v0.2.0

What changed

Added

• Initial public release of the StackRadar scanner and its Helm chart.
  The scanner runs in your cluster, builds an SBOM of every running image,
  discovers Helm releases and the Kubernetes version, and reports them to
  StackRadar so you can see what you run, what is vulnerable, and what to
  upgrade. Install with helm install from
  oci://ghcr.io/lockdep/charts/stackradar-scanner; the image and chart are
  cosigned and the image is pinned by digest.

Install

helm install stackradar-scanner oci://ghcr.io/lockdep/charts/stackradar-scanner \
  --version 0.2.0 \
  --namespace stackradar --create-namespace

Artifacts

Artifact	Reference	Digest
Image	ghcr.io/lockdep/stackradar-scanner:0.2.0	sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360
Chart	oci://ghcr.io/lockdep/charts/stackradar-scanner:0.2.0	sha256:9f01f56927f9b84e5e614246ae7ba49de0423809283e4c8bbd20d2c2840ff4ad

Verify

Both artifacts are signed with cosign keyless
signing. No public key to distribute — the signature is bound to this
repository's release workflow at tag v0.2.0.

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/charts/stackradar-scanner@sha256:9f01f56927f9b84e5e614246ae7ba49de0423809283e4c8bbd20d2c2840ff4ad

The image is built for linux/amd64 and linux/arm64, and carries
SLSA provenance and an SBOM attestation in its index (BuildKit
attestations, readable with imagetools):

docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360 --format '{{json .Provenance}}'
docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:ef60d449c42018b15a4d5c9d8a5264130a0bbe648d6eee318e20deef33baf360 --format '{{json .SBOM}}'

Full Changelog: https://github.com/lockdep/stackradar-scanner/commits/v0.2.0