v0.15.6

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.6      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.6
docker pull ghcr.io/openctemio/openctem-web:v0.15.6
docker pull ghcr.io/openctemio/openctem-console:v0.15.6   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.6
docker pull ghcr.io/openctemio/seed:v0.15.6
docker pull ghcr.io/openctemio/admin-cli:v0.15.6

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.6 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.6 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.6 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.6.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.6-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.6 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.6 by @0xmanhnv in #3272

Full Changelog: v0.15.5...v0.15.6

v0.15.5

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.5      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.5
docker pull ghcr.io/openctemio/openctem-web:v0.15.5
docker pull ghcr.io/openctemio/openctem-console:v0.15.5   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.5
docker pull ghcr.io/openctemio/seed:v0.15.5
docker pull ghcr.io/openctemio/admin-cli:v0.15.5

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.5 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.5 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.5 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.5.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.5-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.5 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.5 by @0xmanhnv in #3221

Full Changelog: v0.15.4...v0.15.5

v0.15.4

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.4      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.4
docker pull ghcr.io/openctemio/openctem-web:v0.15.4
docker pull ghcr.io/openctemio/openctem-console:v0.15.4   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.4
docker pull ghcr.io/openctemio/seed:v0.15.4
docker pull ghcr.io/openctemio/admin-cli:v0.15.4

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.4 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.4 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.4 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.4.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.4-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.4 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.4 by @0xmanhnv in #3204

Full Changelog: v0.15.3...v0.15.4

v0.15.3

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.3      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.3
docker pull ghcr.io/openctemio/openctem-web:v0.15.3
docker pull ghcr.io/openctemio/openctem-console:v0.15.3   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.3
docker pull ghcr.io/openctemio/seed:v0.15.3
docker pull ghcr.io/openctemio/admin-cli:v0.15.3

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.3 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.3 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.3 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.3.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.3-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.3 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.3 by @0xmanhnv in #3187

Full Changelog: v0.15.2...v0.15.3

v0.15.2

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.2      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.2
docker pull ghcr.io/openctemio/openctem-web:v0.15.2
docker pull ghcr.io/openctemio/openctem-console:v0.15.2   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.2
docker pull ghcr.io/openctemio/seed:v0.15.2
docker pull ghcr.io/openctemio/admin-cli:v0.15.2

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.2 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.2 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.2 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.2.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.2-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.2 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.2 by @0xmanhnv in #3152

Full Changelog: v0.15.1...v0.15.2

v0.15.1

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.1      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.1
docker pull ghcr.io/openctemio/openctem-web:v0.15.1
docker pull ghcr.io/openctemio/openctem-console:v0.15.1   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.1
docker pull ghcr.io/openctemio/seed:v0.15.1
docker pull ghcr.io/openctemio/admin-cli:v0.15.1

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.1 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.1 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.1 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.1.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.1-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.1 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• release: v0.15.1 by @0xmanhnv in #3128

Full Changelog: v0.15.0...v0.15.1

v0.15.0

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.15.0      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.15.0
docker pull ghcr.io/openctemio/openctem-web:v0.15.0
docker pull ghcr.io/openctemio/openctem-console:v0.15.0   # platform console
docker pull ghcr.io/openctemio/migrations:v0.15.0
docker pull ghcr.io/openctemio/seed:v0.15.0
docker pull ghcr.io/openctemio/admin-cli:v0.15.0

