v2.9.2

What's Changed

• (c1a68d5) Bump patch version to 2.9.2
• (d272694) test(log): egress multi-process centralization + rolling under tng exec
• (c69e02b) test(log): hook centralization under recursion, fork, and great-grandchild
• (f933297) log: switch hook centralization UDS from stream to datagram
• (0ea9b8f) log: centralize hook log rolling into tng exec via abstract-namespace UDS
• (892b937) docs(claude): codify documentation writing rules from the ra doc work
• (71a462d) feat(log): route ERROR+ events to a separate error log file
• (15f573e) docs(ra): extract remote attestation config into a standalone guide
• (71a97b8) ci(wasm): stop tag-triggered GitHub Pages deployments
• (8b75519) test(testsuite): fix flaky nip_io_hosts cleanup race with vfork spawns

Full Changelog: v2.9.1...v2.9.2

v2.9.1

What's Changed

• (3882590) Bump patch version to 2.9.1
• (0aec5d2) test(log): add integration test for JSON, rolling, and flush-on-exit
• (e8fdb49) feat(log): add size-based rolling with per-pid hook files and exit flush
• (1f18bff) feat(log): add JSON output format for the tng binary and hook cdylib
• (7b7c4c4) docs(claude): add persistent-text writing style rules
• (b1047a0) log: redact secrets and plaintext from logs
• (5443714) docs(configuration): fix config-field mismatches between docs and implementation
• (5e7600c) docs(scenarios): fix use-case title numbering to match directory order
• (faba6c8) docs: fix broken scenario cross-links and sync Chinese README Quick Start
• (95ad19a) test(testsuite): resolve nip.io peer hostnames via /etc/hosts for no-DNS envs
• (b7e17de) docs(skill): add release-version project skill

Full Changelog: v2.9.0...v2.9.1

v2.9.0

What's Changed

• (b900772) Bump minor version to 2.9.0
• (4bfdf8f) feat(transparency_log): optional publishedMeasurements + doc clarification
• (3576d16) refactor(transparency_log): split trust vector for granular failure diagnostics
• (7f5263c) feat(rats-cert): add transparency_log attestation policy with Rekor v1 verification
• (171709c) fix(tng-hook): apply cargo fmt to TCPStore test assertions
• (b19fd99) fix(tng-hook): handle mapped IPv6 TCPStore connections
• (29fb6eb) Add strict reference-value builtin AS policy
• (fa5d067) Add strict hardware-only builtin AS policy
• (9b9e488) netfilter(egress): only capture traffic destined for local addresses
• (b6894ed) test(testsuite): revert run_test! cancel-on-first-completion semantics
• (8959ea0) fix(netfilter_udp): gate Linux-only code so non-Linux targets compile
• (f3007e4) feat: add netfilter_udp transparent UDP proxy mode
• (dd69049) Bump trustee to a7cae246 and enable policy-rvps on wasm
• (f10fc44) fix(rats-cert): enable policy-rvps so the builtin converter can appraise
• (814a5a5) ci: generate AS token-signer key without the EC PARAMETERS block
• (5b7c16c) Migrate trustee to upstream openanolis and add builtin-as wasm tests

