From f2581bfbc7ffc86216e67af070cc2ed7aa273104 Mon Sep 17 00:00:00 2001 From: Chris Fink <7587613+deadpoets@users.noreply.github.com> Date: Sun, 19 Jul 2026 20:25:24 -0400 Subject: [PATCH] docs: cut the v0.2.0 changelog and record its verified kernels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The core module's Unreleased entries become [0.2.0] - 2026-07-19. The headline is a defect users are exposed to on v0.1.0: ReadOnly() followed by CopyIn/SetByteAt/Truncate/ReadFrom, or ArenaSlot.Release on a read-only arena, wrote to a PROT_READ page and killed the process with SIGSEGV. Those paths now return ErrReadOnly. gorelease confirms the only API change is that added sentinel, so v0.2.0 is a compatible minor. KERNELS.md gains a v0.2.0 section with three rows, each validated against f7fdf4e (the library tree the tag lands on; later commits are docs-only): amd64 Hyper-V 7.0.0-azure, arm64 Cortex-A53 6.18.35-rockchip64, and arm64 OCI Ampere 6.17.0-oracle. Every row ran the full qualifying gauntlet — all three modules under -race, GOEXPERIMENT=runtimesecret, the no-heap-escape gates, and -asan — plus the three counted proofs, 3/3 each, secretmem live. Worth recording why the arm64 rows carry weight for this particular release: the concurrent protection-transition stress races ReadOnly/Seal against mutators, and it passes under -race on the in-order Cortex-A53, not just on amd64's stronger TSO ordering. --- CHANGELOG.md | 10 +++++++++- KERNELS.md | 20 ++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2caaf57..0430d57 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,13 @@ mark the stability commitment. > This repo holds three independently versioned Go modules; entries are tagged > by module. Untagged entries belong to the core `secmem` module. +## [0.2.0] - 2026-07-19 + +A bug-fix release for the core `secmem` module, and the reason to upgrade +promptly: v0.1.0 could **crash the process** on a documented API sequence. +`ErrReadOnly` is the only API addition, so the change is backward compatible +(confirmed by `gorelease`). + ### Fixed - **Read-only buffers and arenas no longer fault the process on a mutating @@ -207,7 +214,8 @@ First tagged release of the core `secmem` module. cover all three types, both the pointer and (where a value copy is not itself a `go vet` copylocks violation) a dereferenced value. -[Unreleased]: https://github.com/deadpoets/secmem/compare/v0.1.0...HEAD +[Unreleased]: https://github.com/deadpoets/secmem/compare/v0.2.0...HEAD +[0.2.0]: https://github.com/deadpoets/secmem/compare/v0.1.0...v0.2.0 [secmem-lint/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-lint%2Fv0.1.0 [secmem-crypto/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.0 [0.1.0]: https://github.com/deadpoets/secmem/releases/tag/v0.1.0 diff --git a/KERNELS.md b/KERNELS.md index fa84ff4..8886a4f 100644 --- a/KERNELS.md +++ b/KERNELS.md @@ -28,6 +28,26 @@ security proofs beyond unit tests: blocked by lockdown) — i.e. the L4 path itself was exercised, not only the mmap+mlock (L3) fallback, whose guards and canaries every row verifies. +## v0.2.0 — verified kernels + +Validated against `f7fdf4e`, the library tree v0.2.0 tags; the only later +commits are docs-only (this file and the changelog), so the run reflects +exactly the shipped code. Every row ran the full gauntlet — core, +`secmem-crypto`, and `secmem-lint` under `-race`, `GOEXPERIMENT=runtimesecret`, +the no-heap-escape gates, and `-asan` — plus the three counted proofs. + +| Date | Kernel | Arch | Environment | secretmem | Result | +|---|---|---|---|---|---| +| 2026-07-19 | 7.0.0-1009-azure | amd64 | Local Hyper-V VM, Ubuntu 26.04, Intel Core Ultra 7 265KF | live | PASS · 3/3 | +| 2026-07-19 | 6.18.35-rockchip64 | arm64 | Libre Computer Renegade, RK3328 4× Cortex-A53 (in-order), Armbian | live | PASS · 3/3 | +| 2026-07-19 | 6.17.0-1011-oracle | arm64 | OCI Ampere A1.Flex (Neoverse N1, out-of-order), Ubuntu 24.04 | live | PASS · 3/3 | + +The read-only fix this release centers on is exercised where it matters: the +concurrent protection-transition stress races `ReadOnly`/`Seal` against +mutators, and it passes under `-race` on the **in-order** Cortex-A53 as well as +on amd64's stronger TSO ordering — the arm64 weak memory model being where a +protection-state race would actually surface. + ## v0.1.0 — verified kernels Tags `v0.1.0` (commit `2faf99c`) and `secmem-crypto/v0.1.0` (commit `06960fb`);