open-standards/sandbox/sandbox-rs/crates
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Transaction Science 6e2004f70e
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 8s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 29s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m4s
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 1m6s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 1m9s
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 1m31s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, -p sandbox-tee --features amd-kds,intel-pcs, sandbox-rs, linux) (pull_request) Successful in 2m13s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m34s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 7m7s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m57s
sandbox-rs: wasmtime 49.0.4 -> 49.0.5 (RUSTSEC-2026-0422, -0423, -0424)
Three advisories against wasmtime 49.0.4, published 2026-10-29, each patched in
49.0.5:

- RUSTSEC-2026-0422: typed functions with i31 or nullref arguments may panic,
  from an insufficient type check.
- RUSTSEC-2026-0423: cross-engine type confusion with host-created struct types
  that have supertypes.
- RUSTSEC-2026-0424: unchecked memory use when borrowed resources pass between
  components.

The update moves only the wasmtime family (49.0.4 -> 49.0.5) and its cranelift
crates (0.136.4 -> 0.136.5). WASMTIME_VERSION, which the enforcement commitment
names, follows the lockfile, as wasmtime_version_matches_the_lockfile requires.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-30 08:32:26 -04:00
..
sandbox-attest sandbox-conformance: hold the committed pack to what the builders emit 2026-10-21 20:30:24 -04:00
sandbox-build sandbox: one report_data binding for a run, a relying-party challenge, and evidence a third party can verify 2026-10-21 07:41:40 -04:00
sandbox-capability sandbox: flow across a run's checkpoints — an untrusted read closes the sinks that follow 2026-10-21 10:49:52 -04:00
sandbox-cli sandbox: TDX on the run path, through a pinned PCK 2026-10-21 12:44:36 -04:00
sandbox-conformance sandbox-conformance: hold the committed pack to what the builders emit 2026-10-21 20:30:24 -04:00
sandbox-exec-microvm sandbox-exec-microvm: the liveness tick advances the fake counters itself 2026-10-11 10:52:05 -04:00
sandbox-exec-os sandbox: an S1 executor — a native program confined by the operating system, earning the rung by probe 2026-10-16 10:09:35 -04:00
sandbox-exec-wasm sandbox-rs: wasmtime 49.0.4 -> 49.0.5 (RUSTSEC-2026-0422, -0423, -0424) 2026-10-30 08:32:26 -04:00
sandbox-jcp jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
sandbox-mcp sandbox: one report_data binding for a run, a relying-party challenge, and evidence a third party can verify 2026-10-21 07:41:40 -04:00
sandbox-meter energy meters: a GPU counter reading low is refuted in sandbox-meter, eoc-meter and jcp-energy too 2026-10-20 04:15:36 -04:00
sandbox-proof sandbox-proof: name the hook type in the panicking-hook test 2026-10-10 18:19:11 -04:00
sandbox-proof-wasm sandbox: give the S7 locality claim something that can falsify it (SPEC §7.7) 2026-08-26 11:52:33 -04:00
sandbox-runtime sandbox: a confidential run sealed on TDX hardware, its PCK checked to Intel's root 2026-10-22 06:51:40 -04:00
sandbox-schema Add aac, map, sandbox standards; catalog the standards family 2026-06-07 17:04:36 -04:00
sandbox-tee Merge pull request 'sandbox-tee: check a TDX quote's PCK chain to a pinned Intel root' (#415) from feat/tdx-pck-chain into main 2026-10-22 06:51:24 -04:00