Full Changelog: v2.8.0...v2.9.0

v2.8.0

What's Changed

• (e0d84bb) fix(ci): bump node to 22 for wasm-sdk publish jobs
• (d3e5780) Bump minor version to 2.8.0
• (dd6d198) test: harden curl-based integration checks
• (4647a3c) fix(ci): pin rv-release-tool to fixed trustee commit 28ce0c6
• (2dd61c2) fix(ci): use repo:tag format when grepping docker images in push
• (4fffe5d) feat(buildspec): add linux/arm64 to Tng image platform target
• (fadbf64) feat(ci): publish amd64+arm64 multi-arch docker images
• (1d2ee85) feat(rats-cert): enable builtin verifier for wasm JS SDK via refactored trustee
• (8eef1de) refactor(rats-cert): drop unused Raw report data variant
• (6e1fccb) fix(www-demo): translate attestation model options to Chinese (background-check/passport)
• (6bf23e0) build(rats-cert): use cfg_alias wasm + async_trait(?Send) to drop tokio_with_wasm spawn workarounds
• (f7d4a45) feat(www-demo): add CoCo as_type selector + builtin policy/RV editor
• (98a8f91) build: drop libgit2-sys via trustee shadow-rs git2 feature fix
• (e21149f) build: enable builtin-as-tdx-rust as default feature, drop openssl build deps
• (808cc86) build: drop openssl-sys from attestation-service via pure-Rust crypto
• (0ea76d0) test(tng): mark ITA env-var tests serial to avoid env races
• (f4a3fb7) build(rats-cert): use cfg_alias wasm + async_trait(?Send) to drop tokio_with_wasm spawn workarounds
• (8e2e112) refactor(time): switch to web-time-compat for wasm-safe SystemTime/Instant
• (766103c) fix(rats-cert): left-zero-pad JWK EC coordinates before cert comparison
• (d6a660c) refactor(cfg): unify wasm target cfg via cfg_aliases across all crates
• (f690db4) fix(ci): install chromedriver matching installed Chrome major version
• (29ec690) feat(ohttp): derive wasm OHTTP outer scheme from fetch URL + integration tests
• (0ace238) fix(ci): install perl-Time-Piece for vendored OpenSSL 3.5.x in CI
• (e3f75cd) docs(claude): require Assisted-by trailer for AI-authored commits
• (8ec5833) fix(rpm): vendor trustee protos/ for attestation-service build.rs
• (d701f35) fix(rpm): install perl(Time::Piece) for vendored OpenSSL 3.5.x build
• (d8a22de) fix(ci): align go-sdk.yml triggers with other workflows, drop paths filter
• (21ae9e4) fix(ci): install perl-IPC-Cmd for vendored OpenSSL build
• (f1960aa) chore(tdx): drop setup-vendor-config, document PCCS_URL env var
• (cf4e3ab) feat(ohttp): forward ingress OHTTP over TLS to a gateway
• (862c827) feat(tdx): replace FFI DCAP verifier with pure-Rust dcap-qvl backend
• (6794f5b) docs(claude): forbid manually editing spec Version/Release and changelog
• (2d7eef4) ci(wasm-sdk): run make www-test in build-and-release
• (0f4166c) feat(tng-wasm/www): add ITA provider support to the Pages demo
• (92db0f6) test(tng-wasm): handle firefox-specific fetch error message in render test
• (740c24e) chore(deps): bump reqwest rev for cleaner wasm js_sys::Error printing
• (32fa56d) fix(tng-wasm): pin wasm-bindgen-test to fix firefox "no tests to run"
• (adf8f38) chore(wasm): drop redundant wasm-unit-test invocation
• (b064a84) test(tng-wasm): assert clean rendering of browser fetch failures
• (492cd90) tng: attach URL/method context to AS fetch failures
• (f6ade18) feat(ohttp): unified header passthrough + CORS preflight fallback for browser OHTTP
• (a298e60) docs: add live demo links and Go SDK references
• (f9b0237) test(hook): stabilize echo server startup in ingress capture test
• (e49db9b) feat(tng-wasm/www): add Pages demo site with SSE streaming and TNG config
• (121b150) refactor(tng-wasm): move static example into example/ directory
• (ac7a25d) test(scenarios): add 4-method access test harness for 05-vllm-ohttp-cluster
• (db96cac) docs(scenarios): rename scenario.md files to README.md
• (b6d5846) refactor(tng-wasm): split fetch module into request/response/attestation
• (264a228) fix(wasm): add Host header to OHTTP plaintext requests
• (aef1c72) test(ohttp): add path_default integration test
• (2b4fc25) docs: document ohttp.path_default option
• (6a4597a) docs(python-sdk): document ohttp.path_default option
• (3d2d3a5) feat(ohttp): honor path_default fallback in construct_base_url
• (dc14567) feat(config): add ohttp.path_default enum (root|original)
• (e4fe26a) fix(go-sdk): preserve request path when forwarding through TNG http_proxy
• (f193d25) docs(python-sdk): remove maturin leftovers, fix make python-wheel-install path
• (9dac1b4) fix(python-sdk): infer host platform tag for local wheel builds

