Skip to content

Nimstead Assure 0.1.0 (early access)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ciaranwhiteside ciaranwhiteside released this 27 Oct 21:17
· 12 commits to main since this release
v0.1.0
24f0d23

The first early-access release of Nimstead Assure: self-hosted vulnerability management that finds what's vulnerable, fixes it safely, and proves it to an auditor.

git clone --branch v0.1.0 https://github.com/Nimstead/assure.git && cd assure && cp .env.example .env

Set POSTGRES_PASSWORD in .env to a long random value, then run docker compose up -d and open http://localhost:8000. The install guide covers HTTPS, enrolling machines and turning on automated fixes.

What's in it

  • Detection on Debian, Ubuntu, RHEL family, Alpine, SUSE and Windows (OS updates from MSRC, plus about 18 common apps), and in your applications from CycloneDX or SPDX SBOMs. Matched with each ecosystem's own version rules, so backported fixes aren't flagged.
  • Prioritisation by what attackers actually exploit (CISA KEV, EPSS), then CVSS, criticality and exposure, with the reason written next to every score. You see upgrades, not CVE lists.
  • Remediation with apt, dnf, apk, zypper and Windows cumulative updates: dry run, rollback copy first, canaries first, health checks, automatic rollback, and success only when the next inventory confirms it.
  • Evidence: a hash-chained ledger with signed checkpoints, and Ed25519-signed packs mapped to Cyber Essentials, ISO 27001, NIST, PCI DSS and CIS that your auditor verifies offline.
  • External scanning of internet hosts you prove you own, OIDC single sign-on, webhook and email alerts, Vault and S3 object-lock key storage.

Proven, not just tested

579 API tests on SQLite and PostgreSQL 17, plus end-to-end runs on real machines: fixes and rollbacks on Debian 13, Ubuntu 24.04, AlmaLinux 9, Alpine 3.21, openSUSE Leap 16.0 and Windows Server 2025; real Keycloak, DNS, SMTP, webhooks, Vault and S3; and this Docker Compose install with a real agent. Details and logs: STATUS.md.

Before you rely on it

This is early access. Expect rough edges and breaking changes before 1.0. Start on test machines: automated fixes only touch machines enrolled as sandbox until you turn on production remediation. Known limitations.

Files

  • nimstead_agent.py: the agent, also served by your server at /agent/nimstead_agent.py. One standard-library Python file (3.9+), version 0.1.0.
  • SHA256SUMS: checksums for the files above.

Feedback

Open an issue or email dev@nimstead.systems. Security issues: security@nimstead.systems, never a public issue.

Licensed under FSL-1.1-ALv2: use and self-host it for anything except a competing product. This release becomes Apache 2.0 on 2028-10-27.

Assets 4
Loading