Skip to content

Releases: openctemio/sensor

Release list

v0.18.0

v0.18.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 00:45
v0.18.0
c507687
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.18.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.18.0/openctemio-sensor_0.18.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.18.0/openctemio-sensor_0.18.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.18.0/openctemio-sensor_0.18.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.18.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.18.0-default
docker pull ghcr.io/openctemio/sensor:v0.18.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.18.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.18.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.18.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.18.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.18.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.18.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.18.0"

Changelog

New Features

  • 5addc87: feat(nuclei): keep to the job web scope through the task forwarder (#222) (@0xmanhnv)

Other Changes

  • c507687: chore(release): v0.18.0 (#223) (@0xmanhnv)
  • 8f1ee81: docs(readme): the Compose example runs hardened, like the platform's install snippet (#221) (@0xmanhnv)

Full Changelog: v0.17.0...v0.18.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Assets 14

v0.17.0

v0.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 04:40
v0.17.0
7192bfd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.17.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.17.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.17.0-default
docker pull ghcr.io/openctemio/sensor:v0.17.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.17.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.17.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.17.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.17.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.17.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.17.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.17.0"

Changelog

New Features

  • 2f3334c: feat!: every sensor setting is SENSOR_-prefixed; removed names stop the sensor (#216) (@0xmanhnv)

Performance Improvements

  • 671c2c0: perf(image): -nuclei and -trivy images on distroless static (#217) (@0xmanhnv)
  • cd99105: perf(image): default platform image on distroless, without Python, git or a shell (#215) (@0xmanhnv)

Other Changes

  • 7192bfd: chore(release): v0.17.0 (#219) (@0xmanhnv)
  • 3d84456: deps(actions): bump the actions-minor-patch group with 5 updates (#218) (@dependabot[bot])
  • a17f77d: docs(security): SECURITY.md matches the disclosure policy (#214) (@0xmanhnv)

Full Changelog: v0.16.0...v0.17.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.16.0

v0.16.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 12:50
v0.16.0
9630424
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.16.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.16.0/openctemio-sensor_0.16.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.16.0/openctemio-sensor_0.16.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.16.0/openctemio-sensor_0.16.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.16.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.16.0-default
docker pull ghcr.io/openctemio/sensor:v0.16.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.16.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.16.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.16.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.16.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.16.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.16.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.16.0"

Changelog

New Features

  • badedf0: feat(image): one data volume at /var/lib/openctem (#210) (@0xmanhnv)

Bug Fixes

  • 02e8d54: fix(security): build sensor binaries with Go 1.26.9 (#211) (@0xmanhnv)

Other Changes

Full Changelog: v0.15.0...v0.16.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.15.0

v0.15.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 09:59
v0.15.0
d6272c4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.15.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.15.0/openctemio-sensor_0.15.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.15.0/openctemio-sensor_0.15.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.15.0/openctemio-sensor_0.15.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.15.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.15.0-default
docker pull ghcr.io/openctemio/sensor:v0.15.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.15.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.15.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.15.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.15.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.15.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.15.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.15.0"

Changelog

New Features

  • 91a72e6: feat(transport): gRPC binding on the platform's own port through ALPN routing (#207) (@0xmanhnv)

Other Changes

Full Changelog: v0.14.0...v0.15.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.14.0

v0.14.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 06:25
v0.14.0
422d13e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.14.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.14.0/openctemio-sensor_0.14.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.14.0/openctemio-sensor_0.14.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.14.0/openctemio-sensor_0.14.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.14.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.14.0-default
docker pull ghcr.io/openctemio/sensor:v0.14.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.14.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.14.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.14.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.14.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.14.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.14.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.14.0"

Changelog

New Features

  • d1217c7: feat(nuclei): adaptive per-host rate ceiling and coverage gaps (api RFC-074) (#204) (@0xmanhnv)

Other Changes

Full Changelog: v0.13.0...v0.14.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.13.0

v0.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 05:48
v0.13.0
f93252d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.13.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.13.0/openctemio-sensor_0.13.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.13.0/openctemio-sensor_0.13.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.13.0/openctemio-sensor_0.13.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.13.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.13.0-default
docker pull ghcr.io/openctemio/sensor:v0.13.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.13.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.13.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.13.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.13.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.13.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.13.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.13.0"

