Skip to content

Releases: microsoft/rego-cpp

v1.2.0

08 Jan 15:49
d8f1413

Choose a tag to compare

Minor version fixing some bugs.

Bug Fixes

  • When passing a value to sprintf using %v as the format specifier, the
    interpreter would JSON-escape the result in all cases, even if the argument
    already a valid JSON string. This could result in double-escaping strings in
    some contexts, which was an unintended behavior and a discrepancy between with
    the reference implementation. The interpreter will now pass JSON strings
    unchanged to sprintf when used in this way.
  • Two rules in rego_to_bundle were being shadowed. This did not affect the
    functionality of the compiler but had resulted in an incorrect error message
    being generated and in another case a rule which would never be matched.

v1.1.0

03 Nov 21:47
a511ff6

Choose a tag to compare

Minor version adding more json builtins and an improved built-in system.

This change adds some json builtins and also completely refactors the built-in
system to make it more efficient. It also adds some quality of life improvements
to the C++ API. The C API remains stable, but the C++ API exposes additional
methods to make handling outputs of queries a bit easier.

New Features

  • json.filter, json.patch, and json.remove are now available
  • All built-ins are now accounted for in the built-in system, and those which
    are not supported are explicitly marked as such.
  • There is now an Output class, which is returned from the new query_output
    method on Interpreter. It provides methods which are similar to those available
    in the C API for inspecting the output of a query.
  • There are now try_get_double, try_get_string, and try_get_bool methods
    which will attempt to get raw C++ types from Node objects.
  • The whitelist and blacklist methods in BuiltInsDef provide fine-grained
    control over which built-ins are allowed to be loaded.
  • The stmt_limit method on Interpreter provides a time-out mechanism (defined
    as number of statements which the VM is allowed to execute)

Improvements

  • The Interpreter object can now be created at almost no cost. A large portion
    of its construction cost was the creation of the BuiltIns lookup structure,
    which now is defined statically in-code.
  • The test driver can now run all the tests in the OPA test suite and will skip
    those which use a built-in that is not available in the current implementation.
    This means we do not have to cherry-pick tests anymore, and will pick up
    new tests more cleanly.
  • New methods for creating scalar nodes have been added (number, boolean,
    string, null) and the existing scalar methods have been deprecated.

Breaking Changes

  • The get_string method, which previously returned the raw string of the Trieste
    node, now tries to get a string from a JSONString node and strips it of its
    quotes (in line with the other get_* methods). The previous functionality is
    available via get_raw_string.

Bug Fixes

  • Fuzzer bug with SomeDecl in a NotExpr
  • An issue with built-ins not being written to binary bundles
  • A unification bug with variables in comprehensions that had the same name as their module
  • regopy now performs some additional checks to ensure it is loading the correct
    shared library on all platforms
  • Ubuntu 22.04 builds are now working again and the image has been added back to the workflow
  • macos/x86_64 image has been added back to the workflow, and shared library builds
    (for the Python and dotnet wrappers)
  • Unification bug with masking scopes and variables with comprehensions and every

v1.0.1

21 Oct 10:24
6dee78d

Choose a tag to compare

The v1.0.0 release inadvertently broke Ubuntu 22.04 builds. This release fixes that, and adds a workflow job to explicitly build on 22.04 to avoid regression in the future. There are no changes to the public API.

v1.0.0

18 Oct 08:38
b51e903

Choose a tag to compare

Major version adding VM-based execution of bundles.

This is a massive, breaking change (in the spirit of the Rego v1 change) with a
wide range of beneficial but impactful repercussions. We will do our best to
summarise them here, but for a full sense of impact you should carefully look
at the new API, the new code samples, and other artifacts to ensure everthing
still works as you expect.

New Features

  • Bundle support. The Interpreter can now compile Rego documents into bundles,
    and then save those bundles to disk in the OPA Rego bundle format. It can then
    load those bundles and execute them against new inputs.
  • We introduce a new Rego Bundle binary format for compact storage and optimised
    loading from disk. Read this document for details.
  • regoInput* C API methods for in-memory input creation.
  • regoBundle* C API methods for working with bundles.
  • The BuiltInDef API has changed to support full built-in metadata during creation.
    See the Custom Built-In example for details.
    The old API remains but has been deprecated and will be removed in a future
    release.

Improvements

  • The entire backend has been rewritten. All code is compiled and run as bundles,
    which run on an optimised virtual machine. Policies should execute an order of
    magnitude faster or more.
  • OPA Rego compatibility has been upgraded to 1.8.0
  • Interpreter logging. Interpreters running on separate threads can have their own
    logging levels.
  • output_to_string is now part of the public API
  • Apple Silicon (ARM64) is working again
  • Interpreter will only load Trieste passes on an as-needed basis, which makes
    it far cheaper to construct.
  • All builtins now have associated metadata which document their behaviour

