Skip to content

v2.2.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 11:36
· 22 commits to main since this release
v2.2.2
194b505
This commit was signed with the committer’s verified signature.
had-nu André Ataíde
GPG key ID: 979AC8CE8F357652
Verified
Learn about vigilant mode.

v2.2.2 — Security Hardening + Code Quality

Security (Cordyceps Hardening)

  • CI-1 — Supply chain fix (release.yml): Syft installation replaced curl | bash with pinned binary download + SHA-256 checksum verification. Hash displayed in CI logs for PR diff visibility.
  • CI-2 — Unsigned dev images (docker.yml): Branch-triggered Docker images now use dev- namespace prefix and are signed immediately with cosign (removed tag-only gate).
  • CI-3 — Path traversal via symlink bypass: Replaced utils.SafePath with cli.ValidateInputPath/cli.ValidateOutputPath using filepath.EvalSymlinks before containment check. Migrated 33 call sites across 19+ files. Fixed TOCTOU in pkg/accept/accept.go. Fixed gap in cmd/evaluate/evaluate.go (--out-file now validates before os.Create). 33 tests including symlink escape, null bytes, shell injection, pseudo-filesystems.
  • New pkg/cli/pathguard.go: Central path validation package.

Added (11 New Commands)

Command Description
wardex trust list List all keys in the trust store with status, role, and metadata
wardex trust show <id> Display detailed info for a specific trust key
wardex trust verify Verify root signature validity and key status
wardex config show Display configuration metadata and SHA-256 hash
wardex auth status Show trust store integrity with key counts
wardex auth verify --actor Verify actor permissions against the trust store
wardex contract verify Compute SHA-256 hash of a contract file
wardex assets inventory Display ICT asset inventory with criticality and exposure
wardex hmac sign Compute HMAC-SHA256 signature for file integrity
wardex convert kev Convert CISA KEV catalogue to Wardex YAML format
wardex chain seal Create SHA-256 chain seal of all artifacts in a directory

Code Quality (PR #102)

  • Consolidated atomic writes (pkg/atomicwrite) — fixed temp-file leak
  • Shared gate pipeline (pkg/gate) — DRY between evaluate and wardex commands
  • runEvaluate() decomposed from CC=123 into 11 focused helpers
  • Revocation map helpers (RevokedKeySet, KeyStats) in trust store
  • 39 "what" comments removed across 14 files
  • UI table standardization with pkg/ui/table.go

Provenance

This release includes a signed provenance manifest for source tree verification.

Signing public key:

ed25519:HsD9e6BB2LlaeKODGqgWUZoflDgdUH1HWTdyWA7dGqE=

Root hash (BLAKE3, 113 files):

sha256:6f972edf99f5457f8fb13668c529f4343dab7a76d20b67ea746ebdf54d910fee

# Verify source tree integrity
immutable-provenance verify \
  --manifest provenance-manifest-v2.2.2-signed.yaml \
  --dir /path/to/wardex-v2.2.2

Checksums

Download wardex_2.2.2_checksums.txt and verify:

sha256sum -c wardex_2.2.2_checksums.txt --ignore-missing
Assets 29
Loading