Zero Breach 0.1.1

This patch corrects false alarms and cases where unreadable or malformed evidence could hide findings.

• Preserve findings through later module failures in the downloaded scanner.
• Report unreadable files, unsupported schemas, incomplete snapshots, and cleanup failures as coverage gaps.
• Keep saved references separate from connection evidence. DNS records do not prove endpoint contact; preloaded blocking rules are protective configuration.
• Match recommended next steps to the evidence and indicator role. Ad-network traces and legitimate-driver matches start with context checks; stronger findings recommend qualified help.
• Print full copyable evidence paths and place detailed findings below the DNS-history instructions.
• Reject known remote and redirected paths; disable network-capable certificate verification. Permit only verified macOS system directory aliases.
• Correct IOC freshness, atomic updates, export citations, and reproducible feed generation.

Scope

This release remains focused on AdFection/Candiru. The bundled file indicators contain one known spyware-sample fingerprint and one separately classified legitimate vulnerable-driver fingerprint. It does not add Pegasus detection or mobile forensic collection.

Correction for previous STIX imports

The legitimate driver hash 6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 is not spyware and is excluded from the active STIX feed. Existing users should process adfection.withdrawals.stix.json only with a STIX consumer that supports revocation, or remove these old objects explicitly:

• indicator--80275ed1-64f2-58c7-97dc-9cdacac0ff5d
• relationship--66b188af-2489-5b41-a84f-b90c34f5fc73

Do not use the withdrawal file as an active detection/MVT feed. Continue using adfection.stix.json for scanning.

Publisher signatures

The scanner and checksum manifest now have detached GPG signatures from ArchiveGenocide's established release key. The tested scanner bytes and existing checksum manifest are unchanged.

Full key fingerprint: C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C.

Cross-check the fingerprint on ArchiveGenocide's established verification page. Download zero-breach.py.asc and archivegenocide-signing-key.asc alongside the scanner. Inspect the public key fingerprint before importing it, then verify:

gpg --show-keys --with-fingerprint archivegenocide-signing-key.asc
gpg --import archivegenocide-signing-key.asc
gpg --verify zero-breach.py.asc zero-breach.py

SHA256SUMS.txt.asc signs the ten-content-file checksum manifest. See verification instructions. Later development-branch indicator updates are not covered by this release signature.

Validation

199 tests passed in all nine Windows/macOS/Linux and Python 3.8/3.11/3.12 combinations, plus three end-to-end quick-scan jobs and the reproducible-build job. CI results.

The actual standalone passed synthetic SQLite/hash/report/cleanup integration checks. Repeated builds matched, including a byte-identical build on Windows and Ubuntu.

Download and verify

Requires Python 3.8 or newer. Download zero-breach.py, verify its SHA-256, and open a terminal in the download folder. On Windows run python -X utf8 zero-breach.py; on macOS or Linux run python3 -X utf8 zero-breach.py. Use SHA256SUMS.txt for all asset hashes.

Standalone SHA-256: 9c947d6ba23f4308b4d1512596e44b2ec2b34c3cba4139b4cb4d8774e77d08aa

Source commit: 09585eaf14fcd3a5d0be36767bf6295889e7c575. Rebuild from this release tag, not a later development branch.

Close browsers before scanning for more consistent SQLite snapshots. Python socket/path guards are not an OS network sandbox; POSIX network mounts and concurrent filesystem changes require external isolation for a strict offline boundary. A result with no matches is not a clean bill of health.