Skip to content

ShakerScan v2.12.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 19:12
v2.12.2
3a8ae27

ShakerScan 2.12.2

Status: integration candidate on release/2.12.2; it follows 2.12.1.
The client for this release is shakerscan 0.12.0 (unchanged).

A patch release: the certificate-transparency monitor no longer leaves a gungnir process running at
every domain reload, plus two small web UI corrections. No schema changes; a rollback restores the
pre-upgrade database dump, as for every release (docs/upgrade-and-rollback.md).

Fixes

  • The CT monitor stops gungnir at every domain reload. The gungnir-worker service reloads the
    monitored root domains every five minutes by cancelling the running monitor. The process cleanup
    ran only when the monitor ended on its own, so each reload left the previous gungnir running: the
    worker gathered one more process every five minutes, each taking CPU, until the container's
    memory limit killed them. The cleanup now runs on every way out (reload, worker shutdown, error):
    gungnir runs in its own process group, the group is signalled (SIGTERM, SIGKILL after 5 s) and
    the process is reaped before the next one starts. Any install that runs the CT monitor
    (--profile gungnir) should take this release.
  • The CT monitor skips address roots. A target whose root is an IP address (for example
    10.0.0.5) is no longer passed to gungnir: certificate-transparency logs name DNS names, so
    watching an address could never match.

Interface

  • The Targets row menu offers a Hunt only to someone who may start one. "Start Hunt" (and, on
    a managed workspace, "Copy the Hunt command") now follows the hunts.manage session capability,
    the action that already decides the Hunt page's Stop. A viewer, or an installation without Hunt,
    no longer sees it (docs/session-capabilities.md).
  • A cancelled discovered-secret step-up says how to retry. The notice now says the decision was
    not made and can be chosen again to confirm it in the browser, with the terminal command as the
    alternative.

Known limits

  • The session capabilities answer hides controls; it does not authorize anything. Every request is
    still decided by the server that receives it.

Build provenance

  • Candidate commit: 3a8ae275a7f09c6aecec0f93040057153fda5308
  • Candidate workflow: https://github.com/andriyze/shakerscan/actions/runs/42643986163
  • Runtime manifest: d27c9dd93904a145aa6212a996b1ed6486ce057cab3911e26adf431250613e57
  • Certified receipt: attached as release-candidate-receipt.json
  • SBOMs: per-image/per-platform SPDX files, sbom-index.json, checksums and signature bundle attached. Scope and verification: docs/sbom.md.
  • Stable installer and latest are promoted separately after public smoke.
Assets 63
Loading