Changelog

New Features

  • d799987: feat: adopt sdk-go self-binding of a signing key and transport v3 selection (#203) (@0xmanhnv)

Other Changes

Full Changelog: v0.12.0...v0.13.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.12.0

v0.12.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 02:52
v0.12.0
e865284
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.12.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.12.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.12.0-default
docker pull ghcr.io/openctemio/sensor:v0.12.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.12.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.12.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.12.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.12.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.12.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.12.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.12.0"

Changelog

New Features

  • b022a02: feat(lookup): passive rdap and asn tools (T0); dnsx declares the resolver network ( <>)
  • 6600602: feat(sandbox): built-in tools work under network confinement; a seccomp profile that allows it ( <>)
  • 94e6a34: feat(scope): enforce port and path limits in the task sandbox; advertise scope.limits@1 ( <>)
  • 4d3ffe5: feat: sensor protocol v3 transport (gRPC over mTLS, HTTPS fallback) via sdk-go (@0xmanhnv)

Bug Fixes

  • 9216645: fix(content): a retest during a template install no longer reads "not installed" ( <>)

Other Changes

  • 9b09c58: Merge origin/main into feat/scope-limits; lookups accept scope-limited jobs ( <>)
  • 4d8f57c: build(deps): pin ctis and sdk-go to their main merge commits ( <>)
  • 4b99786: build(deps): pin sdk-go to its main merge commit (1e0c7fe) ( <>)
  • 6540544: build(images): pin trivy, nuclei and semgrep by hash; publish SBOM and provenance ( <>)
  • e9b4966: build: pin sdk-go to main (transport v3 merged) (@0xmanhnv)
  • 013bdad: chore(deps): Go 1.26.9 and x/net v0.60.0 for GO-2026-6617/6613/6612 ( <>)
  • 62f4acd: chore(deps): sdk-go main: fail closed without a policy, platform TLS pin ( <>)
  • 0a9f220: chore(deps): sdk-go main: job-signing root and key set, templates through the signed job ( <>)
  • 8a3c5e4: chore(deps): sdk-go main: verify the platform's signed jobs ( <>)
  • e865284: chore(release): v0.12.0 (#202) (@0xmanhnv)
  • 24ede95: ci(smoke): parse the detected tool list so built-in rdap/asn are accepted and asserted ( <>)
  • b9619ed: deps: sdk-go v0.19.0 (#201) (@0xmanhnv)
  • affa100: test(content): wait for the refresh goroutines before the temp dir is removed ( <>)
  • 0c690f9: test(security): enforce outbound-only; remove the webhook collector ( <>)

Full Changelog: v0.11.0...v0.12.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.11.0

v0.11.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 16:36
v0.11.0
4ef8eed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.11.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.11.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.11.0-default
docker pull ghcr.io/openctemio/sensor:v0.11.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.11.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.11.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.11.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.11.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.11.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.11.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.11.0"

Changelog

New Features

  • 39f608f: feat(katana): keep to the job web scope (deny paths, prefixes, hosts, methods) ( <>)
  • 84c89dd: feat(nuclei): CTIS 1.6 evidence; retests run with -ms and prove a fix ( <>)
  • 8f31615: feat(nuclei): the finding check declares verify.finding@1 (retest mode) ( <>)
  • 28ae4c8: feat(policy): *.domain in the local policy covers the domain itself ( <>)
  • fc5dee8: feat(policy): skip refused scan targets instead of failing the job; explain prints the per-target reason ( <>)
  • 5fb16a7: feat(tools): embedded tool.yaml per built-in tool with the capabilities it implements; capability jobs ( <>)
  • 72b924d: feat(tools): settings for subfinder, dnsx, httpx, katana, codeql, trivy and betterleaks, mapped from the capability params ( <>)
  • 5fb5df4: feat(trivy): implement sbom.generate@1 (component inventory without matching) ( <>)

Bug Fixes

  • 8855175: fix(ci): deps-on-main checks with git; re-pin sdk-go to its main commit ( <>)
  • 3d8491c: fix(logs): ship tool and validation lines to the command log on the platform ( <>)
  • a32ab15: fix(nuclei): re-verify results use the redacted matched URL ( <>)
  • b2f66ba: fix(secrets): mask the raw secret in every field of betterleaks and trivy findings ( <>)
  • ba5b7fa: fix(tools): compiled-in tools report origin builtin in the manifest ( <>)