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.15.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.15.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.15.0 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.15.0.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.15.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.15.0-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.15.0 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• fix(web): findings list clears its selection when rows change; phone cards get checkbox and menu by @0xmanhnv in #2784
• feat(ingest): a receipt for every upload and sensor run by @0xmanhnv in #2786
• fix(security): step-up on secret-store and module writes; SCIM tokens expire and rotate by @0xmanhnv in #2789
• fix(sso): requiring SSO needs a verified domain; a lapsed domain alerts and keeps enforcement by @0xmanhnv in #2793
• fix(oidc): id_tokens accept only RS256/PS256/ES256; Google sign-in requires a verified id_token by @0xmanhnv in #2794
• feat(findings): duplicate candidates with known-since, inside the caller's data scope by @0xmanhnv in #2767
• feat(findings): search matches title, file path, rule id, CVE and asset name, with trigram indexes and time limits by @0xmanhnv in #2783
• feat(findings): bulk change of every finding a filter selects, run as an operation by @0xmanhnv in #2791
• feat(web): findings list empty states, inline errors, translated list by @0xmanhnv in #2792
• fix(dashboard): Fix next shows findings without a title instead of failing by @0xmanhnv in #2804
• feat(web): findings quick views in the sidebar replace the metric strip and state tabs by @0xmanhnv in #2795
• feat(findings): receipts API, POST /findings/imports and a durable Idempotency-Key by @0xmanhnv in #2796
• fix(notifications): per-channel delivery with its own retries, real event type, no redirects by @0xmanhnv in #2770
• feat(web): brand tokens, self-hosted fonts, flat cards by @0xmanhnv in #2812
• feat(entitlement): deniable features for SSO connections, SSO enforcement, SCIM and group links by @0xmanhnv in #2797
• feat(web): findings filter chips and Add filter built from the filter contract by @0xmanhnv in #2799
• feat(findings): an upload can declare full coverage of explicit assets by @0xmanhnv in #2800
• fix(web): Add finding dialog loads the source catalog only when opened by @0xmanhnv in #2832
• feat(web): dashboard chart primitives read on their own and on a phone by @0xmanhnv in #2825
• test(ingest): SQL statement budget for one import and three re-imports by @0xmanhnv in #2810
• feat(web): flat app shell, no floating content frame by @0xmanhnv in #2824
• feat(webhooks): signed deliveries (Standard Webhooks), per-integration secret, redelivery by @0xmanhnv in #2777
• ci: label PRs by path and group release notes under operator headings by @0xmanhnv in #2811
• fix(ingest): concurrent uploads to a new repository keep their findings by @0xmanhnv in #2816
• fix(ingest): deadlock-safe batched writes, no lost sightings by @0xmanhnv in #2822
• feat(web): receipts on the import dialog, the scan run page and the finding overview by @0xmanhnv in #2801
• ci: run zizmor in workflow lint and fix its findings by @0xmanhnv in #2805
• fix(db): recount branch finding counters once per statement by @0xmanhnv in #2819
• fix(ingest): decide absence from the receipt, not findings.scan_id by @0xmanhnv in #2823
• fix(web): dashboard edit chrome fits narrow widgets and phones by @0xmanhnv in #2821
• feat(approvals): risk acceptance approval level per organization (all, high_and_above, off) by @0xmanhnv in #2808
• feat: richer Overview and CTEM dashboards; discovery coverage metric by @0xmanhnv in #2831
• fix(web): dashboard header fits a phone; untitled Fix next rows by @0xmanhnv in #2807
• fix(findings): full-coverage uploads decide absence from the receipt by @0xmanhnv in #2826
• feat(findings): explain why a finding is one finding (identity recipe, sources, merged duplicates) by @0xmanhnv in #2827
• ci: upgrade the previous release database to the release candidate, nightly and on release branches by @0xmanhnv in #2813
• fix(components): one spelling for a package across the inventory and its findings by @0xmanhnv in #2837
• fix(web): Add a widget panel no longer overflows by @0xmanhnv in #2838
• feat(components): an uploaded SBOM or dependency report is matched within minutes by @0xmanhnv in #2844
• ci: weekly check of the inline tool pins, reported as one issue by @0xmanhnv in #2806
• fix(vulnmatch): version matches on packages are one finding with the scanner's by @0xmanhnv in #2842
• fix(web): load errors explain rate limits and lost connections, and fit on a phone by @0xmanhnv in #2847
• fix(sensors): offer only the lifecycle actions the API allows by @0xmanhnv in #2848
• fix(sensors): refresh keeps the list on screen, polls do not toast by @0xmanhnv in #2854
• feat(web): asset lenses as sidebar quick views replace the lens pills, type pills and metric strip by @0xmanhnv in #2841
• fix(web): threat intelligence keeps your findings apart from the global catalogs by @0xmanhnv in #2850
• feat(web): one approval policy card for false positives and risk acceptance by @0xmanhnv in #2814
• fix(findings): awaiting-verification view lists every finding the count counts by @0xmanhnv in #2836
• fix(web): crown jewels keep notes, drop mock dependencies, honest states by @0xmanhnv in #2857
• fix(web): scoping registers load every page up to a cap by @0xmanhnv in #2859
• fix(security): mask tool-reported secrets in exposure details on the...

