What's new in v0.31.0
v0.31.0 is about the readers who never open a terminal. A periodic disclosure was a JSON file that only verify-hash could vouch for, so a reader without one had to take a summary on trust. disclose-pdf now turns it into a PDF/A-3b that carries the report, its attestation and its bundle, and verify-hash reads that PDF back. Around it, a live report can acknowledge through PerfSentinelHub instead of reaching the daemon from the browser, the pg_stat and mysql_stat scrapes filter on label matchers, and the daemon's Hub export takes a configurable timeout.
A disclosure a reader opens, and still checks
perf-sentinel disclose-pdf renders a periodic report as A4 pages in English, five for most reports: the figures, the uncertainty band, the applications, the method and disclaimers, and how to verify. The report, its attestation and its bundle travel inside as attachments, byte for byte. The command renders only when the content_hash recomputes and the attestation names that report, so a PDF never vouches for a file that does not hold up. It prints one JSON line and exits 0 when it rendered, 1 when it refused, 3 on an input error and 5 when it cannot render: a schema newer than the binary, text outside the bundled fonts, or a document the PDF writer refuses. A transparency entry in [notes.reference_urls] puts a QR code on the cover. veraPDF validates the output as PDF/A-3b in CI.
verify-hash --report report.pdf checks the report the PDF attaches, including in a copy re-saved by a tool that keeps attachments, and says it checked that report and not the printed pages. A PDF over 4 MiB is refused before parsing, and --format json adds verified_from: "pdf_attachment". In the lab, a Hub built around this engine publishes a hash-baked report, renders its PDF, and verify-hash checks that PDF.
A verify-hash that says what went wrong
verify-hash exits 5 on a report whose schema is newer than the binary, where it used to report a misleading hash failure, and 3 on a schema_version that is not a version at all. --attestation and --bundle now win over the files verify-hash --url finds beside the report. The attestation and bundle that --url fetches go to a private temporary directory removed when the command returns, instead of fixed names left in the shared temporary directory, and a failed write is an input error (exit 3) rather than a silent PARTIAL.
Acknowledging through the Hub, with no key in the browser
report --hub-relay <source_id> renders a live report for PerfSentinelHub to serve. Ack and Revoke go through that Hub's relay at the page's own origin, in the reader's Hub session, so no daemon key reaches the browser and the daemon needs no CORS entry. The page's content security policy narrows to connect-src 'self'. The flag is exclusive with --daemon-url, which keeps working as before.
One tenant's statements, not every tenant's
pg-stat --selector, mysql-stat --selector, report --pg-stat-selector and report --mysql-stat-selector filter the Prometheus scrape on label matchers such as 'namespace="shop",db_role="primary"'. The matchers apply to the ranked query and to every counter query, so an exporter serving several tenants, or a primary with its replicas, no longer ranks their statements together. Each matcher is parsed and rebuilt before it is encoded, so a stray brace or quote is refused instead of rewriting the query around it.
A Hub export that waits as long as the Hub needs
[daemon.hub_export] request_timeout_secs, from 1 to 60 seconds and 10 by default as before, bounds one push of findings, incidents or correlations. A Hub slowed down while catching up answered past the fixed 10 seconds, so the daemon timed out every push, backed off up to five minutes and dropped findings from a full pending table.
Upgrade impact
- PerfSentinelHub 0.7.0, the next Hub release, drives
disclose-pdfand--hub-relay. An older Hub has no disclosures and never passes--hub-relay, so it renders reports exactly as before against this binary. verify-hashexit codes move for two inputs. A report newer than the binary exits 5 instead of 1, and aschema_versionthat is not a version exits 3. A script that read exit 1 as a hash failure on those reports now sees the real cause.- The release binary is about 3.4 MB larger, embedded fonts included, 14.4 MB to 17.8 MB on macOS arm64. The
pdffeature brings krilla, whose text shaping crates are flagged unmaintained upstream. They only read the fonts embedded in the binary, and krilla's next release replaces them. - One configuration key is added,
request_timeout_secs, with the previous behavior as its default. The public API only gains fields on#[non_exhaustive]structs, no detector, normalizer or finding signature changes, the embedded reference data keeps its vintages, and MSRV stays 1.99.0.
Full detail in CHANGELOG.md.
Verifying this release
# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
--repo Institut-du-Numerique-Responsable/perf-sentinel
# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
--attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
--expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.31.0" \
--expected-issuer "https://token.actions.githubusercontent.com" \
--verify-binary ./perf-sentinel-linux-amd64gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.