v0.3.0

GSEER v0.3.0

Discover. Identify. Search.

Self-hosted internet-asset search. Verify the archive against
checksums.txt (SHA-256) before running anything, and check
gseer doctor after installing — it prints the running binary's
SHA-256 so you can compare it with this release's checksums.

Changelog

• 99b8f9e: docs(changelog): record the ip2asn AS-name fix and the dns MX/NS addition under v0.3.0 (@Lutfifakee-Project)
• 9971942: feat: v0.3.0 — zero-config first run, personal-mode collection, ptr connector, new identity (@Lutfifakee-Project)
• 204f505: fix(ci): restore the lint and Windows gates post-push (@Lutfifakee-Project)
• 540e563: fix(collect): Cymru AS-name field 5; dns connector gains MX/NS (@Lutfifakee-Project)
• 798e685: fix(gofmt): convert 16 Go files from 8-space indent to tabs (@Lutfifakee-Project)

v0.2.2

GSEER v0.2.2

Discover. Identify. Search.

Self-hosted internet-asset search. Verify the archive against
checksums.txt (SHA-256) before running anything, and check
gseer doctor after installing — it prints the running binary's
SHA-256 so you can compare it with this release's checksums.

Changelog

• e6175c6: fix(cli): wire personal mode through to fixtures, doctor, and export (@lutfifakee)

GSEER v0.2.0 — Hardened Self-Hosted Readiness

GSEER — Release Notes v0.2.0

Hardened Self-Hosted Readiness. v0.2.0 turns the owner-approved
hardened deployment contract (OD-1…OD-7, Revision 6.7.2) into the
shipped binary: the fail-closed privilege audit gates gseer server start before the port binds, the server serves traffic only under the
least-privilege gseer_app runtime credential, and the whole hardened
deployment order is one command. It also ships the GAP-1 safe-cast
migration, the read-only gseer host inspection command, and the
release-quality round (PostgreSQL 16 + 17 matrices, fresh-install and
fresh-clone verification, real-binary E2E with negative security
tests).

Highlights

• Fail-closed privilege audit, in-binary (OD-5). gseer server start runs the embedded effective-privilege audit under gseer_app
  before binding: missing grants, unsafe role attributes, ownership
  violations, and escalation paths in the full membership closure
  refuse startup with the complete failure list (exit code 5). No
  flag, env var, or config key can skip it.
• Runtime credential switch (M-B). Operator (GSEER_DB_DSN) vs
  runtime (GSEER_DB_RUNTIME_DSN) credentials are distinct; the
  runtime identity is gseer_app, provisioned and least-privileged by
  the pinned Rev 6.7.2 grant matrix. The server refuses to serve as
  anything else (E_RUNTIME_CREDENTIAL_MISMATCH, exit 5). CLI
  data-plane commands prefer the runtime credential and say so when
  they fall back.
• Migration 0016 (pinned) + 0017 (safe-cast, GAP-1). The
  gseer_policy enforcement layer with SECURITY DEFINER policy
  functions (all suppression writes; direct DML refused with GSUP2),
  and search-safe casts so malformed evidence can no longer break
  search/facets/export. Versions 0007–0015 are permanently reserved
  (OD-4). All artifacts are embedded byte-for-byte and hash-enforced
  by the test suite.
• Hardened setup in one command. gseer setup --self-hosted runs
  bootstrap → migrate → runtime grants → privilege audit, provisions
  the gseer_app password (printed once; --runtime-password-env for
  deterministic/compose provisioning; --reset-runtime-password to
  rotate), and refuses the deployment on any audit failure.
• gseer host <ip|hostname|domain> — read-only host inspection
  (asset + services + latest HTTP/TLS/fingerprints + provenance;
  -o json).
• PostgreSQL 16+ minimum (OD-7). Enforced by setup and doctor;
  verified end-to-end on 16.15 and 17.2.
• Source-provenance fix. Collected assets now carry the source name
  (sources facet, gseer host) — previously only fixture rows did.