Breaking Changes

  • Support for v0 Rego has been dropped.
  • All TZData related methods have been removed. Platforms which do not support
    cpp_lib_chrono >= 201907L will be missing builtins which require timezone
    functionality.
  • Any code which relied upon specifics of the backend implementation will no longer
    work. That is all gone.
  • The deprecated set_input_json method has been removed
  • The exposed Trieste passes have had their names changed for increased clarity.
  • The remaining C API methods which exposed raw const char* internals have been
    replaced with external-buffer-based APIs:
    • regoBuildInfo => regoBuildInfoSize/regoBuildInfo
    • regoVersion => regoVersionSize/regoVersion
    • regoGetError => regoErrorSize/regoError
    • regoNodeTypeName => regoNodeTypeNameSize/regoNodeTypeName
    • regoOutputString => removed. Use regoOutputJSON instead.
  • regoSetLogLevel => regoSetDefaultLogLevel
  • regoSetLogLevelFromString => regoLogLevelFromString
  • regoNewV1 has been removed. regoNew will always return a V1 interpreter.
  • The deprecated regoSetInputJSON method has been removed
  • regoIsBuiltin => regoIsAvailableBuiltin

Wrappers

v0.4.6 - dotnet wrapper

01 Feb 14:29
5a6b476

Choose a tag to compare

Point release adding a dotnet wrapper.

New Features

  • dotnet wrapper
  • The C API has changed slightly (added a regoOutputJSON method, as well as regoVersion and regoBuildInfo methods)
  • Python and Rust wrapper implementations have been changed to use the new regoOutputJSON method, which should aid
    in stability on some platforms
  • The Python wrapper no longer reads its version from the repository, allowing it to be built independently
  • The Python wrapper will not use a manual tzdata install by default, but will use the system tzdata if available
  • Added a rego_shared target which builds rego-cpp as a shared library

Bug Fixes

  • The Python wrapper has been broken since 0.4.0 on Windows due to a bug with DLL calling conventions.
    The whole wrapper has been rearchitected to use ctypes and the same rego-shared library as the dotnet wrapper

Caution

As of this release the MacOS python wrapper is faulty and will not work. This is under active investigation and will be
resolved in a future release.

v0.4.5

27 Sep 08:40
e64553b

Choose a tag to compare

Point release addressing some issues in the Python and Rust wrappers.

New Features

  • The Python wrapper now packages the tzdata database inside the wheel to ensure consistent performance across platforms.
  • The Rust wrapper now has the ability to download a fresh copy of the tzdata database if needed
  • Added a regoSetTZDataPath method to the C API and exposed it for the Python and Rust wrappers.
  • The regoNew C API method now supports the v1_compatible flag for interpreter creation
  • The library embeds the windowsZones.xml mapping file so it can provide it where needed
  • The Python wrapper provides a more natural interface for sets and objects
  • The CMake system will now look for a REGOCPP_TZDATA_PATH environment variable to use for setting the default path

Bug Fix

  • Fixed a bug where builtins would not be available if an interpreter was re-used
  • Fixed a bug with the Rust wrapper where it was aggressively trimming strings

v0.4.4 - Adding `time` and `uuid` builtins

24 Sep 16:10
3eb9a7c

Choose a tag to compare

Point release adding the uuid, time, and walk builtins.

In order to add support for the time built-ins that worked cross-platform and with the widest
range of C++ compilers, we had to introduce a dependency on the date
library. This contains a full implementations of the std::chrono functionality which will eventually be
supported across most c++ compilers as part of the STL. In particular, it provides the crucial Time Zone
lookup functionalities required by the Rego time built-ins. The Time Zone lookup requires a valid
tzdata database from the IANA. This can either be configured to use the local
system TZ data (default for Linux variants) or a manual database (default for Windows). If the REGOCPP_USE_MANUAL_TZDATA flag
is set, then the project will download the latest database and install it as part of its build process.

New Features

  • Added the uuid built-ins
  • Added the time built-ins
  • Added the walk built-in
  • It is now possible for BuiltInDef implementations to cache values or otherwise maintain state. To facilitate this,
    a new virtual clear() method has been added which will be called at the start of each query evaluation.

Bug Fixes

  • Fixed a bug with adding zero to negative integers.

v0.4.3 - Upgrade to Rego v0.68.0

10 Sep 13:13
cc42534

Choose a tag to compare

Point release updating to Rego v0.68.0

New Features

  • Updated the support version of Rego to v0.68.0
  • Updated to the latest build of Trieste.
  • Added a v1-compatible flag to the test driver and interpreter which forces rego-v1 compliance
  • Added code to run both the v0 and v1 OPA test suites
  • Added the new strings.count built-in
  • Improved the tool messaging around debug options

Bug Fixes

  • Fixed an issue with recursion errors being swallowed by not
  • Fixed issues where undefined values were not handled correctly during unification
  • Fixed issue with whitespace after package definitions
  • Fixed issue where internal values were lingering in rule evaluations

v0.4.2

29 Jun 13:47
eccb13c

Choose a tag to compare

Point release updating the Trieste version.

This change should address build instability due to snmalloc updates.

v0.4.1

24 Jun 17:20
b9278ad

Choose a tag to compare

Point release containing doc updates and bug fixes.

  • Updated the docs to reflect the new interfaces and outputs

Bug Fixes

  • Fixed an issue with actions attached to an In statement for some builds/environments
  • Fixed a bug with modules that start with comments
  • Fixed a bug with comprehension contexts when an assigned variable is shadowed in the body of the comprehension