Changelog

All notable changes to Heimdall are listed here, one section per release tag. Each entry names the commit on main it comes from. The format follows Keep a Changelog, and Heimdall uses Semantic Versioning: from v0.1.0 the job API in docs/API.md changes by additions only.

Heimdall is a defensive sandbox. Each fixed vulnerability is listed under Security with its RUSTSEC, CVE or GHSA id where one exists. To report a vulnerability, see SECURITY.md.

Unreleased

Changes on main after v0.1.0.

Added

• SECURITY.md, CONTRIBUTING.md, this changelog, deny.toml (cargo-deny: advisories, bans, licences, sources; no advisory fires and none is ignored), the CI image ci/ci.Containerfile (rustfmt, clippy, libseccomp, pinned nightly, cargo-fuzz and cargo-deny) and docs/OPENSSF-ANSWERS.md (the OpenSSF Best Practices answers).
• Two cargo-fuzz targets for heimdall-wasm: wasm_guest_load (arbitrary bytes through the pin, the signature check and the compiler: refused without a panic, only a pinned and signed component loads) and wasm_emit_file (fuzzer-scripted emit-file calls checked against a model), with seeds (55f1e61).
• The README: what Heimdall is, its users, the layers, the tuning process and the standards table with an honest status (61d215d, 485c440, 831999e, 5e11f93, 25387df).

Changed

• scripts/fuzz.sh runs in the CI image heim-ci; ci/fuzz.Containerfile is gone (the CI image pins the same nightly and cargo-fuzz).

• The workspace's path dependencies between the Heimdall crates also name their version (0.1.0), so cargo-deny's wildcard ban holds and the crates can be published.

[0.1.0] - 2026-10-30

Tag v0.1.0 at 386a67f. The first release: the stable job API that Holger builds against, and an interim plain container runner. Consumed by git tag (see docs/API.md); not on crates.io yet, and not SLSA-attested yet.

Added

• heimdall-core: the job, policy, limits, result, verdict, broker-event and id types (6bbaaaf); the milestone 0 job API: the JobRunner trait, Job with output_dir, JobKind::Native { image, argv } and JobKind::Wasm, ImageRef, GuestRef with its BLAKE3 pin, Limits (wall, memory, cpus, pids and the wasm and output limits), Verdict::Refused { code, reason }, Output, ExitInfo, KillReason, Features, Protection, RunError, verify, check_outputs and the stable refusal codes (RED 27891c3, GREEN 65c0d0e).
• heimdall-core: the canonical binary encoding v1, the per-boot Ed25519 key, the domain-separated SignedResult wire (HMDL-SR, version 1), the Verifier with a replay guard and job ticket, the PinnedKey text record and the output check (RED 2cf6c45, GREEN 46cb44e); fuzz targets for the wire, the encoding and the pinned key text, with seeds replayed in the tests (RED b129417, GREEN 52fe299).
• heimdall-wasm: a wasmtime 49 component host with the WIT interface run(input, params) -> result<output, refusal> plus emit-file, and no WASI. A guest is checked before it is compiled: its .wasm.blake3 pin and its .wasm.p7s signature (CMS over the BLAKE3, chained to pinned roots); there is no unsigned mode. Fuel, an epoch timeout, memory and table totals, instance, table and memory counts and the stack are limited, and each limit is a named refusal with a stable code (heimdall-wasm-<n>) (RED 8b84508, GREEN 3b55be4, 9cc78be).
• heimdall-run and heimdall-cli: the policy file (TOML v1, docs/POLICY.md), the input and output directory rules (docs/RUN.md), heimdall run --job wasm and heimdall verify-result with a pinned key, a ticket and the output check, and stable exit codes (docs/CLI.md) (RED 98192d8, GREEN 7c2ebd1; RED 9216e61, GREEN 3410553; 1f5cddc); the wasm bridge to heimdall-wasm with end-to-end tests through the heimdall binary and real signed guests (RED ff14bb7, GREEN 6b0c1d1); WasmJobRunner behind the JobRunner trait (65c0d0e, f99a118). Fuzz targets policy_file, output_name and verify_result_file.
• heimdall-plain: PlainYoukiRunner, an ordinary youki container (libcontainer =0.7.0) per job through heimdall-plain-shim. The OCI image is verified and unpacked fresh at every start; the default seccomp profile (x86_64, no capabilities), cgroup v2 limits with no swap, user namespaces and no_new_privs; wall and memory kills; the features it reports are truthful (youki-plain, seccomp Default, no landlock, broker or wasm). The youki feature is off by default; scripts/plain-tests.sh runs the container tests (RED d55408e, GREEN 386a67f).
• The CI script scripts/ci.sh (fmt, clippy -D warnings, tests, cargo deny when deny.toml exists, fuzz smoke runs) (1f5cddc), the fuzz image ci/fuzz.Containerfile and scripts/fuzz.sh (2aeff70).
• The specification docs/SPEC.md, docs/BUILD-THING.md (164d038) and the job API reference docs/API.md (386a67f).
• The licence: AGPL-3.0-only plus a commercial licence, and the CLA (a68bce5); the logo (f15cb7e).

Decided

• The signature covers Heimdall's canonical binary wire v1, not canonical JSON: it is deterministic by construction, domain-separated, length-prefixed and fuzzed. Callers call verify and check_outputs and never touch the bytes (docs/API.md).

Not in this release

• heimdall run --job native in the CLI, the syscall broker, Landlock, the generated per-program seccomp profiles and the verify-bundle guest (spec §12).