v0.12.0

OpenCTEM Sensor v0.12.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.12.0/openctemio-sensor_0.12.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.12.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.12.0-default
docker pull ghcr.io/openctemio/sensor:v0.12.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.12.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.12.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.12.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.12.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.12.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.12.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.12.0"

Changelog

New Features

• b022a02: feat(lookup): passive rdap and asn tools (T0); dnsx declares the resolver network ( <>)
• 6600602: feat(sandbox): built-in tools work under network confinement; a seccomp profile that allows it ( <>)
• 94e6a34: feat(scope): enforce port and path limits in the task sandbox; advertise scope.limits@1 ( <>)
• 4d3ffe5: feat: sensor protocol v3 transport (gRPC over mTLS, HTTPS fallback) via sdk-go (@0xmanhnv)

Bug Fixes

• 9216645: fix(content): a retest during a template install no longer reads "not installed" ( <>)

Other Changes

• 9b09c58: Merge origin/main into feat/scope-limits; lookups accept scope-limited jobs ( <>)
• 4d8f57c: build(deps): pin ctis and sdk-go to their main merge commits ( <>)
• 4b99786: build(deps): pin sdk-go to its main merge commit (1e0c7fe) ( <>)
• 6540544: build(images): pin trivy, nuclei and semgrep by hash; publish SBOM and provenance ( <>)
• e9b4966: build: pin sdk-go to main (transport v3 merged) (@0xmanhnv)
• 013bdad: chore(deps): Go 1.26.9 and x/net v0.60.0 for GO-2026-6617/6613/6612 ( <>)
• 62f4acd: chore(deps): sdk-go main: fail closed without a policy, platform TLS pin ( <>)
• 0a9f220: chore(deps): sdk-go main: job-signing root and key set, templates through the signed job ( <>)
• 8a3c5e4: chore(deps): sdk-go main: verify the platform's signed jobs ( <>)
• e865284: chore(release): v0.12.0 (#202) (@0xmanhnv)
• 24ede95: ci(smoke): parse the detected tool list so built-in rdap/asn are accepted and asserted ( <>)
• b9619ed: deps: sdk-go v0.19.0 (#201) (@0xmanhnv)
• affa100: test(content): wait for the refresh goroutines before the temp dir is removed ( <>)
• 0c690f9: test(security): enforce outbound-only; remove the webhook collector ( <>)

---

Full Changelog: v0.11.0...v0.12.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.