Skip to content

Releases: fornex/kapkan

Release list

v1.6.0

v1.6.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 10:54
v1.6.0
bd2c353
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

  • de7b75e: feat(api): node self-reports and poll-based liveness — reports are advisory, the poll is the signal (@fornex)
  • f2ba92f: feat(api): the agent role — a scrub node's credential, off the privilege ladder (@fornex)
  • 5a61302: feat(api): the scrub-node rules channel — long-poll GET /api/v1/dataplane/rules (@fornex)
  • e6b0b7d: feat(cmd): kapkan scrub — the scrub-node role, same binary, no second product (@fornex)
  • dd40262: feat(console): the Nodes view — scrub-node inventory with provenance kept honest (@fornex)
  • ac20c37: feat(engine): --allow-live capture for the data-plane screenshots (@fornex)
  • cb0ec83: feat(mitigate): frozen scrubbing-node choice + re-announce on node loss (@fornex)
  • 1b52bbd: feat(site): a dedicated /xdp landing for in-kernel mitigation (@fornex)
  • f9e2a7f: feat(site): derive the landing's version from CHANGELOG at build time (@fornex)
  • 05ba6cc: feat(site): rewrite landing copy in plain language, add an 'under attack now' lane (@fornex)
  • 8db32ae: feat(site): the integrated-mitigation comparison row (M4.11) (@fornex)
  • a814d69: feat(site): translate the /xdp landing to ru/de/fr/es (@fornex)

Fixes

  • 11867ca: fix(mitigate): a divert ban to a managed scrub node must carry its drop rules (@fornex)
  • e60183f: fix(site): add XDP to the top nav, and redraw the pipeline diagram (@fornex)
  • e67f648: fix(site): the /xdp page had its own top menu — use the site's (@fornex)
  • 2e1f2a7: fix(site): the /xdp showcase was a settings screenshot — show the attack instead (@fornex)

Other

  • b2fc00e: build(release): ship the BPF license texts and gate releases on the kernel matrix (M4.10) (@fornex)
  • 772d94b: build: go 1.26.6 for six reachable stdlib security fixes (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.6.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.6.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Assets 11
Loading

v1.5.0

v1.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 08:48
v1.5.0
3b6878b

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

  • 3c60c88: feat(engine): commit the console screenshot harness, and recapture (@fornex)
  • 08f8164: feat(metrics): split the data-plane rung out of the announced-route gauges (@fornex)
  • 46bd435: feat(site): the landing's fourth verb — kapkan drops packets too (@fornex)

Fixes

  • 801739e: fix(api): active attacks reported the weakest second of their life (@fornex)
  • 6dbe2c2: fix(metrics): qualify the two-gauge comparison to real mode, and pin the fallback contract (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.5.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.5.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Loading

v1.4.0

v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 16:29
v1.4.0
1d579e3

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

  • e7445ac: feat(config): freeze the data-plane and multi-node scrubbing schema (@fornex)
  • 5d9d982: feat(dataplane): kapkan dataplane status, a read-only pin inspector (@fornex)
  • 7a9d246: feat(dataplane): load, size, attach and adopt the XDP program (@fornex)
  • 9e09a0a: feat(dataplane): prove the block rate, the kernel floor, and the filter's one blind spot (@fornex)
  • f64ba22: feat(dataplane): the XDP program, its maps, and a per-source rate limiter (@fornex)
  • 7c6ef8c: feat(dataplane): wire detection to a dropped packet (@fornex)

Fixes

  • 85753d5: fix(dataplane): renew the in-kernel deadline while an attack is still running (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.4.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.4.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Loading

v1.3.1

v1.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jun 09:40
v1.3.1
7f6fdf4

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Fixes

  • b7e15aa: fix(console): apply inline styles via CSSOM so the strict CSP can't block re-renders (@fornex)
  • 66288b3: fix(console): cache-bust dashboard assets so upgrades reach the browser (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.3.1
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.3.1
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Loading

v1.3.0

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jun 20:53
v1.3.0
bb9559e

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.3.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.3.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing
Loading

v1.2.1

v1.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 18:19
v1.2.1
0df2696
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Fixes

  • 8a2bb76: fix(engine): don't count sFlow samples as flows (flows_per_sec was a duplicate of pps) (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.2.1
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.2.1
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Loading

v1.2.0

v1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jun 20:37
v1.2.0
5f4e38e

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

  • cbb942b: feat(cli): nginx-style kapkan -s reload|stop|quit via pid file (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.2.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.2.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing

Contributors

fornex
Loading

v1.1.0

v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jun 20:25
v1.1.0
0d50029

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.1.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.1.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing
Loading

v1.0.0

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jun 17:35
v1.0.0
566e16d

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Verify the download

VER=v1.0.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER}_linux_amd64.tar.gz"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing
Loading