v0.14.0

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.14.0      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.14.0
docker pull ghcr.io/openctemio/openctem-web:v0.14.0
docker pull ghcr.io/openctemio/openctem-console:v0.14.0   # platform console
docker pull ghcr.io/openctemio/migrations:v0.14.0
docker pull ghcr.io/openctemio/seed:v0.14.0
docker pull ghcr.io/openctemio/admin-cli:v0.14.0

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.14.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.14.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.14.0 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.14.0.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.14.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.14.0-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.14.0 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• docs(config): AI budget variable counts an organization's own provider by @0xmanhnv in #2724
• fix(ticketmap): no mapping guess when the issue type is unknown by @0xmanhnv in #2727
• feat(web): dashboard widget kit with every widget state and validated chart palettes by @0xmanhnv in #2730
• feat(dashboard): typed widget spec, metric catalog and server-side validation by @0xmanhnv in #2732
• fix(service-accounts): atomic key revoke on demotion, suspend and role loss; full-data ceiling for held roles by @0xmanhnv in #2726
• test(migrations): replay 001185 in a private database by @0xmanhnv in #2736
• fix(ticket-policy): per-finding create lock, release job budget and due-holds index by @0xmanhnv in #2728
• feat(dashboard): widget results from the fact tables, personal and organization reads, preview by @0xmanhnv in #2735
• feat(api): sensor proxy pools by @0xmanhnv in #2733
• fix(dashboard): tenant figures instead of catalog counts, tiles open the list they count by @0xmanhnv in #2731
• feat(web): sensor proxies page and per-sensor network path by @0xmanhnv in #2725
• feat(web): Verification panel, checklist editor and inline blocked reasons by @0xmanhnv in #2744
• fix(service-accounts): a service-account key stops working when its minter loses service_accounts:manage by @0xmanhnv in #2734
• feat(dashboard): stored snapshots, scheduled refresher and Refresh now by @0xmanhnv in #2737
• fix(command): a repeated claim hands out the same payload as the first delivery by @0xmanhnv in #2738
• feat(web): dashboard home renders stored dashboards with switcher, scope badge and freshness by @0xmanhnv in #2743
• fix(sla): announce breaches and at-risk deadlines once per SLA clock, whoever sets the status by @0xmanhnv in #2740
• fix(sla): creating a policy never replaces the default; protect the default policy by @0xmanhnv in #2745
• fix(findings): reachability check needs findings:verify on the server by @0xmanhnv in #2752
• fix(dashboard): one refresh per dashboard, refund, preview limit, snapshot cleanup, pentest trends by @0xmanhnv in #2739
• fix(findings): detection does not reopen a finding closed as mitigated by @0xmanhnv in #2741
• feat(findings): verification plan per finding (GET /findings/{id}/verification) by @0xmanhnv in #2742
• fix(web): request budget for the dashboard home counts its two dashboard list reads by @0xmanhnv in #2753
• feat(web): widget gallery with live previews, config panel and keyboard grid editing by @0xmanhnv in #2746
• fix(web): findings bulk bar follows permissions, SLA column sorts, bulk writes guarded by @0xmanhnv in #2748
• feat(findings): audit every status move and assignment by @0xmanhnv in #2747
• feat(dashboard): templates as typed configs, retire the CTEM and Classic views by @0xmanhnv in #2749
• fix(web): the false-positive dialog follows the organization's FP level by @0xmanhnv in #2750
• test(dashboard): i18n completeness, accessibility and visual checks for the dashboard by @0xmanhnv in #2751
• fix(web): drawer uses the page's lock rules; Undo reverts and asks for its note by @0xmanhnv in #2759
• fix(web): finding AI triage needs permission and opt-in, summary from its own endpoint by @0xmanhnv in #2760
• fix(web): finding page tells not-found from load failure, section error rows by @0xmanhnv in #2758
• fix(security): mask credentials in scanner output at ingest and on read by @0xmanhnv in #2754
• fix(security): enforce pentest campaign membership on every finding sub-route by @0xmanhnv in #2755
• fix(findings): step-up for approve, severity approve, delete and bulk close by @0xmanhnv in #2757
• fix(findings): comments are append-only; ticket unlink needs the link permissions by @0xmanhnv in #2763
• feat(web): show a pending approval request on the finding page and drawer by @0xmanhnv in #2756
• docs(rfc): RFC-121 bug-bounty and disclosure reports as findings by @0xmanhnv in #2764
• fix(web): finding page shows scanner code safely, drops empty Related and progress facades by @0xmanhnv in #2761
• fix(api): asset owner principal checks answer 404 for foreign and unknown ids by @0xmanhnv in #2772
• docs(api): amend RFC-041 and api-conventions with the public API review decisions by @0xmanhnv in #2774
• fix(api): cap unbounded sub-resource reads, asset-group bulk ids and credential CSV rows by @0xmanhnv in #2771
• fix(api): request_id in every error body; audit rows use only the validated request id by @0xmanhnv in #2768
• fix(api): id tie-breaker in the shared sort helper by @0xmanhnv in #2769
• feat(api): Retry-After and RateLimit headers on API-key and MCP 429s by @0xmanhnv in #2773
• fix(api): template source lookups answer 404 for another organization's id by @0xmanhnv in #2780
• feat(findings): typed bug-bounty report object and one finding per report by @0xmanhnv in #2765
• web: remove coloured accent stripes from cards and gate new ones by @0xmanhnv in #2779
• feat(dashboard): CTEM loop, crown jewels exposed and attack paths as catalog metrics by @0xmanhnv in #2782
• feat(findings): quick-view counts endpoint for the findings list by @0xmanhnv in #2776
• feat(findings)...