Compatibility changes (read before upgrading)

• PostgreSQL 16+ is required (was 15+). Upgrade the cluster first
  (docs/UPDATE.md §8).
• The server requires the runtime credential. A v0.2.0
  gseer server start without GSEER_DB_RUNTIME_DSN refuses with
  E_RUNTIME_CREDENTIAL_REQUIRED (exit 3); with a DSN that is not
  gseer_app, it refuses with E_RUNTIME_CREDENTIAL_MISMATCH
  (exit 5). Run gseer setup --self-hosted once to provision.
• Migrations moved out of server start into gseer setup --self-hosted (the operator credential's job — the runtime
  credential is denied the migration ledger by design). The audit
  verifies the schema before any traffic.
• Exit code 5 now also covers security refusals (failed privilege
  audit, runtime-credential identity mismatch) in addition to the
  client-profile 401 case — see the exit-code table in
  docs/DEPLOYMENT.md §3.4.
• Rollback = previous binary + restored backup; the v0.1.0 binary
  keeps working on the unchanged GSEER_DB_* configuration.

Supported PostgreSQL versions

Version	Status
17.x	Supported — verified end-to-end (17.2)
16.x	Supported — verified end-to-end (16.15); minimum (OD-7)
15.x	Not supported for v0.2.0 (the v0.1.0 binary remains the 15-compatible release)

Release artifacts

v0.2.0 is a source-only self-hosted release: the source archive
GSEER-v0.2.0-source.zip + its SHA-256 sidecar. No prebuilt binaries,
no published image, no hosted update channel (docs/INSTALL.md). The
build is reproducible: two fresh-clone builds with the same toolchain
and flags produce byte-identical binaries.

Verification evidence (this release)

• Unit suites: 19 packages green. Integration suites (-tags integration): green on PostgreSQL 16.15 and 17.2 — hardened setup,
  migration up/down round-trips, suppression policy paths, the v0.1.0 →
  v0.2.0 upgrade path, search/planner/facets, export, fixture
  round-trip, collect/redrive.
• Real-binary E2E on both majors: hardened setup → doctor (6 PASS,
  0 FAIL) → fixtures → search/facets/export → suppress (policy
  functions) → gseer host → authorized DNS collection → server start
  (audit under gseer_app) → health → graceful stop.
• Negative security tests: revoked grant → exit 5 with the GSUPF list;
  decoy DML grant on public.suppressions → caught twice, exit 5;
  operator DSN in runtime_dsn → exit 5.

Known limitations (honest)

• Self-hosted index only — no global dataset, no hosted search service,
  no FOFA/Shodan equivalence of any kind. You search exactly what your
  own reviewed sources collected.
• The client-profile CLI cannot present the API's Bearer token (use
  curl -H "Authorization: Bearer …").
• Passive DNS facts are asset-level: resolved IPs are searchable with
  source provenance, but the resolving name is on the observation's
  evidence, not mirrored into the asset's hostname/domain columns.
• RDAP and crt.sh/CT connectors stay disabled pending provider terms
  (enforced in code — docs/SOURCES.md).
• Suppression IDENTITY sequence gaps are cosmetic (0016's in-migration
  refusal probes consume values; register R7).
• No prebuilt binaries and no hosted update channel yet (binary
  distribution is the EU-3 roadmap item).

Documentation

docs/QUICKSTART.md (canonical verified workflow), docs/INSTALL.md,
docs/DEPLOYMENT.md (credential model + hardened startup + audit),
docs/DOCKER.md (hardened full stack), docs/UPDATE.md (§8: the
v0.1.0 → v0.2.0 upgrade runbook), docs/ROADMAP.md (release register),
CHANGELOG.md (full change list).

GSEER v0.1.0 — First Useful Self-Hosted Release

GSEER v0.1.0 — Release Notes

GSEER

GSEER is an open-source, self-hosted internet-asset intelligence and
search engine. You point it at identifiers you care about, its passive
collectors gather public facts about them (DNS records, ASN ownership),
and you search everything it has indexed with a simple query language
(GQL) — through a CLI, a REST API, and a built-in dashboard.