Full Changelog: v2.7.3...v2.8.0

v2.7.3

What's Changed

• (e3678eb) Bump patch version to 2.7.3
• (1c19ffb) fix(python-sdk): tag wheels per platform so all 5 ship to PyPI

Full Changelog: v2.7.2...v2.7.3

v2.7.2

What's Changed

• (1ada6cb) Bump patch version to 2.7.2
• (db46a21) fix(ci): grant release job contents:write + actions:read permissions
• (7be2c22) fix(ci): write windows zip to artifacts/ top level for release glob

Full Changelog: v2.7.1...v2.7.2

v2.7.1

What's Changed

• (f8a8573) Bump patch version to 2.7.1
• (6d2aab6) fix(python-sdk): populate PyPI project description via static readme
• (bfdb4c3) fix(tng): drop incorrect Debug assertions from endpoint test
• (2eabcf4) fix(ci): upload standalone tng.exe for windows-gnu cross-build

Full Changelog: v2.7.0...v2.7.1

v2.7.0

What's Changed

• chore(deps): update openssl to 0.10.78 to fix CVE vulnerabilities by @imlk0 in #87
• feat: Add ITA provider support by @shariqahmed-cohere in #85
• feat: Add ASR evidence fetching support by @shariqahmed-cohere in #91
• feat: add opt-in signer transparency verification for COCO AS JWT by @imlk0 in #90
• feat(builtin-as): add rv-release-manifest support for RVPS by @imlk0 in #95
• Consolidate test dep startup into Makefile targets + sync Chinese docs by @imlk0 in #92
• feat: egress netfilter cgroup support and multi-match capture_dst by @imlk0 in #94
• feat(tests): pre-compile test binaries before running tests by @imlk0 in #96
• perf,feat: rats-tls improvements, H2 optimization, and port_end support by @imlk0 in #98
• refactor(rats-tls): consolidate shared rustls config into utils/rustls/ by @imlk0 in #99
• test: add cgroup and port range integration tests for netfilter by @imlk0 in #101
• chore(deps): update hyper with backpressure bypass fix by @imlk0 in #102
• feat: add inclavare-containers community ASR compatibility by @imlk0 in #100
• feat: replace NetTransport with QuicTransport for serf gossip + add peer_shared tests by @imlk0 in #97
• feat: add Windows x86_64-pc-windows-gnu cross-build support by @imlk0 in #106
• feat(python): create new Python SDK with high-level API and subprocess TNG binary management by @imlk0 in #107
• ci(test): update codecov-action to v7 by @imlk0 in #108
• refactor(peer_shared): implement ClusterKeySet, key rotation, and protocol documentation by @imlk0 in #104
• docs: add vLLM OHTTP cluster scenario (Use Case 5) by @imlk0 in #110
• docs: redesign README for open-source project landing page by @imlk0 in #109
• ref(config): rename Builtin AS 'policy' to 'attestation_policy' with default by @imlk0 in #111
• docs(scenarios): add vLLM P/D separation scenario with NIXL/UCX KV cache encryption by @imlk0 in #112
• fix(tng-testsuite): comprehensive integration test logging and organization improvements by @imlk0 in #105
• feat: add skip_as_token_cert_verify option to CoCo verifier by @imlk0 in #113
• fix(tng): clamp min sleep interval in MaybeCached to prevent busy-wait on past expire timestamps by @imlk0 in #114
• feat: add setup-vendor-config tool for builtin AS PCCS configuration by @imlk0 in #115
• feat: add Ubuntu 24.04 as alternative Docker base image by @imlk0 in #116
• feat(setup-vendor-config): add --internal flag for VPC endpoint access by @imlk0 in #117
• ci: fix push job — remove test dependency and fix tag parsing by @imlk0 in #118
