v1.5.0

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

• 3c60c88: feat(engine): commit the console screenshot harness, and recapture (@fornex)
• 08f8164: feat(metrics): split the data-plane rung out of the announced-route gauges (@fornex)
• 46bd435: feat(site): the landing's fourth verb — kapkan drops packets too (@fornex)

Fixes

• 801739e: fix(api): active attacks reported the weakest second of their life (@fornex)
• 6dbe2c2: fix(metrics): qualify the two-gauge comparison to real mode, and pin the fallback contract (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.5.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.5.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing