mithril 0.2.1

mithril 0.2.1

Packaging only; no code changes since 0.2.0.

• Added Debian packaging (debian/) and a release job that builds a .deb for amd64 and arm64 and attaches it to the release, alongside the existing binary tarballs.
• Install on Debian/Ubuntu/Kali: download mithril_0.2.1-1_<arch>.deb, then sudo apt install ./mithril_0.2.1-1_<arch>.deb.

mithril 0.2.0

mithril 0.2.0

Detection and output:

• Raw DER-encoded private key detection (PKCS#8, PKCS#1, SEC1), on top of the existing PEM handling (#2).
• --license-paths: list the file locations of each license, not just a count, plus a paths array in JSON output (#6).
• --kernel-cves-all: list every CVE for the detected kernel version against the full kernel.org (Linux CNA) feed, matched branch-aware; the kernel is now surfaced even with zero curated hits, with the curated list labeled non-exhaustive (#4).
• The default human CVE view is gated to foothold-worthy findings (on CISA KEV, or high CVSS, or EPSS traction); --component-cves-all shows the full set (#9).

Accuracy:

• Binary version extraction keeps the patch level for hostapd and wpa_supplicant (#10), and requires a real banner date or timestamp before reporting an OpenSSL or U-Boot version (#7).

Docs and CI:

• Added a man page (mithril.1).
• GitHub Actions: build and test, an ASan+UBSan job, and a libFuzzer smoke run on every PR and push (#8).

Thanks to @rabernethy for the DER private-key scanner.

v0.1.3

mithril 0.1.3 — multi-platform release binaries

v0.1.2

mithril 0.1.2 — kernel-config recovery + tri-state kernel-CVE gating

v0.1.1

mithril v0.1.1

v0.1.0

mithril v0.1.0 — first public release

Vulnerability index (rolling)

Prebuilt offline vulnerability index for mithril --fetch-db
(OSV + NVD/CPE + CISA KEV + EPSS), plus the optional full kernel.org
CVE feed (kernel-cve-index.json.gz) for --fetch-db --with-kernel-feed
/ --kernel-cves-all. Rebuilt weekly from the upstream feeds. Each
asset is checksummed in SHA256SUMS; --fetch-db verifies before
installing. This release is intentionally not marked "Latest" so the
versioned binary release keeps that badge.