ctfkit v0.10.0

0.10.0 (2026-11-13)

Features

• action: name the action ctfkit by compliance.tf for the Marketplace listing (#46) (a0e3ad5)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.10.0

ctfkit v0.9.0

0.9.0 (2026-11-12)

Features

• sarif: rule name, help, docs link, tags and severity for code scanning (#44) (55503bb)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.9.0

ctfkit v0.8.0

0.8.0 (2026-11-12)

Features

• report: write an evidence pack with a PDF to --out-dir (#41) (ee23fc0)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.8.0

ctfkit v0.7.1

0.7.1 (2026-11-11)

Bug fixes

• analyzer: close module source and program-execution coverage gaps (#36) (85281dc)
• cli: confine output paths and harden runtask, evidence spool and markdown values (#38) (751bda1)
• gate: bind the terraform digest and refuse forked AWS providers under governed profiles (#37) (c8ade14)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.7.1

ctfkit v0.7.0

0.7.0 (2026-11-10)

Features

• action: add catalog: pull to download the full control catalog (#31) (57e6625)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.7.0

ctfkit v0.6.0

0.6.0 (2026-11-09)

Features

• catalog: add ctfkit catalog pull (#29) (43d6ce4)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.6.0

ctfkit v0.5.0

0.5.0 (2026-11-09)

⚠ BREAKING CHANGES

• catalog: with the embedded catalog, findings carry control ids and frameworks for CIS v6.0 controls only. A control-keyed exception for a control outside CIS v6.0 no longer matches; use a rule entry or load the full catalog. ctf.policy.disabled_control_unknown is reported at error level instead of warning.

Features

• catalog: embed the CIS AWS Benchmark v6.0 controls only (#28) (4daade7)

Bug fixes

• catalog: retire CIS AWS Benchmark v1.2.0, v1.3.0 and v1.4.0 (#24) (3306cd8)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.5.0

ctfkit v0.4.1

0.4.1 (2026-11-05)

Bug fixes

• drop the preview label; every shipped command is available (#22) (6003e0f)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.4.1

ctfkit v0.4.0

0.4.0 (2026-11-04)

Features

• Homebrew formula in compliancetf/homebrew-tap and a Windows arm64 build (#19) (f49cc3b)

Installation

macOS and Linux: brew install compliancetf/tap/ctfkit.

Or download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.4.0

ctfkit v0.3.0

0.3.0 (2026-11-04)

Features

• plain semver releases; the action installs the latest ctfkit by default (#17) (e1127ab)

Dependencies

• bump golang.org/x/sys from 0.48.0 to 0.49.0 in the go-patch-minor group across 1 directory (#14) (58c9037)

Installation

Download the archive for your platform and checksums.txt from the assets below, and
check the archive with sha256sum --ignore-missing -c checksums.txt before unpacking it.
.deb, .rpm and .apk packages are attached too, with an SPDX SBOM per archive.

To check that an archive was built by the release workflow from this tag:

gh attestation verify <archive> --repo compliancetf/ctfkit \
  --signer-workflow compliancetf/ctfkit/.github/workflows/release.yml \
  --source-ref refs/tags/v0.3.0