Skip to content

v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 16:20
· 1 commit to main since this release
v0.2.0
3cff383
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.2.0] - 2026-10-11

OpenVEX, reachability triad, and remediate since 0.1.0:

Added

  • OpenVEX ingest (file + optional OCI attestation via cosign verify-attestation --type openvex)
  • VEX decisions: not_affected suppresses (valid justification + exact digest/image binding); under_investigation keeps WARN; fixed requires fixed version present
  • Reachability triad signals: package_present, network_reachable, execution_observed (UNKNOWN without runtime evidence)
  • blastguard remediate --image <new> impact report (markdown + JSON)
  • Real vuln matching, selector exposure, and CI exit codes
  • Kind e2e: matching-digest VEX flips BLOCK→ALLOW; wrong digest stays BLOCK
  • EVIDENCE.md claim/status standard

Fixed

  • OpenVEX digests require exact sha256:+64 hex; match by equality and product name (reject prefix digests)
  • --vex-attestation requires --key or certificate identity flags; decodes DSSE→in-toto→predicate; fails closed
  • Reachability triad wired into Policy.Evaluate; empty runtime evidence package no longer matches all
  • Remediate marks proposed images without scan data as UNKNOWN; "safer" only when no new/worse CVEs
  • Reject OpenVEX when twin has no artifacts; validate @context/author/timestamp; reject unknown statuses
  • ArtifactByDigest exact equality via NormalizeImageDigest
Assets 20
Loading