v0.3.0

What changed

Added

• Scan failures are now reported with a reason. When syft cannot pull an
  image, the agent classifies the failure — registry authentication
  (401/403/denied), registry rate limiting (429/TOOMANYREQUESTS), or a generic
  scan error — and reports the code and registry host on its 5-minute
  inventory cycle, so the StackRadar coverage card can say why an image has
  no SBOM instead of "generating SBOMs" forever. Only the code and the host
  leave the cluster, never syft's output; retry behaviour is unchanged, and a
  successful upload clears the reported failure. Works against a StackRadar
  control plane that predates the field too — older servers ignore it.

Fixed

• syft's filesystem cache now lives under the /tmp scratch volume
  (SYFT_CACHE_DIR, overridable). It previously defaulted to /.cache/syft,
  which readOnlyRootFilesystem makes unwritable, so every scan logged
  WARN unable to get filesystem cache before doing anything.

Install

helm install stackradar-scanner oci://ghcr.io/lockdep/charts/stackradar-scanner \
  --version 0.3.0 \
  --namespace stackradar --create-namespace

Artifacts

Artifact	Reference	Digest
Image	ghcr.io/lockdep/stackradar-scanner:0.3.0	sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292
Chart	oci://ghcr.io/lockdep/charts/stackradar-scanner:0.3.0	sha256:8a1096a4a16c0223e7b14bd706261de852fae7fa0e93bd0375ea6a84b6805b2c

Verify

Both artifacts are signed with cosign keyless
signing. No public key to distribute — the signature is bound to this
repository's release workflow at tag v0.3.0.

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/charts/stackradar-scanner@sha256:8a1096a4a16c0223e7b14bd706261de852fae7fa0e93bd0375ea6a84b6805b2c

The image is built for linux/amd64 and linux/arm64, and carries
SLSA provenance and an SBOM attestation in its index (BuildKit
attestations, readable with imagetools):

docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292 --format '{{json .Provenance}}'
docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292 --format '{{json .SBOM}}'

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What changed

Added

• Initial public release of the StackRadar scanner and its Helm chart.
  The scanner runs in your cluster, builds an SBOM of every running image,
  discovers Helm releases and the Kubernetes version, and reports them to
  StackRadar so you can see what you run, what is vulnerable, and what to
  upgrade. Install with helm install from
  oci://ghcr.io/lockdep/charts/stackradar-scanner; the image and chart are
  cosigned and the image is pinned by digest.

Install

helm install stackradar-scanner oci://ghcr.io/lockdep/charts/stackradar-scanner \
  --version 0.2.0 \
  --namespace stackradar --create-namespace

Artifacts

Artifact	Reference	Digest
Image	ghcr.io/lockdep/stackradar-scanner:0.2.0	sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360
Chart	oci://ghcr.io/lockdep/charts/stackradar-scanner:0.2.0	sha256:9f01f56927f9b84e5e614246ae7ba49de0423809283e4c8bbd20d2c2840ff4ad

Verify

Both artifacts are signed with cosign keyless
signing. No public key to distribute — the signature is bound to this
repository's release workflow at tag v0.2.0.

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/charts/stackradar-scanner@sha256:9f01f56927f9b84e5e614246ae7ba49de0423809283e4c8bbd20d2c2840ff4ad

The image is built for linux/amd64 and linux/arm64, and carries
SLSA provenance and an SBOM attestation in its index (BuildKit
attestations, readable with imagetools):

docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360 --format '{{json .Provenance}}'
docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360 --format '{{json .SBOM}}'

Full Changelog: https://github.com/lockdep/stackradar-scanner/commits/v0.2.0