Skip to content

OpenVAPT v0.1.0-alpha.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 06:03
· 14 commits to main since this release
v0.1.0-alpha.4
8ac336a

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit 12bdadd; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 a54686523648143de5d5985be2f1cf862e2eff73e149f42ed4731720b0b5cd59); the full tests and the installer test ran again on exactly these binaries, and two separate builds of the same source produced identical bytes.

Verify before use: gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt (or arm64), cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github.com/OpenVAPT/openvapt/.github/workflows/release.yml@refs/heads/main$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS, then sha256sum -c SHA256SUMS. Sigstore bundles cover both binaries, SHA256SUMS, the SBOM and the vulnerability snapshot.

Changes in v0.1.0-alpha.4

Stream: round3 fixes

  • Website: until the default release includes them, pages that mention openvapt cite, --open or the default ~/openvapt-reports folder say they arrive in the next release and show what the current release does.
  • Under sudo with HOME kept, the default reports folder and its files are given back to the sudo user (checked against the user database); the base folder is checked to be a real folder owned by the expected user, and report files refuse links.
  • Installer: a non-HTTPS OPENVAPT_CHANNELS_URL or OPENVAPT_BASE_URL now stops with a clear reason; its next steps describe where reports go for the installed version.
  • report.md keeps URLs in the How to Cite block literal (fenced text); builds without a version are called "unreleased build" everywhere.
  • NIST SP 800-115 phases worded consistently (Planning, Discovery and Reporting; no Attack phase); walkthrough marks the trimmed pre-release warnings and names its last chapter Get Started; page citations label the access date.
Assets 14
Loading