Skip to content

v0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 May 23:54
v0.5.0
This tag was signed with the committer’s verified signature.
Pyronewbic Kanishka Nambiar
SSH Key Fingerprint: q0M0A0wcreflKmnrazYpxGXKV3i9GCEdRUe9MsNogjc
Verified
Learn about vigilant mode.
9d89be4
This commit was signed with the committer’s verified signature.
Pyronewbic Kanishka Nambiar
SSH Key Fingerprint: q0M0A0wcreflKmnrazYpxGXKV3i9GCEdRUe9MsNogjc
Verified
Learn about vigilant mode.

sluice learn --audit - a one-shot, open-egress discovery pass for the egress allowlist.

sluice learn proposes the allowlist from what the firewall blocked, without ever opening egress. --audit covers the one case enforce-mode can't: trusted code whose fetcher aborts on the first blocked host. It runs your command once in a throwaway, credential-stripped container with egress open to all HTTP/HTTPS hosts, then proposes the full allowlist from every host it reached.

Added

  • sluice learn --audit runs SLUICE_RUN_CMD once with egress opened to all HTTP/HTTPS hosts, then proposes the allowlist from everything it reached. Loudly warned and confirm-gated; the audit container is ephemeral and torn down after the run. Enforce-mode learn stays the default.
  • Credential-stripped by design. The audit run forwards no SLUICE_ENV, runs no SLUICE_PRELAUNCH, and mounts no persisted state dirs, so nothing sensitive can leave while egress is open. Non-HTTP ports and IPv6 stay default-DROP throughout. See THREAT_MODEL.md for exactly what it opens and keeps closed.

Changed

  • Slimmer README layout - documented as role-based top-level directories rather than a per-file tree.

Full changelog: v0.4.0...v0.5.0

Assets 2
Loading