Skip to content

CF Scanner v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 03:36
v2.0.0
80f7114
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CF Scanner v2.0.0

CF Scanner v2 unifies the Web console, management API, and Agent API behind one public origin, and permanently removes the shared Agent-token compatibility layer.

Highlights

  • One public origin configured by CFSCAN_PUBLIC_URL.
  • Recommended routing:
    • /api/* → Center
    • /healthz → Center
    • /* → Web
  • Browser-approved Agent pairing and preauthorized deployment remain the only enrollment methods.
  • Every Agent uses its own long-term Bearer credential and saved identity.json.
  • Go module path is now github.com/3011/cfscan/v2.

Breaking changes

The following v1 compatibility surfaces were removed:

  • CFSCAN_AGENT_TOKEN shared authentication;
  • POST /api/v1/agent/register;
  • legacy Agent name, region, and continent registration environment variables;
  • auth_mode in the API and database;
  • agent_id in heartbeat, task-claim, and result-upload request bodies;
  • CFSCAN_PUBLIC_WEB_URL and CFSCAN_PUBLIC_AGENT_URL.

Agents must have a valid per-Agent identity created by connect or join. A v1.1.x Agent that still relies on the shared token must be enrolled before upgrading to v2.

Upgrade guide

  1. Back up PostgreSQL.
  2. Confirm every existing Agent already uses a per-Agent identity.json.
  3. Configure one HTTPS origin with CFSCAN_PUBLIC_URL.
  4. Route /api and /healthz directly to Center, and / to Web.
  5. Update each saved identity's server_url to the unified origin.
  6. Upgrade Center, Web, and Agents to v2.0.0.
  7. Remove the old Agent-only Ingress, hostname, certificate, and shared-token Secret.

Existing Agent IDs, credentials, tasks, and scan history remain valid when upgrading from v1.1.x per-Agent identities.

Downloads

Release archives contain the Center, Agent, license, notice, and changelog for Linux amd64 and arm64. Verify downloads with the adjacent SHA-256 files:

sha256sum -c cfscan-linux-amd64.tar.gz.sha256
sha256sum -c cfscan-linux-arm64.tar.gz.sha256

Container images

ghcr.io/3011/cfscan-server:v2.0.0
ghcr.io/3011/cfscan-agent:v2.0.0
ghcr.io/3011/cfscan-web:v2.0.0

OCI index digests:

cfscan-server  sha256:27c923af2c2fb2dd17cc922edb5e7834860f9d9e9771f072beb0d576d1ab0164
cfscan-agent   sha256:513ed7b15a44a03ce930306ac0118abf37d2e2a438943fdb68594f20ead62e66
cfscan-web     sha256:84a944d765b39125e07a9adf477c7ca9f5f089aab4fb000c8a27f401dfce336a

Each image includes linux/amd64, linux/arm64, SBOM, and provenance attestations. The latest tag points to the same OCI indexes.

Security and responsible use

Center stores only hashes of pairing keys and Agent secrets. Production Agents should connect only over HTTPS. CF Scanner performs active network measurements; use it only on systems and address ranges you own or are authorized to test.

CF Scanner is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc.

Assets 6
Loading