From 6f99de5b307dc7bdb264694daede98d19a454178 Mon Sep 17 00:00:00 2001 From: stacknil Date: Sat, 8 Aug 2026 21:43:17 +0800 Subject: [PATCH] chore(release): prepare v0.6.0 --- CHANGELOG.md | 59 +++++++++++++++++++++--------------------- CMakeLists.txt | 2 +- docs/release-v0.6.0.md | 19 ++++++++++---- tests/test_cli.cpp | 2 +- 4 files changed, 46 insertions(+), 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4bb202e..6cbf50b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,35 +6,39 @@ All notable user-visible changes should be recorded here. ### Added -- Added stable JSON finding identity fields: `finding_id` and - `episode_index`. -- Added a separated-burst syslog report-contract fixture where one source IP - produces two time-separated brute-force findings. -- Added detector regression coverage for stable episode identity under unsorted - input order and inclusive window-boundary behavior. -- Added parser regression coverage for malformed source-IP token - classification. -- Added deterministic parser property tests for registry-order independence, - generated malformed tokens, failure taxonomy stability, and arbitrary-byte - result invariants. -- Added an optional Clang libFuzzer parser target with a sanitized seed corpus - and bounded Ubuntu CI smoke campaign. -- Added a dedicated util-linux `login` handler for selected failed-login, - retry-exhaustion, session-failure, local-login, and root-login messages. -- Expanded the sanitized mixed auth corpus from 150 to 160 lines with ten - fixture-backed `login` records and updated parser coverage telemetry. +- None yet. + +### Changed + +- None yet. + +### Fixed + +- None yet. + +### Docs + +- None yet. + +## v0.6.0 + +### Added + +- Added multiple time-separated detector episodes for one rule subject. +- Added stable finding identity fields: `finding_id` and `episode_index`. +- Added a parser handler registry that keeps program-specific parsing modular. +- Added deterministic parser property coverage and an optional libFuzzer smoke + target with a sanitized seed corpus. +- Added a dedicated util-linux `login` handler for selected login failure and + session messages. +- Added audit-only privilege authentication signals for sudo and su failures; + these remain visible without counting as detector evidence by default. ### Changed -- Refactored parser internals into timestamp, source-envelope, program-dispatch, - program-handler, and failure-classifier modules behind the unchanged - `AuthLogParser` interface. -- Detector rules now emit separate findings for time-separated detection - episodes within the same rule subject instead of collapsing each subject to a - single best window. - Bumped the JSON report artifact contract from `loglens.report.v2` / - `schema_version` 2 to `loglens.report.v3` / `schema_version` 3 for finding - identity fields. + `schema_version` 2 to `loglens.report.v3` / `schema_version` 3, including + `finding_id` and `episode_index`. ### Fixed @@ -42,10 +46,7 @@ All notable user-visible changes should be recorded here. ### Docs -- Documented detection episode semantics in the rule catalog and report artifact - contract notes. -- Added the v0.6 Detection Episode Semantics release note and schema v2 to v3 - migration guidance. +- Added the v0.6 release note and schema v2 to v3 migration guidance. ## v0.5.0 diff --git a/CMakeLists.txt b/CMakeLists.txt index 4671119..00beeea 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -4,7 +4,7 @@ project(LogLens VERSION 0.6.0 LANGUAGES CXX) set( LOGLENS_VERSION_SUFFIX - "-dev" + "" CACHE STRING "Prerelease suffix appended to the LogLens project version" ) diff --git a/docs/release-v0.6.0.md b/docs/release-v0.6.0.md index cf30b8c..0581e48 100644 --- a/docs/release-v0.6.0.md +++ b/docs/release-v0.6.0.md @@ -1,10 +1,9 @@ -# LogLens v0.6.0 - Detection Episode Semantics +# LogLens v0.6.0 - Detection Episodes, Parser Coverage, and Audit Signals -Theme: Detection Episode Semantics. +Theme: Detection Episodes, Parser Coverage, and Audit Signals. -This release note describes the v0.6 report and detector contract. It does not -add new detection rules. It makes repeated time-separated findings for the same -rule subject explicit and reviewable. +This release note describes the fixed v0.6 report, parser, coverage, and audit +signal contract. It does not add new detection rules. ## What Changed @@ -15,6 +14,13 @@ rule subject explicit and reviewable. - JSON findings include stable finding identity fields: - `finding_id` - `episode_index` +- Parser internals are organized behind a program handler registry. +- Deterministic parser property coverage and an optional libFuzzer smoke target + cover malformed and arbitrary-byte input invariants. +- A dedicated util-linux `login` handler normalizes selected login failure and + session messages while preserving unsupported variants as warnings. +- Privilege authentication failures from `sudo` and `su` are exposed as + audit-only signals and do not count as detector evidence by default. - The separated-burst contract fixture demonstrates one source IP producing two distinct brute-force findings in one report. @@ -96,6 +102,9 @@ v0.6 is covered by: - detector tests for stable episode identity under unsorted input order - detector tests for inclusive rule-window boundaries - parser tests for malformed source-IP token classification +- parser handler registry and util-linux `login` coverage +- deterministic parser property tests and bounded fuzz smoke coverage +- audit-only privilege authentication signal behavior - report tests for `finding_id`, `episode_index`, and schema v3 output - golden report-contract fixtures for Markdown, JSON, and optional CSV reports diff --git a/tests/test_cli.cpp b/tests/test_cli.cpp index cc082b8..9c0768d 100644 --- a/tests/test_cli.cpp +++ b/tests/test_cli.cpp @@ -135,7 +135,7 @@ int main(int argc, char* argv[]) { &version_stderr) .c_str()); expect(version_exit == 0, "expected --version to succeed"); - expect(read_file(version_stdout) == "LogLens 0.6.0-dev\n", + expect(read_file(version_stdout) == "LogLens 0.6.0\n", "expected --version to print project version to stdout"); expect(read_file(version_stderr).empty(), "expected --version to keep stderr empty");