v0.13.0

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.13.0      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.13.0
docker pull ghcr.io/openctemio/openctem-web:v0.13.0
docker pull ghcr.io/openctemio/openctem-console:v0.13.0   # platform console
docker pull ghcr.io/openctemio/migrations:v0.13.0
docker pull ghcr.io/openctemio/seed:v0.13.0
docker pull ghcr.io/openctemio/admin-cli:v0.13.0

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.13.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.13.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.13.0 --owner openctemio

Installing without containers, or from a private registry

The archives below install every component as programs with systemd
units (linux amd64/arm64; bootstrap-admin also for macOS and
Windows): api/docs/deployment/binary-install.md. For sites whose
clusters cannot reach the internet, each image is also attached as an
OCI archive with its signatures (openctem-image-*.oci.tar, listed
and signed in openctem-images-v0.13.0.txt), and the image kit builds
the images from the archives without source code:
api/docs/deployment/air-gapped.md.

Verify before use:

cosign verify-blob checksums-sha256.txt --bundle checksums-sha256.txt.sigstore.json \
  --certificate-identity https://github.com/openctemio/openctem/.github/workflows/release.yml@refs/tags/v0.13.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums-sha256.txt
gh attestation verify openctem-server-v0.13.0-linux-amd64.tar.gz --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.13.0 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• perf(findings): recount a branch only when a finding's branch, severity or status changes by @0xmanhnv in #2636
• fix(priority): rule dry run covers only findings in the caller's data scope by @0xmanhnv in #2631
• fix(priority): batched audit cleanup (no-op and deleted-organization rows), erase on organization delete by @0xmanhnv in #2637
• fix(tenant): risk scoring save merges partial bodies and refuses unsafe score maps by @0xmanhnv in #2634
• fix(scoring): the daily EPSS refresh compares and writes the score only, not the percentile by @0xmanhnv in #2639
• perf(ingest): stop rewriting every touched asset at the end of a report by @0xmanhnv in #2642
• feat(audit): retention is on by default and archives through the storage provider by @0xmanhnv in #2643
• perf(findings): unchanged scanner output and template provenance no longer rewrite a re-seen finding by @0xmanhnv in #2644
• perf(db): drop six duplicate indexes by @0xmanhnv in #2635
• fix(findings): reversing a decision needs findings:approve; automation cannot reverse it by @0xmanhnv in #2647
• fix(findings): sole-member self-approval is for false positives only by @0xmanhnv in #2649
• chore(security): ignore the fake credentials in the all-in-one child-env test fixture by @0xmanhnv in #2660
• fix(automation): a scan an automation starts acts as the automation's owner by @0xmanhnv in #2659
• fix(findings): bulk status and bulk assign need the single-item permission by @0xmanhnv in #2633
• fix(deploy): bundled sensor reaches the platform over https through the gateway by @0xmanhnv in #2654
• fix(approvals): false-positive approval treats every public asset as internet-exposed by @0xmanhnv in #2655
• test(e2e): create a remediation task from findings, then hold and resume it by @0xmanhnv in #2657
• feat(scanrun): unreachable and skipped targets do not make a run partial by @0xmanhnv in #2658
• feat(scan): managed scans are identified by key, never by name by @0xmanhnv in #2638
• fix(migrations): severity override down restores chk_activity_type validated by @0xmanhnv in #2656
• fix(dashboard): facts maintainer skips the all-zero system tenant row by @0xmanhnv in #2663
• chore(release): after v0.12.0: versions.yaml, changelog folded by @0xmanhnv in #2662
• test(findings): disposition-reversal bulk test carries findings:status by @0xmanhnv in #2701
• feat(deploy): optional off-host backups and point-in-time recovery (pgBackRest overlay) by @0xmanhnv in #2650
• fix(findings): bulk status never overwrites a finding that changed after it was read by @0xmanhnv in #2651
• feat(web): scan workflow connections say what they carry by @0xmanhnv in #2665
• feat(web): deleting an asset asks for its name; bulk delete asks for the count by @0xmanhnv in #2670
• fix(web): asset relationship graph full-screen button and card overflow by @0xmanhnv in #2668
• fix(findings): classify is limited by finding type and approval, and recorded by @0xmanhnv in #2671
• test(findings): bulk compare-and-set test carries findings:status by @0xmanhnv in #2715
• fix(easm): govern public host names by what they are, not the asset type by @0xmanhnv in #2632
• fix(roles): role edits are checked against old and new permissions; gaining approve permissions needs step-up by @0xmanhnv in #2672
• feat(db): lz4 compression for large columns, app-role statement and idle-in-transaction timeouts by @0xmanhnv in #2640
• feat(remediation): status menu per finding row and in-task finding drawer (P0-15) by @0xmanhnv in #2704
• feat(web): one verification-code field and one step-up dialog by @0xmanhnv in #2706
• fix(retest): a tool that could not run the check is not an unreachable target by @0xmanhnv in #2664
• fix(commands): every return to the queue is counted, delayed and capped by @0xmanhnv in #2641
• feat(scan): managed scans are read-only through the scan API by @0xmanhnv in #2646
• fix(remediation): task timeline redacts other tasks the reader cannot open by @0xmanhnv in #2677
• fix(service-accounts): key list is admin-only; last-used IP shown to administrators only by @0xmanhnv in #2673
• ops(refingerprint): reset secret fingerprints derived from a mask by @0xmanhnv in #2675
• feat(ai): openai_compatible provider, private-address toggle and model allow-list by @0xmanhnv in #2676
• fix(ingest): keep a secret finding's masked line and preview; no code lines of secrets to AI or exports by @0xmanhnv in #2682
• fix(remediation): finding_id filter and related members respect the data scope by @0xmanhnv in #2679
• ci: a pull request runs a fast tier, the merge queue the full one by @0xmanhnv in #2709
• fix(remediation): a new task owner is told; task notices respect the data scope; moves notify both owners by @0xmanhnv in #2684
• fix(remediation): task members and counters follow the pentest member rule by @0xmanhnv in #2683
• fix(attack): protected_by marks the protected asset, not the control by @0xmanhnv in #2687
• fix(remediation): removing a task from a campaign checks access to the task by @0xmanhnv in #2688
• fix(approvals): the requester is told how a request ended; hide the dead Mentions preference by @0xmanhnv in https://github.com/open...

v0.12.0

Container images (multi-arch: amd64 + arm64)

docker pull ghcr.io/openctemio/openctem:v0.12.0      # all-in-one (API + web + console + gateway)
docker pull ghcr.io/openctemio/openctem-api:v0.12.0
docker pull ghcr.io/openctemio/openctem-web:v0.12.0
docker pull ghcr.io/openctemio/openctem-console:v0.12.0   # platform console
docker pull ghcr.io/openctemio/migrations:v0.12.0
docker pull ghcr.io/openctemio/seed:v0.12.0
docker pull ghcr.io/openctemio/admin-cli:v0.12.0

Every image is signed with cosign (keyless, GitHub OIDC) and carries a
signed SPDX SBOM attestation and a signed SLSA build provenance; the
SBOMs are also attached to this release.
Verify an image before deploying it:

cosign verify ghcr.io/openctemio/openctem-api:v0.12.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/openctemio/openctem-api:v0.12.0 \
  --certificate-identity-regexp '^https://github.com/openctemio/openctem/.github/workflows/docker-publish.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openctemio/openctem-api:v0.12.0 --owner openctemio

Upgrading (Compose deployment, api/deploy)

Read the upgrade notes below first. Then set OPENCTEM_VERSION=v0.12.0 in
api/deploy/.env and run docker compose pull && docker compose up -d:
the one-shot migrate service applies the database migrations before the
API starts (the API refuses to start on an older schema). Back up the
database and the api-data volume before upgrading.

What's Changed

• chore(security): scrub customer and network identifiers; refuse the leaked dev sensor CA by @0xmanhnv in #2489
• test: neutral example names in fixtures by @0xmanhnv in #2615
• feat(threatalert): emerging-threat alerts, planner, delivery and API by @0xmanhnv in #2607
• feat(remediation): a campaign is a program of tasks; finding filters removed by @0xmanhnv in #2600
• fix(findings): no sensor-local paths in finding details by @0xmanhnv in #2610
• deps(api): ctis and ctis/transfer pins that exist after the history rewrite by @0xmanhnv in #2614
• fix(security): bootstrap-admin is audited, alerts the other admins, and -force touches only the named admin by @0xmanhnv in #2565
• feat(sensors): relay connector, the platform side of the sensor relay by @0xmanhnv in #2601
• feat(web): emerging threats page and settings; translate the threat intel page by @0xmanhnv in #2608
• fix(e2e): drop two specs for the task UI that the campaigns API (#2600) replaced by @0xmanhnv in #2617
• feat(scan): rule sources for scans and scan profiles; custom templates fail closed by @0xmanhnv in #2611
• ci(gateway): the layer4 smoke build prints its own error and retries once by @0xmanhnv in #2619
• fix(web): the Copy reset timer of the scanner output block no longer outlives it by @0xmanhnv in #2621
• feat(web): rule sources selector for scans and scan profiles by @0xmanhnv in #2612
• feat(findings): record which rules found a finding; organization template on the Detection rule line by @0xmanhnv in #2613
• fix(ai-triage): organization AI data policy for pentest findings, failure codes, retries by @0xmanhnv in #2616
• fix(scans): accept an inherited rule_sources when editing a scan by @0xmanhnv in #2622
• fix(remediation): rebuild the campaign pages as programs of tasks by @0xmanhnv in #2599
• feat(ai-triage): organization consent, honest availability, budgets and fair share by @0xmanhnv in #2618
• feat(web): Settings > AI, honest AI triage button states, translated AI triage by @0xmanhnv in #2620
• feat(security): signed jobs on by default; production requires the job signer by @0xmanhnv in #2589
• docs(changelog): fold the fragments shipped up to v0.11.0 into an archive section by @0xmanhnv in #2623
• fix(signer): crash-atomic signing key write, clear error on corrupt key by @0xmanhnv in #2624
• docs(architecture): job dispatch, from trigger to result by @0xmanhnv in #2625
• fix(commands): lease expiry keeps the pin of commands addressed to one sensor by @0xmanhnv in #2626
• fix(scan): stop sending routing_tags and tenant_runner_only to sensors by @0xmanhnv in #2627
• fix(deploy): bundled sensor on its own network, with limits by @0xmanhnv in #2628
• feat(signer): bundled sensor pins the signer key from a volume the API cannot write (G2) by @0xmanhnv in #2629
• feat(web): one tab row and a status lens on the approvals page by @0xmanhnv in #2630
• chore(release): v0.12.0 by @0xmanhnv in #2653

Full Changelog: v0.11.0...v0.12.0