Institut-du-Numerique-Responsable/perf-sentinel v0.37.1 on GitHub

What's new in v0.37.1

v0.37.1 fixes three edges of the detection ledger that v0.37.0 shipped. Detection, scoring and the counts themselves are unchanged.

Findings first when the daemon stops

On a graceful shutdown the Hub export drains what it still holds, for up to 10 seconds. Each drain round sent one findings batch, then every page of every ledger day that changed since the Hub last accepted it, before the next findings batch. After a long Hub outage, several days of detection pages could use up the budget, and the findings still pending were dropped. The ledger's last push now waits until the findings, incidents and correlation episodes are sent.

Smaller fixes

A GET /api/detections page now stays near its 4 MiB budget when signatures hold " or \. The size estimate counted a signature's raw bytes and missed the JSON escapes, so 5000 such signatures could serve a body of about 7.9 MB.
perf-sentinel hub analyze --from and --to accept epoch milliseconds, as hub findings does, through the same parser.

Upgrade impact

Nothing to change. No configuration key is added or removed, no route, metric or wire format changes, and the ledger's counts and the push contract stay as in v0.37.0.
No finding appears, disappears or changes signature, acknowledgments keep matching, the disclosure schema stays v1.8, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.

Full detail in CHANGELOG.md.

Verifying this release

# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
  --attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
  --expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.37.1" \
  --expected-issuer "https://token.actions.githubusercontent.com" \
  --verify-binary ./perf-sentinel-linux-amd64

gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.