Other Changes

  • 66388a7: Merge main into ci/pin-on-main-guard ( <>)
  • 3404c3d: Merge remote-tracking branch 'origin/main' into feat/nuclei-validate-verify-finding ( <>)
  • fe4ef3e: build: pin sdk-go to its main commit after #202 merged (6d8a167) ( <>)
  • 9fa81c7: build: pin sdk-go to its main commit after #204 merged (9e9cc58) ( <>)
  • fb4dd51: build: pin sdk-go to main (#203 merged) ( <>)
  • 651cc22: build: pin sdk-go to main (web scope merged) ( <>)
  • 679d9ca: chore!: remove the CI mode (moved to openctemio/ci) ( <>)
  • e15785b: chore(release): v0.11.0 ( <>)
  • f2e8844: deps: pin sdk-go and ctis to their main commits ( <>)
  • 4d65842: deps: pin sdk-go to its main commit after #191 ( <>)
  • 03c39f9: docs(nuclei): nuclei masks Authorization and Cookie itself; keep its mask ( <>)
  • 6214e48: refactor(scanners): read nuclei, semgrep, trivy and betterleaks output with ctis/importer ( <>)
  • 15d039a: test(nuclei): -ms lines captured from the real binary; port closed is connection refused ( <>)

Full Changelog: v0.10.0...v0.11.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.10.0

v0.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 02:54
v0.10.0
e81c418
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.10.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.10.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.10.0-default
docker pull ghcr.io/openctemio/sensor:v0.10.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.10.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.10.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.10.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.10.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.10.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.10.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.10.0"

Changelog

New Features

  • ed491ed: feat(nuclei): serve the platform's retests of nuclei findings (retest:nuclei) ( <>)
  • c59f900: feat(policy): policy validate|digest|explain|install --expect-sha256; SIGHUP reload with kill switch on an invalid file; schema v2 (@0xmanhnv)
  • 25e2341: feat(recon): httpx keeps the TLS leaf, favicon, JARM and CDN; same-host redirects and crawl; rate limit honoured (@0xmanhnv)
  • 8688525: feat(recon): run naabu and katana out of process on the tool contract ( <>)
  • 07c2c1f: feat(recon): run subfinder and dnsx out of process on the tool contract ( <>)
  • 16d2538: feat(runner): CI jobs use their OIDC identity and the platform gate (api RFC-051) (@0xmanhnv)
  • 479260e: feat(sandbox): every scanner runs in the tool sandbox; scanners declare what they write (@0xmanhnv)
  • f1253e0: feat(scanners): run betterleaks and codeql out of process on the tool contract ( <>)
  • 7a862a3: feat(scanners): run trivy and semgrep out of process on the tool contract ( <>)
  • 23d24ab: feat(sensor): -job runs one platform command and exits (SENSOR_JOB_ID, a Kubernetes Job) ( <>)
  • 74da552: feat(sensor): openctemio-sensor pair and auto-pair on first start (api RFC-052) ( <>)
  • b6ad52d: feat(toolrun): admit every ported tool task against the local policy in force ( <>)
  • 553e9e7: feat(tools): httpx and nuclei run out of process on the tool contract (sdk-go pkg/tool) (@0xmanhnv)
  • 7c15abc: feat(tools): nothing found means no output on both paths; httpx child reports the probed version; pin sdk-go to the head of #167 (CTIS 1.4) (@0xmanhnv)
  • 9bcdcc8: feat(validate): the nuclei re-verification runs out of process on the tool contract ( <>)
  • ccad0f4: feat: preflight checks on the platform; no more silent configuration mistakes (@0xmanhnv)

Bug Fixes

  • 79de7eb: fix(deps): pin sdk-go v0.18.0 (the previous pin was a branch commit not on sdk-go main) ( <>)
  • 4a3d4c4: fix(recon): katana follows no redirect; scan limits only lower; 429/503 back-off with target_throttled (@0xmanhnv)
  • e2af146: fix: executor path is pkg/sensorkit/executor; gofmt (@0xmanhnv)