Everything runs on your machine: your database, your data, your rules.

GSEER is not a FOFA clone and makes no claim of global internet
coverage. It is a self-hosted search engine over data you collect.

License: GNU Affero General Public License v3.0 (AGPL-3.0) — see
LICENSE.

v0.1.0 — First Useful Self-Hosted

GSEER v0.1.0 is the first useful self-hosted release: a source-only
distribution that gives operators a local search engine over their own
passively collected asset data. Nothing collects uninvited, and search is
always read-only — GSEER does not scan the internet.

What's included

• GQL search — one query language across CLI, REST API, and dashboard;
  read-only by design (a query can never trigger collection or mutate
  data). Surfaces: gseer search, GET /api/v1/search, dashboard.
• Faceted search — port/protocol/technology/service/country/source/
  freshness aggregates over the same GQL filter
  (gseer search --facets, GET /api/v1/facets, dashboard facet panel).
• Export — streamed JSON / CSV / NDJSON with cursor-stable pagination
  (gseer export, GET /api/v1/export).
• Fingerprint rules — a lint-gated, versioned rule collection (22 seed
  rules across web-server / cms / language / framework / web-tech /
  service families) that classifies observed evidence into technology
  products with confidence (gseer rules list|validate).
• Passive collection — explicit, operator-driven collectors with a
  terms-review gate, checkpoints, dead-letter bookkeeping, and re-drive.
  Reviewed-enabled: dns, ip2asn. Held disabled pending provider
  authorization: rdap, ct (gseer source, gseer collect).
• Suppression policy — block IPs/CIDRs/domains from your index,
  retroactively if needed (gseer suppress); enforced at ingestion and
  by a database backstop trigger.
• Docker stack — gseer setup --with-compose --full writes a db +
  server compose file with healthchecks, a persistent volume, and a
  generated API token (docs/DOCKER.md). The image is built locally
  from the Dockerfile, not pulled from a registry.
• Signed updater mechanism — gseer update --check|--apply verifies
  an Ed25519-signed manifest against a key embedded in the binary before
  anything is downloaded or replaced (atomic rename with .bak backup
  and rollback; docs/UPDATE.md).

Security and data-collection limits

• Search ≠ Scan — no port-scanning, banner-grabbing, or internet
  enumeration exists in this release; gseer scan is planned, not
  shipped. Invoking it prints a pointer and exits 64.
• Nothing runs uninvited — no background collection daemon or automatic
  collection scheduler; every collection run is an explicit operator command
  gated by the terms register.
• Passive facts are asset-level only — a DNS answer proves a name was
  published; it never invents ports, banners, or HTTP titles.
• No global index — a fresh install has an empty database; you search
  exactly what your sources collected. GSEER is the engine, not a hosted
  service.

Requirements

• Go 1.26+ — required to build from source (per go.mod).
• PostgreSQL 15+ — self-hosted, or via the bundled compose stack
  (postgres:17-alpine); v0.1.0 is verified against PG 17.

Getting the source and building

v0.1.0 is distributed as source only. The artifact is the source archive
GSEER-v0.1.0-source.zip together with its SHA-256 checksum sidecar
GSEER-v0.1.0-source.zip.sha256. Both files must be placed in the same
directory before verification.

The checksum published with v0.1.0 covers only the source archive.
There are no binary checksums in this release. The SHA-256 printed by
gseer doctor is a self-reported running binary fingerprint for
diagnostic purposes and must not be compared against the source archive
checksum — they are different artifacts.

