release: 1.17.0#83
Merged
Merged
Conversation
Serve, the tenth built-in capability and the language's first inbound authority (Python backend only, conjunctive addr:port attenuation enforced before the syscall, sequential connections, Serve.recv as the first inbound IFC source); a single source of truth for the handle-bearing capability set with the cross-check guard the code already promised (which caught LSP completion missing Proc and Db); three Python-vs-Wasm parity fixes (parse_float's undefined helper, Fs/Db/Proc error text on the Wasm hosts, payloadless-variant receivers); the discarded-result drop class and the self-copy type loss; the tuple pointer element type through the ? boundary; `capa --wit` no longer describing a different program; and `capa --help` advertising the subcommands. Version bump + CHANGELOG + DONE + doc version pins. No breaking changes; additive minor release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Additive minor release.
Serveis a new built-in capability; nothing changes shape, so no existing program needs touching.The headline is the tenth capability, but the release is warranted on the bug fixes alone. Anyone on 1.16.0 is currently exposed to a hard build failure (
parse_floatin a program that never formats a Float emits a call to a helper that was never defined), an editor regression (LSP completion had never offeredProcorDb), and four Python-versus-Wasm divergences, which is precisely the parity promise the project sells.Added
Serve, the tenth built-in capability: the authority to listen and accept inbound connections. Every capability so far reaches out; this one is reached.The surface is connection-level rather than HTTP-level, so protocol parsing lives in ordinary Capa code and a protocol bug is not a bug in the trusted computing base. Attenuation is conjunctive over
(address, port)with ranges, enforced before the syscall so a denied bind never happens even transiently. Sequential by design, one connection at a time, enforced rather than advised. Python backend only:wasi:socketsis not reachable from the wasmtime bindings, so the Wasm emitter and--witreject any program whose signatures reach it, listing every offending site.Serve.recvis the language's first inbound information-flow source and is@public, withServe.senda sink on its payload argument. The docs now state that the lattice models confidentiality rather than integrity or taint, so@publicon an attacker-controlled request asserts nothing about its trustworthiness.Changed
capa --helpnow advertises the ten subcommands, which were dispatched before argparse ran and so were undiscoverable.The handle-bearing capability set was a tuple hand-copied at 21 sites; it now routes through one registry, and the cross-check the code comment had long claimed existed now actually runs.
Fixed
parse_floatno longer produces an unbuildable module.Fs/Db/Procerror text is identical across backends again. A payloadless variant bound by an unannotatedletsupports method calls andmatchon Wasm. A value-discarded call no longer leaves values on the stack, closed across all 47 affected shapes through a single seam with a sweep test that fails CI if a builtin is added without a discard recipe. A method copyingselfinto an unannotated binding compiles. A tuple with a pointer element returned through?compiles. LSP completion offersProcandDb.capa --witno longer emits a document describing a different program.Verification
python -m unittest discover tests(what CI runs): 4304 tests, OK, 18 skipped.pytest: 4321 passed. The seven files touched match the shape of the 1.16.0 release commit; the four hardcoded version pins were each verified by reading the line.The new capability was dogfooded before this release rather than after, by building an HTTP library on top of it. That surfaced no compiler bugs but three real gaps in
Serveitself, all now recorded: no half-close (so a close with unread client bytes can lose the response to a TCP reset, including on the success path), a 30s timeout that bounds a read rather than a request, and--check-capabilitiesattributing an example root's capabilities to the package.