v1.6.0

Curated notes — including any BREAKING or Config changes — are in
CHANGELOG.md.

Changelog

Features

• de7b75e: feat(api): node self-reports and poll-based liveness — reports are advisory, the poll is the signal (@fornex)
• f2ba92f: feat(api): the agent role — a scrub node's credential, off the privilege ladder (@fornex)
• 5a61302: feat(api): the scrub-node rules channel — long-poll GET /api/v1/dataplane/rules (@fornex)
• e6b0b7d: feat(cmd): kapkan scrub — the scrub-node role, same binary, no second product (@fornex)
• dd40262: feat(console): the Nodes view — scrub-node inventory with provenance kept honest (@fornex)
• ac20c37: feat(engine): --allow-live capture for the data-plane screenshots (@fornex)
• cb0ec83: feat(mitigate): frozen scrubbing-node choice + re-announce on node loss (@fornex)
• 1b52bbd: feat(site): a dedicated /xdp landing for in-kernel mitigation (@fornex)
• f9e2a7f: feat(site): derive the landing's version from CHANGELOG at build time (@fornex)
• 05ba6cc: feat(site): rewrite landing copy in plain language, add an 'under attack now' lane (@fornex)
• 8db32ae: feat(site): the integrated-mitigation comparison row (M4.11) (@fornex)
• a814d69: feat(site): translate the /xdp landing to ru/de/fr/es (@fornex)

Fixes

• 11867ca: fix(mitigate): a divert ban to a managed scrub node must carry its drop rules (@fornex)
• e60183f: fix(site): add XDP to the top nav, and redraw the pipeline diagram (@fornex)
• e67f648: fix(site): the /xdp page had its own top menu — use the site's (@fornex)
• 2e1f2a7: fix(site): the /xdp showcase was a settings screenshot — show the attack instead (@fornex)

Other

• b2fc00e: build(release): ship the BPF license texts and gate releases on the kernel matrix (M4.10) (@fornex)
• 772d94b: build: go 1.26.6 for six reachable stdlib security fixes (@fornex)

Install

No build toolchain needed — grab a prebuilt artifact for linux amd64/arm64.

Debian / Ubuntu (.deb) — sets up the systemd unit, the kapkan user, and a
dry-run config under /etc/kapkan:

VER=v1.6.0
curl -fLO "https://github.com/fornex/kapkan/releases/download/$VER/kapkan_${VER#v}_linux_amd64.deb"
sudo apt install "./kapkan_${VER#v}_linux_amd64.deb"

RHEL / Fedora (.rpm): sudo dnf install ./kapkan_<ver>_linux_amd64.rpm

Tarball (any distro): download kapkan_<ver>_linux_<arch>.tar.gz below, tar xzf
it, and run ./kapkan. See the Quickstart.

Verify the download

VER=v1.6.0
base="https://github.com/fornex/kapkan/releases/download/$VER"
curl -fLO "$base/kapkan_${VER#v}_linux_amd64.tar.gz"   # archive names drop the leading "v"
curl -fLO "$base/checksums.txt"
curl -fLO "$base/checksums.txt.sig"
curl -fLO "$base/checksums.txt.pem"
# 1) authenticity: signature over checksums.txt, pinned to this repo's release tag
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/fornex/kapkan/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2) integrity: hash of the downloaded archive (shasum -a 256 -c on macOS)
sha256sum -c checksums.txt --ignore-missing