v2.6.3

A maintenance release. The sandbox binary is unchanged from v2.6.2; this
release only fixes building ai-jail from source under Nix on recent kernels.

Backward compatible: every pre-2.6.3 .ai-jail keeps working.

Fixed

• nix build no longer fails its checkPhase on kernels with Landlock
  ABI ≥ 6 (Linux ≥ 6.12). Nix's builder hardening wraps Linux builds in an
  outer, scope-only Landlock layer; under stacked-layer semantics, as soon as
  ai-jail's own filesystem ruleset makes the domain filesystem-applicable, the
  outer layer (which grants no REFER) denies every cross-directory rename
  with EXDEV, so the landlock_allows_cross_dir_rename_* integration tests
  failed and landlock_denies_rename_out_of_readonly_map passed vacuously.
  The REFER tests now run a probe outside the jail and skip themselves when an
  outer Landlock domain denies reparenting to a nested ruleset, since ai-jail's
  inner REFER grants are unmeasurable there. On an ordinary host (no outer
  Landlock) the tests still run and pass as before. Thanks to @pqitr (#150).

Checksums (SHA256)

31c44e8f4da78bc4bad7b4d0ba4e0c2578eec8035594e13744764c6b108eef95  ai-jail-linux-x86_64.tar.gz
dc466ba94f99ab179f525e0d5749dbed7d81c7832c677d090fb5745a78365848  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail