What's new in v0.34.0
v0.34.0 is about a container log that nothing read. The daemon writes every finding to stdout as one NDJSON line, for a log backend that tails the container. A daemon whose findings already reach PerfSentinelHub through [daemon.hub_export] kept writing millions of those lines a day, at a CPU and node disk cost, and buried its own messages on stderr. [daemon] findings_stdout turns that copy off.
Findings on stdout, now optional
[daemon] findings_stdout, default true, decides whether each finding is also written to stdout. Set to false, the daemon skips the write and the stdout lock it took on every analysed batch. Metrics, the findings ring, the archive and every export keep every finding. /api/config reports the setting, the query monitor Config tab shows it for a daemon that does, and watch --help lists it.
A warning when nothing else keeps the findings
A daemon set to findings_stdout = false with neither [daemon.hub_export] nor [daemon.archive] warns at startup. Its findings then live in the query API's bounded ring only, lost once it rolls over or the daemon restarts, or nowhere at all with api_enabled = false or max_retained_findings = 0, where only /metrics counts them. The message says which case applies.
Smaller changes
docs/REPORTING.md no longer suggests passing a capture of stdout to disclose: stdout carries findings, not the {ts, report} envelopes it reads. The official public example disclosure moves to perf-sentinel 0.33.0, with the published binary's binary_hash and a rebaked content_hash, and the sample on the website is signed from it. lopdf moves to 0.46, and tokio to 1.54.1 against RUSTSEC-2026-0386, where AsyncFd::new and the related constructors violated I/O safety. perf-sentinel does not call them itself.
Upgrade impact
- Nothing changes without the key.
findings_stdoutdefaults totrue, so stdout keeps its NDJSON lines. - A log pipeline that reads findings from stdout loses them with
false. Read them from the Hub, the archive or the query API instead. - One new configuration key, one new
/api/configfield. No route, metric or wire format change, no detector, normalizer or finding signature change, the disclosure schema stays v1.8, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.
Full detail in CHANGELOG.md.
Verifying this release
# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
--repo Institut-du-Numerique-Responsable/perf-sentinel
# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
--attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
--expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.34.0" \
--expected-issuer "https://token.actions.githubusercontent.com" \
--verify-binary ./perf-sentinel-linux-amd64gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.