Skip to content

Nimstead Assure 0.2.0 (early access)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ciaranwhiteside ciaranwhiteside released this 28 Oct 10:06
· 7 commits to main since this release
v0.2.0
5a63015
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security release. A Claude Security scan of the whole repository found 21 issues (12 medium, 9 low); all are fixed, each with a test, and everything that touches real systems was rerun against them: a Windows 11 VM attacked by a standard user, real Keycloak/SMTP/webhook services, real external-scan targets, the Docker Compose install, and the full suite on PostgreSQL 17. Upgrade, and read "What changes for you" first.

Security fixes

  • Windows agent 0.1.3: a standard user who created C:\ProgramData\Nimstead before the agent was installed could keep reading the agent key, and a junction planted there could make the elevated agent delete another user's files. The agent now takes the folder first, never follows junctions, and locks it before the key is written.
  • Tenant isolation: read-only members can't upload SBOMs (which resolved findings); one organisation can't block or discover another's external targets; an unknown ecosystem from any agent can't stop everyone's hourly update; login CSRF and an open redirect in SSO start are closed.
  • Hardening: a crafted Composer version can't freeze the API; the OIDC client can't reuse a TLS connection across hostnames; spread-out failed logins can't lock the real user out; webhook URLs are encrypted at rest; agent text can't inject Slack links or mentions; install commands keep the enrolment token off the command line.
  • Evidence packs no longer ship their own verifier (get it from your server at /api/evidence/verify.py and check its SHA-256 against the one published next to the key fingerprint), and name the tenant's id and DNS-verified domains.

What changes for you

  • Sign-up no longer reveals which emails have accounts. The first account on a server is created straight away; later sign-ups finish from an emailed link, so they need SMTP. Colleagues join through SSO. NIMSTEAD_OPEN_SIGNUP=1 restores instant sign-up for development and demos only.
  • External targets must also serve their verification value at /.well-known/nimstead-verify.txt from the address being scanned (HTTPS or HTTP). Add the file to existing targets, or their scans are refused.
  • Alert email recipients must confirm before they receive alerts. Remove and re-add existing recipients in Settings to send them a confirmation.

Upgrade

git fetch --tags && git checkout v0.2.0 && docker compose up -d --build

Migrations run on start. Machines on an older agent then show Agent outdated on the Assets page; rerun the install command from the app on each one, Windows machines especially (enrolment is kept).

Files

  • nimstead_agent.py: agent 0.1.3, also served by your server at /agent/nimstead_agent.py.
  • SHA256SUMS: checksums for the files above.

Full list: CHANGELOG. This release becomes available under Apache 2.0 on 2028-10-28 (FSL-1.1-ALv2).

Assets 4
Loading