Skip to content

v1.0.2-maintenance-release.md

Latest commit

 

History

History
45 lines (36 loc) · 1.93 KB

v1.0.2-maintenance-release.md

File metadata and controls

45 lines (36 loc) · 1.93 KB
Raw

DetFuzz V1.0.2 Maintenance Release

V1.0.2 is a code-hardening maintenance release built on the V1.0.1 experiment. It does not relabel or rewrite the retained V1.0.1 Windows evidence.

Changes

  • Reject XML documents containing a DTD before xml.etree.ElementTree parses them, closing the entity-expansion path for caller-supplied XML.
  • Treat a missing or non-numeric Sysmon EventID as an invalid event instead of raising an uncaught exception.
  • Tolerate malformed XML returned during telemetry polling and retry until the normal deadline.
  • Make evaluate-detection return structured XML_PARSE_FAILED output and a nonzero exit instead of a traceback for malformed input.
  • Enable Ruff's blind-except, stale-suppression, and security rule families so future broad exception handlers, subprocess calls, and XML parsing changes require explicit review.
  • Remove a dead calibration parameter and correct the documented timeout selection formula.
  • Commit the historical V1.0.1 evidence bundle with a pinned SHA-256 digest so the evidence referenced by the repository is available from a clone.

Verification

Verified locally on 2026-08-28 with the pinned development toolchain:

98 tests run; 97 passed and 1 expected dependency-path test skipped
Ruff: all checks passed
mypy: no issues found in 31 source files

The package version and CLI report 1.0.2. The historical live evidence remains artifacts/detfuzz-v1.0.1-release.zip, whose digest is pinned by artifacts/detfuzz-v1.0.1-release.sha256.txt. That bundle records the 2026-08-13 V1.0.1 VM run and is intentionally unchanged.

Claim boundary

V1.0.2 is locally verified for unit-tested behavior, linting, type checking, packaging, and CLI smoke checks. The live Windows classification results cited by the project are still the retained V1.0.1 results. A future live rerun should receive a new evidence bundle and validation record rather than modifying the historical one.