Institut-du-Numerique-Responsable/perf-sentinel v0.31.4 on GitHub

What's new in v0.31.4

v0.31.4 changes no product code. It closes a gap in how the SQL tokenizer is tested, and moves the lockfiles off a yanked dependency release. The binary normalizes, detects and reports exactly as v0.31.3 did.

A round trip through the SQL tokenizer

The tokenizer's metamorphic suite checked two things: that a template is a fixed point, and that the params are exactly the literals with nothing of them left in the template. Neither checked the text between the literals, so a tokenizer that dropped or changed a character there would have passed. A new property puts each extracted literal back in place of its ? and requires the original statement back, byte for byte. It runs on an unnamed engine, MySQL and PostgreSQL, each with the literal forms it reads as one literal, and every literal is followed directly by a non-space byte, the last one included. A deliberately broken tokenizer that drops the character after a number fails it.

Off a yanked `inout`

inout 0.2.3 was yanked from crates.io. Cargo.lock and fuzz/Cargo.lock move to 0.2.4.

Upgrade impact

Nothing moves at runtime. No finding appears, disappears or changes signature, and acknowledgments keep matching. A daemon image built from this release passed validate-findings 12/12, sql-backtick-redaction, pg-stat, mysql-stat, the hybrid daemon-to-HTML scenario, CI shift-left and output-formats-coverage in the simulation lab.
No configuration key is added or removed, no route, metric or wire format changes, the public API of perf-sentinel-core does not change shape, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.

Full detail in CHANGELOG.md.

Verifying this release

# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
  --attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
  --expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.31.4" \
  --expected-issuer "https://token.actions.githubusercontent.com" \
  --verify-binary ./perf-sentinel-linux-amd64

gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.