Skip to content

CipherHorizon v0.4.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 14:29
v0.4.1
e7dc9b7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Distrusted CA keys are reported, on any Go version
    (CRYPTO-REVIEW-004). A new bundled distrust list is
    matched by key (SPKI SHA-256) and by certificate fingerprint. Its first entry is the eight eMudhra intermediate CAs
    of October 2026, whose P-384 private keys are below 256, with their Sectigo cross-signs. The new rule
    CERT.DISTRUSTED-KEY (critical) fires on served chains and on certificates found on hosts, in files and in
    imports.
  • A chain through a distrusted key is still evaluated. 0.4.0 rejected these chains only because Go 1.27.3
    drops them inside crypto/x509, and the report showed just "x509: no valid chains built". The evaluation now
    builds signature-valid paths itself. Each store's result keeps the path, names the listed certificate and its
    position, and says why the store does not trust it. Every other rule still runs. Evaluation version eval/13.

Added

  • CRL revocation checks, opt-in (--revocation on tls scan and serve; CRYPTO-REVIEW-004 P1b). Every
    certificate on the served path is checked against the CRL it names, signed by its own issuer, up to the root.
    New rules: REV.REVOKED (critical), REV.CRL-BAD-SIGNATURE (high), REV.CRL-STALE (medium) and
    REV.UNKNOWN (low). They read not checked when lookups are off.
    • Status, not gate: a revoked certificate stays on the path, and trust and every other rule are unchanged.
    • Hostile URLs are guarded: fetches are plain HTTP only, with a 16 MiB size cap and timeouts, and every
      connection's real address is checked. Private, loopback and cloud-metadata addresses are refused unless
      --revocation-private is set.
    • Caching: CRLs are cached until their nextUpdate.
    • Not OCSP: OCSP responders are still never contacted.
    • Tested: fixtures are produced by OpenSSL (testing/pki/make-crl.sh), including IDP scope, partitions,
      delta and wrong-key CRLs, and a fuzz target runs in CI.
    • Settings and Help show whether lookups are on.
  • Safer upgrades (PRD-016 Phase 0). The server still upgrades
    its database at launch, from any earlier version, after a backup; now it also:
    • refuses to run two servers on one database, and refuses to upgrade a database another CipherHorizon process
      is using (a <database>.lock file next to it; the OS releases the lock if the process dies);
    • checks there is room for the backup first, and changes nothing if there is not;
    • checks the database after upgrading it, and if a step or the check fails, puts the file back exactly as it
      was, keeps the failed copy for diagnosis, and refuses to start;
    • records each upgrade (from which schema to which, by which version, and the backup) in the database.
  • cipherhorizon db status (schema, what an upgrade would do, backups, upgrade history, whether a server is
    using it), db check (SQLite integrity check, references, structure; exit 2 on a problem), db migrate
    (--dry-run to rehearse) and db restore BACKUP-FILE (the server must be stopped; the replaced database
    is kept beside it).
  • serve --migrate refuse: for change-controlled sites, stop instead of upgrading an older database, so the
    upgrade is run as its own step with db migrate.

Changed

  • Root stores refreshed from CCADB (2026-11-03). Mozilla has removed emSign ECC Root CA - G3, emSign ECC Root CA -
    C3 and emSign Root CA - C1, and Chrome Root Store v43 has removed emSign ECC Root CA - G3. Chains through these
    roots now read "no path to a root" in those stores; CERT.DISTRUSTED-KEY still names the reason. CT log list
    refreshed: Google's logs are now named like "Google Argon2026h2".
  • Dependencies: modernc.org/sqlite 1.61.0; the Go build image and the GitHub Actions used by CI and releases
    updated to their latest pinned digests.

Upgrade notes

  • Schema 15 → 16: adds the upgrade_log table. Nothing existing is changed; the upgrade takes under a second.
  • From this version on, a second serve on the same database exits with a message naming the process using
    it. If you ran two servers on one file before, give each its own --db.
  • A database upgraded by this version is refused by 0.4.0 and earlier ("newer than this program
    understands"). To go back, restore the backup made before the upgrade with cipherhorizon db restore
    (this version) and then run the older one.

Verify what you downloaded

sha256sum --check --ignore-missing checksums.txt
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The inventory scripts a server of this version hands out are attached too, with
inventory-scripts.sha256; cipherhorizon scripts list prints the same hashes offline.

Full instructions, including the container image and build provenance: docs/engineering/DISTRIBUTION.md.

Assets 39
Loading