Other Changes

  • bc5ebc4: Merge main into feat/ci-oidc-runner; pin sdk-go to sdk-go#165 merged with main (@0xmanhnv)
  • 2d509a4: Merge main; pin sdk-go to main b60c260 ( <>)
  • d60d739: Merge main; pin sdk-go to main e5c3f23 (retest command merged) ( <>)
  • be8d38a: Merge origin/main (runner OIDC, #146) into feat/tool-contract-httpx-nuclei; pin sdk-go to #167 + #165 heads (@0xmanhnv)
  • fff7665: Merge origin/main into feat/config-preflight; pin sdk-go to openctemio/sdk-go#158 (bcd4acb) (@0xmanhnv)
  • e1d97d8: Merge origin/main into feat/policy-cli-sighup; pin sdk-go to openctemio/sdk-go#157 (0a5c0a9) (@0xmanhnv)
  • 6ca8129: Merge remote-tracking branch 'origin/feat/config-preflight' into feat/tool-sandbox (@0xmanhnv)
  • dff323a: Merge remote-tracking branch 'origin/main' into chore/remove-protocol-v1 ( <>)
  • b9f43d2: Merge remote-tracking branch 'origin/main' into feat/tool-contract-httpx-nuclei ( <>)
  • 7cd8d5f: Merge remote-tracking branch 'origin/main' into feat/tool-sandbox (@0xmanhnv)
  • 543641c: Merge remote-tracking branch 'origin/main' into feat/tool-sandbox (@0xmanhnv)
  • b1792c4: build: sdk-go config-report branch at 01a8c2e (@0xmanhnv)
  • 593157d: chore!: remove sensor protocol v1 ( <>)
  • 68eb0dc: chore(changelog): one fragment file per change in changelog.d/, folded at release ( <>)
  • 99ea05b: chore(codeql): remove the unused CodeQL SARIF parser ( <>)
  • 1a1ed58: chore(deps): pin sdk-go to main (ctis importer, importtool, adapters over the importer) ( <>)
  • fd0623c: chore(deps): pin sdk-go to the current sdk-go #177 head while draft ( <>)
  • 8eebdc4: chore(deps): pin sdk-go to the head of sdk-go#160 (041c153), rebased on main (@0xmanhnv)
  • f81b265: chore(deps): pin sdk-go to the head of sdk-go#167 (on main with #165) (@0xmanhnv)
  • b059d89: chore(deps): pin sdk-go to the merged main commit ( <>)
  • 51f12e4: chore(deps): pin sdk-go to the merged main commit 3c6eaaa7fd84 ( <>)
  • 4eb4845: chore(deps): pin sdk-go to the merged main commit of #155 (@0xmanhnv)
  • 5ce3af7: chore(deps): pin sdk-go to the merged main commit of sdk-go #177 ( <>)
  • 75c627e: chore(deps): pin sdk-go to the merged main commit of sdk-go#160 (ef06390d4723) (@0xmanhnv)
  • 2e912c2: chore(deps): pin sdk-go v0.18.0 ( <>)
  • 65a6b03: chore(deps): take the SDK SARIF parser on the ctis importer ( <>)
  • 1f90620: chore(release): v0.10.0 (@github-actions[bot])
  • a9567f1: ci(templates): run the sensor image by verified digest; opt-in gate enforcement ( <>)

Full Changelog: v0.9.1...v0.10.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading

v0.9.1

v0.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Oct 01:39
v0.9.1
2ae8c24
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.9.1

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.9.1_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.9.1-default
docker pull ghcr.io/openctemio/sensor:v0.9.1-semgrep
docker pull ghcr.io/openctemio/sensor:v0.9.1-trivy
docker pull ghcr.io/openctemio/sensor:v0.9.1-nuclei
docker pull ghcr.io/openctemio/sensor:v0.9.1-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.9.1-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.9.1"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.9.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.9.1"

Changelog

Bug Fixes

  • a226a10: fix(nuclei): non-intrusive by default; default-login, brute-force and intrusive templates never run ( <>)
  • b656920: fix(recon): dnsx, naabu and subfinder use the sensor's resolvers; dnsx that resolves nothing fails ( <>)

Other Changes

  • 1140da4: Merge remote-tracking branch 'origin/main' into fix/recon-sensor-resolver (@0xmanhnv)
  • ecc8808: chore(release): v0.9.1 (@github-actions[bot])

Full Changelog: v0.9.0...v0.9.1

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Loading