• feat(tng): add StatusProvider trait and unified /status/ REST API by @imlk0 in #103
• feat(tng): add port_end option to dst_filters in http_proxy and socks5 ingress modes by @imlk0 in #119
• docs: add pasta workaround note for netfilter mode in containers without CAP_NET_ADMIN by @imlk0 in #121
• feat: multi-rule and port range support for mapping ingress/egress by @imlk0 in #120
• feat(tng): add header_passthrough config for OHTTP mode by @imlk0 in #122
• fix(test): fix header_passthrough target name and mapping_multi_rule race by @imlk0 in #126
• refactor(testsuite,ohttp): tracing spans, ShellMode 2D semantics, serf watcher fixes by @imlk0 in #127
• docs: reorganize scenario docs into numbered subdirectories and fix broken links by @imlk0 in #128
• feat(ra): add hardware_only and trust_all builtin attestation policy templates by @imlk0 in #124
• feat(egress): retry peer_shared Serf cluster join with exponential backoff by @imlk0 in #125
• chore: bump memberlist to 0.8.5 and serf to 0.5.2 from crates.io by @imlk0 in #129
• feat(tng): add LD_PRELOAD-based egress hook for transparent port interception by @imlk0 in #131
• refactor(access-log): replace monolithic AccessLog enum with RAII state machine by @imlk0 in #132
• feat(tng): add ingress LD_PRELOAD hook for transparent connect() interception via HTTP CONNECT by @imlk0 in #134
• feat: add HPKE Auth Mode for sender-authenticated OHTTP tunnels by @imlk0 in #133
• feat(tng): egress hook host filtering at accept time + exec port allocation fix by @imlk0 in #136
• fix(tng-hook): improve connect hook reliability and add SO_TYPE filtering by @imlk0 in #137
• feat(tng-hook): reject connections to 0.0.0.0 in connect hook by @imlk0 in #138
• feat(tng-hook): add sendto hook for TCP Fast Open handling by @imlk0 in #139
• refactor(tng): make forward_stream errors independent per direction, add data-loss logging by @imlk0 in #140
• fix(tng): propagate signal exit codes in tng exec by @imlk0 in #141
• feat(cli): add --log-file option for file-based logging by @imlk0 in #142
• refactor(tng): replace CIDR host filtering with IP address + interface name in egress hook by @imlk0 in #143
• feat: add UDP over QUIC Datagram tunnel with mapping_udp mode by @imlk0 in #135
• feat(go-sdk): add Go SDK with subprocess http_proxy architecture by @imlk0 in #123
• fix(hook): require local peer to skip encryption with capture_local_traffic=false by @imlk0 in #144
• docs(python-sdk): improve docstrings, add context manager support, and rats-TLS examples by @imlk0 in #146
• ci: unify artifact packaging — combine tng and libtng_hook.so with system path layout by @imlk0 in #148
• refactor(rats-cert): simplify CoCo token verifier error chain by @imlk0 in #149
• ci: add trusted publishing for npm and PyPI, remove obsolete native branch triggers, update README quick start by @imlk0 in #145
• ci: extract GitHub Packages publish to standalone job in WASM workflow by @imlk0 in #150
• fix(go-sdk): correct module path to match directory structure by @imlk0 in #151
• fix(go-sdk): replace LICENSE symlink with actual Apache 2.0 license file by @imlk0 in #152
• docs: add Go Reference badge to README by @imlk0 in #153
• refactor: clarify IP/CIDR/Domain types and add IP/CIDR endpoint filtering by @imlk0 in #147