Verify the downloaded source archive from the directory containing both
files. Do not claim verification succeeded if the .sha256 sidecar is
not present.

set -eu

ARCHIVE="GSEER-v0.1.0-source.zip"
CHECKSUM="GSEER-v0.1.0-source.zip.sha256"

# Verify the source archive checksum.  Abort if the sidecar is absent.
sha256sum -c "$CHECKSUM"

# Extract source archive into a temporary directory.
TMP="$(mktemp -d)"
unzip -q "$ARCHIVE" -d "$TMP"

# Enter the extracted source directory (git archive prefix).
cd "$TMP/GSEER-v0.1.0"

# Build from extracted source.  Version is stamped via ldflags.
make build VERSION=v0.1.0

# Verify binary version and help surface.
./bin/gseer version
./bin/gseer --help

Build verification does not require Docker or PostgreSQL. It only
requires Go 1.26+.

For self-hosted provisioning, Docker Engine and the Docker Compose
plugin are prerequisites when using Compose. gseer setup supports two
profiles:

• client — configures a remote endpoint URL (--server). client.endpoint
  is required for this profile.
• self-hosted — verifies PostgreSQL reachability, checks PostgreSQL
  version (15+), and runs migrations to head.

gseer setup --self-hosted --with-compose writes a db-only
docker-compose.yml and a generated .env first, then stops. On a
fresh machine the database only exists once Compose starts it, so the
continuation is:

set -eu

# Write Compose stack and .env (does not start containers).
gseer setup --self-hosted --with-compose

# Start PostgreSQL.
docker compose up -d db

# Verify PostgreSQL is healthy before proceeding.
# Inspect `docker compose ps db` output and confirm status is "healthy".
# Do not proceed until PostgreSQL reports healthy.
docker compose ps db

# Initialize schema/migrations only after db is healthy.
gseer setup --self-hosted --db-url "$(grep '^GSEER_DSN=' .env | cut -d= -f2-)"

# Diagnose installation.  Expect PASS with an honest EMPTY index.
gseer doctor

--with-compose writes files first and stops. If an existing
docker-compose.yml already defines a db service, reuse that
configuration instead of overwriting it. Do not overwrite an
operator-edited docker-compose.yml.

gseer doctor reports an honest EMPTY index on a fresh install; it does
not claim PASS on an unconfigured environment.

Source-only distribution

The only downloadable release artifact for v0.1.0 is the source
archive GSEER-v0.1.0-source.zip. There are no prebuilt platform
binaries, no binary packages, and no published Docker image for this
release. Docker images are built locally
(docker build --build-arg VERSION=v0.1.0 -t gseer:local .), not
pulled from a registry. The SHA-256 checksum published with v0.1.0
covers the source archive — there are no binary checksums in this
release.

Signed updates — bring your own manifest

The signed-update mechanism is implemented and shipped in v0.1.0, but
GSEER does not host an official manifest or update feed for this
release. gseer update requires an operator-provided
GSEER_UPDATE_MANIFEST_URL pointing to a manifest signed with the Ed25519
key embedded in the binary. Without a configured channel it refuses with
E_UPDATE_NO_CHANNEL. A new installation does not automatically have
an active update channel; the operator supplies and verifies their own
manifest (key ceremony and recovery: docs/UPDATE.md §3–§4).

What is not in v0.1.0

• Global internet index or hosted search service (no FOFA-scale coverage).
• Active scanning / service observation (gseer scan, gseer asset —
  planned for a later phase; both exit 64 in v0.1.0).
• Prebuilt binaries for Linux, macOS, or Windows.
• Published Docker image / container registry.
• Official hosted update feed or automatic update channel.

Platform support is limited to where the CI matrix runs; no platform is
officially verified as a binary target in v0.1.0. Claims beyond this are
not made.

Documentation

• docs/QUICKSTART.md — canonical fresh-install workflow
• docs/INSTALL.md — build from source, local Docker image
• docs/DOCKER.md — full self-hosted stack: startup, upgrade, backup/restore
• docs/UPDATE.md — signed-update chain, key ceremony, recovery
• docs/SOURCES.md — passive data-source review register
• docs/RULES.md — fingerprint rule format and contributions
• docs/ROADMAP.md — release register
• CHANGELOG.md — per-release changes