Skip to content

v0.11.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 16:36
· 61 commits to main since this release
v0.11.0
4ef8eed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenCTEM Sensor v0.11.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.11.0/openctemio-sensor_0.11.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.11.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.11.0-default
docker pull ghcr.io/openctemio/sensor:v0.11.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.11.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.11.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.11.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.11.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.11.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.11.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.11.0"

Changelog

New Features

  • 39f608f: feat(katana): keep to the job web scope (deny paths, prefixes, hosts, methods) ( <>)
  • 84c89dd: feat(nuclei): CTIS 1.6 evidence; retests run with -ms and prove a fix ( <>)
  • 8f31615: feat(nuclei): the finding check declares verify.finding@1 (retest mode) ( <>)
  • 28ae4c8: feat(policy): *.domain in the local policy covers the domain itself ( <>)
  • fc5dee8: feat(policy): skip refused scan targets instead of failing the job; explain prints the per-target reason ( <>)
  • 5fb16a7: feat(tools): embedded tool.yaml per built-in tool with the capabilities it implements; capability jobs ( <>)
  • 72b924d: feat(tools): settings for subfinder, dnsx, httpx, katana, codeql, trivy and betterleaks, mapped from the capability params ( <>)
  • 5fb5df4: feat(trivy): implement sbom.generate@1 (component inventory without matching) ( <>)

Bug Fixes

  • 8855175: fix(ci): deps-on-main checks with git; re-pin sdk-go to its main commit ( <>)
  • 3d8491c: fix(logs): ship tool and validation lines to the command log on the platform ( <>)
  • a32ab15: fix(nuclei): re-verify results use the redacted matched URL ( <>)
  • b2f66ba: fix(secrets): mask the raw secret in every field of betterleaks and trivy findings ( <>)
  • ba5b7fa: fix(tools): compiled-in tools report origin builtin in the manifest ( <>)

Other Changes

  • 66388a7: Merge main into ci/pin-on-main-guard ( <>)
  • 3404c3d: Merge remote-tracking branch 'origin/main' into feat/nuclei-validate-verify-finding ( <>)
  • fe4ef3e: build: pin sdk-go to its main commit after #202 merged (6d8a167) ( <>)
  • 9fa81c7: build: pin sdk-go to its main commit after #204 merged (9e9cc58) ( <>)
  • fb4dd51: build: pin sdk-go to main (#203 merged) ( <>)
  • 651cc22: build: pin sdk-go to main (web scope merged) ( <>)
  • 679d9ca: chore!: remove the CI mode (moved to openctemio/ci) ( <>)
  • e15785b: chore(release): v0.11.0 ( <>)
  • f2e8844: deps: pin sdk-go and ctis to their main commits ( <>)
  • 4d65842: deps: pin sdk-go to its main commit after #191 ( <>)
  • 03c39f9: docs(nuclei): nuclei masks Authorization and Cookie itself; keep its mask ( <>)
  • 6214e48: refactor(scanners): read nuclei, semgrep, trivy and betterleaks output with ctis/importer ( <>)
  • 15d039a: test(nuclei): -ms lines captured from the real binary; port closed is connection refused ( <>)

Full Changelog: v0.10.0...v0.11.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.

Assets 14
Loading