Skip to content

v0.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 02:54
· 108 commits to main since this release
v0.10.0
e81c418
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.10.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.10.0/openctemio-sensor_0.10.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.10.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.10.0-default
docker pull ghcr.io/openctemio/sensor:v0.10.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.10.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.10.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.10.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.10.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.10.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.10.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.10.0"

Changelog

New Features

  • ed491ed: feat(nuclei): serve the platform's retests of nuclei findings (retest:nuclei) ( <>)
  • c59f900: feat(policy): policy validate|digest|explain|install --expect-sha256; SIGHUP reload with kill switch on an invalid file; schema v2 (@0xmanhnv)
  • 25e2341: feat(recon): httpx keeps the TLS leaf, favicon, JARM and CDN; same-host redirects and crawl; rate limit honoured (@0xmanhnv)
  • 8688525: feat(recon): run naabu and katana out of process on the tool contract ( <>)
  • 07c2c1f: feat(recon): run subfinder and dnsx out of process on the tool contract ( <>)
  • 16d2538: feat(runner): CI jobs use their OIDC identity and the platform gate (api RFC-051) (@0xmanhnv)
  • 479260e: feat(sandbox): every scanner runs in the tool sandbox; scanners declare what they write (@0xmanhnv)
  • f1253e0: feat(scanners): run betterleaks and codeql out of process on the tool contract ( <>)
  • 7a862a3: feat(scanners): run trivy and semgrep out of process on the tool contract ( <>)
  • 23d24ab: feat(sensor): -job runs one platform command and exits (SENSOR_JOB_ID, a Kubernetes Job) ( <>)
  • 74da552: feat(sensor): openctemio-sensor pair and auto-pair on first start (api RFC-052) ( <>)
  • b6ad52d: feat(toolrun): admit every ported tool task against the local policy in force ( <>)
  • 553e9e7: feat(tools): httpx and nuclei run out of process on the tool contract (sdk-go pkg/tool) (@0xmanhnv)
  • 7c15abc: feat(tools): nothing found means no output on both paths; httpx child reports the probed version; pin sdk-go to the head of #167 (CTIS 1.4) (@0xmanhnv)
  • 9bcdcc8: feat(validate): the nuclei re-verification runs out of process on the tool contract ( <>)
  • ccad0f4: feat: preflight checks on the platform; no more silent configuration mistakes (@0xmanhnv)

Bug Fixes

  • 79de7eb: fix(deps): pin sdk-go v0.18.0 (the previous pin was a branch commit not on sdk-go main) ( <>)
  • 4a3d4c4: fix(recon): katana follows no redirect; scan limits only lower; 429/503 back-off with target_throttled (@0xmanhnv)
  • e2af146: fix: executor path is pkg/sensorkit/executor; gofmt (@0xmanhnv)

Other Changes

  • bc5ebc4: Merge main into feat/ci-oidc-runner; pin sdk-go to sdk-go#165 merged with main (@0xmanhnv)
  • 2d509a4: Merge main; pin sdk-go to main b60c260 ( <>)
  • d60d739: Merge main; pin sdk-go to main e5c3f23 (retest command merged) ( <>)
  • be8d38a: Merge origin/main (runner OIDC, #146) into feat/tool-contract-httpx-nuclei; pin sdk-go to #167 + #165 heads (@0xmanhnv)
  • fff7665: Merge origin/main into feat/config-preflight; pin sdk-go to openctemio/sdk-go#158 (bcd4acb) (@0xmanhnv)
  • e1d97d8: Merge origin/main into feat/policy-cli-sighup; pin sdk-go to openctemio/sdk-go#157 (0a5c0a9) (@0xmanhnv)
  • 6ca8129: Merge remote-tracking branch 'origin/feat/config-preflight' into feat/tool-sandbox (@0xmanhnv)
  • dff323a: Merge remote-tracking branch 'origin/main' into chore/remove-protocol-v1 ( <>)
  • b9f43d2: Merge remote-tracking branch 'origin/main' into feat/tool-contract-httpx-nuclei ( <>)
  • 7cd8d5f: Merge remote-tracking branch 'origin/main' into feat/tool-sandbox (@0xmanhnv)
  • 543641c: Merge remote-tracking branch 'origin/main' into feat/tool-sandbox (@0xmanhnv)
  • b1792c4: build: sdk-go config-report branch at 01a8c2e (@0xmanhnv)
  • 593157d: chore!: remove sensor protocol v1 ( <>)
  • 68eb0dc: chore(changelog): one fragment file per change in changelog.d/, folded at release ( <>)
  • 99ea05b: chore(codeql): remove the unused CodeQL SARIF parser ( <>)
  • 1a1ed58: chore(deps): pin sdk-go to main (ctis importer, importtool, adapters over the importer) ( <>)
  • fd0623c: chore(deps): pin sdk-go to the current sdk-go #177 head while draft ( <>)
  • 8eebdc4: chore(deps): pin sdk-go to the head of sdk-go#160 (041c153), rebased on main (@0xmanhnv)
  • f81b265: chore(deps): pin sdk-go to the head of sdk-go#167 (on main with #165) (@0xmanhnv)
  • b059d89: chore(deps): pin sdk-go to the merged main commit ( <>)
  • 51f12e4: chore(deps): pin sdk-go to the merged main commit 3c6eaaa7fd84 ( <>)
  • 4eb4845: chore(deps): pin sdk-go to the merged main commit of #155 (@0xmanhnv)
  • 5ce3af7: chore(deps): pin sdk-go to the merged main commit of sdk-go #177 ( <>)
  • 75c627e: chore(deps): pin sdk-go to the merged main commit of sdk-go#160 (ef06390d4723) (@0xmanhnv)
  • 2e912c2: chore(deps): pin sdk-go v0.18.0 ( <>)
  • 65a6b03: chore(deps): take the SDK SARIF parser on the ctis importer ( <>)
  • 1f90620: chore(release): v0.10.0 (@github-actions[bot])
  • a9567f1: ci(templates): run the sensor image by verified digest; opt-in gate enforcement ( <>)

Full Changelog: v0.9.1...v0.10.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Assets 14
Loading