v1.4.0
Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.
Changelog
Features
- e7445ac: feat(config): freeze the data-plane and multi-node scrubbing schema (@fornex)
- 5d9d982: feat(dataplane): kapkan dataplane status, a read-only pin inspector (@fornex)
- 7a9d246: feat(dataplane): load, size, attach and adopt the XDP program (@fornex)
- 9e09a0a: feat(dataplane): prove the block rate, the kernel floor, and the filter's one blind spot (@fornex)
- f64ba22: feat(dataplane): the XDP program, its maps, and a per-source rate limiter (@fornex)
- 7c6ef8c: feat(dataplane): wire detection to a dropped packet (@fornex)
Fixes
Install
No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.
Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:
VER=v1.4.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm
Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.
Verify the download
VER=v1.4.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz" # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
--signature checksums.txt.sig --certificate checksums.txt.pem \
--certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missingContributors
fornex