Skip to content

ShadowShield 0.6.3

Choose a tag to compare

View all tags
@0xsl1m 0xsl1m released this 25 Jul 22:20
v0.6.3
cd852fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ShadowShield 0.6.3 is a post-launch production-hardening release.

Highlights:

  • Records blocked session turns exactly once and surfaces bounded detector failures through scan metadata, audit events, control-plane metrics, and Prometheus. Strict mode now fails closed on detector execution errors.
  • Hardens HTTP intake with authentication before body admission, a 1 MiB aggregate body limit, a fragmentation ceiling, one total read deadline, and authenticated protected OPTIONS requests while preserving valid CORS preflights.
  • Adds trustworthy benchmark warmup/readiness/error reporting, confusion matrices, per-category recall/FPR/balanced accuracy, and 95% Wilson confidence intervals.
  • Reduces common scan-path overhead while preserving detector behavior; focused measurements showed roughly 5–12% improvements on affected paths.
  • Pins and hashes build/runtime dependencies, verifies byte-identical double builds, pins workflow actions, and makes container tags, release evidence, provenance, and SBOM handling immutable and verifiable.

Validation:

  • 320 tests passed across Python 3.10–3.14; real-model integration passed.
  • Ruff, strict mypy, dependency audit, CodeQL, reproducible package build, and hardened container security smoke passed for the release commit.
  • Candidate image had zero fixable HIGH/CRITICAL findings with the current vulnerability database.

Upgrade notes:

  • Configure four independent high-entropy API, admin, policy-signing, and policy-state keys before exposing the control plane.
  • Balanced mode reports detector failures; strict mode blocks on them.
  • Existing 0.6.0 durable policy-state volumes still require the documented offline migration before startup.

See the changelog and production-readiness roadmap for details.

Container evidence

  • Immutable image: ghcr.io/0xsl1m/shadowshield@sha256:ddc369cd94ee8b982fd8976f2a3641bb75546a4da805ab556e97c3a80df69d9f
  • Both 0.6.3 and sha-cd852fe6f2b8a3e766fc21ae9f6360755ae50e97 resolve to that digest.
  • SLSA provenance is bound to release source cd852fe6f2b8a3e766fc21ae9f6360755ae50e97.
  • The signed CycloneDX SBOM was recovered without rebuilding or retagging from protected main commit 9b3d7ac0cb095a9b7f179eecf2693cdf9b23d17e; see the successful evidence run.
  • container-digest.txt and shadowshield-sbom.cdx.json are attached below.
Assets 4
Loading