Full Changelog: v2.6.0...v2.7.0

v2.6.0

What's Changed

• (f346add) Bump minor version to 2.6.0
• (6052304) fix(build): use --locked flag for cargo install commands
• (1a97fe2) Revert "fix(build): update nightly toolchain from 2025-07-07 to 2025-12-01"
• (8efdadb) refactor: improve error messages for hyper serve_connection call sites
• (4a792fc) fix(build): update nightly toolchain from 2025-07-07 to 2025-12-01
• (6093001) docs: add CLAUDE.md with project development guidelines
• (28d17af) Fix fmt, clippy, wasm build failures
• (e265ed7) Update as_addr extraction in tng wasm fetch
• (7571939) Move custom deserialization level in config parsing
• (ffdec12) Remove coco.rs as it is renamed to ra.rs
• (69d2014) Add provider wire format compat test
• (0fb8023) Update docs for multi-provider feat
• (a173914) Remove ambigious provider type accessors
• (1030f14) Change evidence/token backcompat approach
• (400b0a0) Refactor evidence wire format and cert verifier/config
• (2668946) Refactor multi-provider layer
• (7a7875e) ohttp: Fix unexpected unreachable panic in ChunkWriter flush handling
• (b262251) refactor(error): remove redundant source placeholders from error messages
• (e6a87dd) Add multi-provider layer
• (e64ac90) feat(ohttp): add error logging for OHTTP server request failures
• (00cf4a3) test(coco): update integration tests to use concrete converter/verifier types
• (52c62f3) ohttp: Fix intermittent Aead(Error) caused by truncated varint-encoded chunk length
• (0490004) refactor(ra): remove VerifyContext::Builtin variant and simplify converter instantiation
• (bd84987) refactor(tunnel): convert RaArgs to Arc at entry points
• (2fa2e87) refactor(config): restructure builtin provider with explicit type tags
• (dd6fae0) fix(ci): use nohup with output redirection to prevent Broken pipe in background services
• (422c112) fix(Makefile): consolidate test-dep-as into a single shell to prevent zombie crane process
• (3f35afa) refactor(ohttp): use AttestContext from ra_context instead of constructing RA components directly
• (97540b4) ci(clippy): add missing build dependencies
• (a5ec6c9) docs: add rv_name field documentation for ReferenceValueListItem
• (9959293) fix(makefile): remove --all-features from clippy to fix compilation errors
• (a8d7fff) ci: improve trustee service startup reliability in GitHub Actions
• (f4290e5) docs: add Builtin mode documentation to English configuration guide
• (e36a1ae) fix(build): fix RPM and container build issues
• (459b877) build: preserve uncommitted changes when creating source tarball
• (9e30898) fix(test): align SLSA test configurations with Makefile test environment
• (3e297e1) refactor(rats-cert): replace custom TeeType/AaTeeType with kbs_types::Tee
• (e3518e2) refactor(rats-cert): restructure error types with thiserror and source chains
• (e56d18c) feat(builtin-as): refactor reference value configuration to use typed payload structures
• (e98b922) feat: add builtin attestation service (AS) support for local evidence verification

Full Changelog: v2.5.0...v2.6.0

v2.5.0

What's Changed

• (a881526) Bump minor version to 2.5.0
• (fadac84) ci: add GitHub Release notes generation with robust tag detection
• (bb68f04) ci: upgrade GitHub Actions to v6/v8 for Node.js 24 compatibility
• (e74d14d) build(makefile): add automated version bump targets
• (d9bf790) chore: unify dependency versions and migrate to workspace-level management
• (f236e47) feat: migrate rats-cert into workspace with SGX/TDX features removed
• (6f4527a) docs(configuration): fix typo in field name from r#in to in
• (76aa324) fix(verifier): fix missing headers when fetching JWT verification certs in Passport mode
• (a713598) refactor(verifier): handle AS certificate fetch errors gracefully and validate HTTP status
• (ce3664d) ohttp(peer_shared): add support for peers_file in peer_shared key mode
• (00b2519) feat(ohttp, utils): add robust file watcher with close-write detection for key reload
• (3e25a44) feat(attestation): enable multi-submod EAR verification and additional evidence support
• (d1a4b89) ci: add reproducible build and SLSA provenance support for RPM build workflow
• (dca92ec) docs: add missing attest, verify, and no_ra fields to peer_shared mode configuration
• (392cae3) fix(rpm): specify AnolisOS 23.3 release version in Dockerfile

Full Changelog: v2.4.0...v2.5.0