actual extraction path
|
|
- `StampBinary()` uses cross-assembler (`{triple}-as`) when available
|
|
- ISA flag table for AVX512, AVX2, SSE4_2, NEON, MIPS32, TILE
|
|
- SSE4_2 ISA tier added for Intel Atom and AMD APU targets that lack AVX
|
|
- 19 cross-compilation targets: Intel HEDT/Server (5), AMD Ryzen/EPYC (4),
|
|
AMD APU (4: apu-zn1 through apu-zn4), Intel Atom (4: silvermont, goldmont,
|
|
tremont, sierraforest), embedded (mipselr2, armv7, tilegx)
|
|
- New env vars: `BTC_TARGET_ID`, `BTC_CROSS`, `BTC_CLIB`, `BTC_TARGET_TRIPLE`
|
|
- **Shared CAS client** (`pkg/cas/`) — content-addressable store client
|
|
for the sorcery-go <-> Fester shared artifact cache
|
|
- `CheckArtifact` — DAG-aware cache check before build dispatch
|
|
- `PushFile` / `PushArtifact` — store .svb bundles and build outputs
|
|
- `RetrieveArtifact` / `RetrieveArtifactToFile` — fetch cached artifacts
|
|
- `Stats` — cache hit rate, utilization, artifact count
|
|
- Auto-initialized when Fester integration is active
|
|
- **Cauldron.BundleAndCache** — one-call bundle + CAS push method
|
|
- **Scheduler.Dispatch now CAS-aware** — checks shared CAS before
|
|
dispatching to Fester; skips builds for cached artifacts
|
|
- **FesterClient.CAS field** — shared CAS client embedded in the
|
|
Fester HTTP client, available to all cluster operations
|
|
- **Deterministic task IDs** — replaced `crypto/rand` with atomic counter +
|
|
nanosecond timestamp (`sync/atomic` + `time.Now().UnixNano()`). No
|
|
cryptographic randomness dependency remains in the codebase.
|
|
|
|
### Changed
|
|
- **Security model**: Firewall-first architecture replaces mTLS. Transport
|
|
security delegated to network boundary (OPNsense / IPFire). No application-
|
|
layer TLS certificates, key management, or CRL propagation required.
|
|
- **eBPF security** replaces AppArmor as primary enforcement mechanism
|
|
- `tomb_guard.bpf.c` — LSM hooks for file/inode protection
|
|
- `sorcery_filter.bpf.c` — cgroup filters for device/network whitelisting
|
|
- **License** changed from GPL-3.0 to AGPL-3.0-or-later
|
|
- **Fester cluster integration** — full delegation of distributed build
|
|
scheduling, node telemetry, and build dispatch to Fester
|
|
- **NVD API v2 client** with SQLite WAL cache replaces hardcoded CVE data
|
|
- **Sovereign Bundle (.svb)** format with ed25519 signatures and
|
|
per-file SHA-256 MANIFEST.txt
|
|
- **Port**: Fester default port changed from 8080 to 8181 to resolve conflict
|
|
with sorcery-go.
|
|
|
|
### Removed
|
|
- **All `crypto/rand` usage** — removed from `pkg/web/server.go` and
|
|
`cmd/sorcery/commands.go`. Zero active `crypto/rand`, `crypto/tls`, or
|
|
`crypto/x509` code paths remain in default builds.
|
|
- **`pkg/warding/keys.go`** — dead code gated behind `//go:build mtls`
|
|
build tag. Contained CA key generation logic that is no longer used.
|
|
- **`FesterTLS` config field** and `SORCERY_GO_FESTER_TLS` env var — no
|
|
longer needed with firewall-first model.
|
|
- **`TLSConfig()` method** on the Fester client — transport security is
|
|
now handled by the network boundary.
|
|
|
|
### Fixed
|
|
- Added missing `bytes` import to `state.go` (compile failure).
|
|
- Added `defer` mutex unlock in `Banish()` (deadlock on panic).
|
|
- Fixed BTC.sh SHA-256 checksum ordering (was computed before tarball creation).
|
|
- Added cycle detection to dependency solver (stack overflow on circular graphs).
|
|
- Fixed ELF note type mismatch in BTC stamp format (7 -> 1, now matches
|
|
BTC.sh NT_VERSION).
|
|
|
|
## [1.0.0] — 2026-03-17 — "The Sovereign Coven"
|
|
|
|
### Added
|
|
- **The Cauldron** — Go build engine with OverlayFS sandbox isolation
|
|
- **The Tablet** — ACID BoltDB journal for y/n configuration persistence
|
|
- **The Tomb** — content-addressable Merkle-tree storage for Essences
|
|
- **The Warding** — security layer with eBPF + OpenSnitch/Portmaster integration
|
|
- **The Coven** — firewall-isolated cluster with Fester-scheduled builds
|
|
- **Gaze** — reverse-path inventory query engine
|
|
- **Legal Sentinel** — license compliance with three posture templates
|
|
- **ICE** — Interactive Configuration Engine preserving the y/n query UX
|
|
- **Cauldron Portable Bin** — static ELF generation for standalone tools
|
|
- **Emergency Kit** — curated static bundle (busybox, gdisk, e2fsck, etc.)
|
|
- **Coven Mirror WebUI** — Cockpit-integrated dashboard
|
|
- **Bubble Tea TUI** — tmux-style build dashboard
|
|
- **Multi-arch support** — `--target x86_64|aarch64` and `--matrix`
|
|
- **Sub-Depends solver** — feature-aware DAG with Re-Forge triggers
|
|
- **Disaster Recovery Tome** — restore the entire Coven from backup
|
|
- **Toolchain Validator** — smoke-tests GCC/LLVM for SSP, PIE, LTO |