v0.3.0

mithril 0.3.0 adds two new analysis passes (boot security and public-key weakness), UEFI Secure Boot enumeration, and a batch of false-positive precision fixes. It stays fully offline at scan time and has zero third-party runtime dependencies; the vulnerability index is distributed separately (fetch it after install with mithril --fetch-db).

Highlights

New analysis passes

• --boot Boot Security pass: U-Boot environment, device tree, and FIT image posture, with the usual self-filtering (no finding unless something real is recovered).
• --keys Public-Key Weakness pass: batch-GCD shared-prime detection across recovered keys.

UEFI / Secure Boot

• Parse vendor UEFI variable stores and enumerate Secure Boot certificates and the dbx revocation list.
• Find the UEFI firmware volume at any offset in a full-flash dump, and analyze standalone variable stores that carry no firmware-volume header (the common chipsec/UEFITool artifact).

Precision fixes (fewer false positives)

• PEM private-key findings now require a real body and matching END line.
• Identify GPL-2.0 (not LGPL-2.0) when a GPLv2 preamble names the LGPL.
• Filter structured-text false positives from the generic-secret detector.
• Down-rank unbounded-range CVE matches on vendor-fork components.
• JSON number-grammar parsing fix.

Build and packaging

• Nix flake support; single-sourced version (VERSION file); CTest-registered test suite; run-stats footer aligned with moria.

Install

• Homebrew: brew install nmatt0/tap/mithril
• Prebuilt binaries / .deb: attached below (linux-x86_64, linux-arm64, macos-arm64).
• From source: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j
• After install, fetch the offline vulnerability index: mithril --fetch-db

Thanks

This release includes community contributions from:

• @kleindotc — Nix flake support (#24)
• @0xDyews — JSON number parsing fix (#21)

Thank you!