v0.17.0

OpenCTEM Sensor v0.17.0

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.17.0/openctemio-sensor_0.17.0_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.17.0_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.17.0-default
docker pull ghcr.io/openctemio/sensor:v0.17.0-semgrep
docker pull ghcr.io/openctemio/sensor:v0.17.0-trivy
docker pull ghcr.io/openctemio/sensor:v0.17.0-nuclei
docker pull ghcr.io/openctemio/sensor:v0.17.0-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.17.0-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.17.0"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.17.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.17.0"

Changelog

New Features

• 2f3334c: feat!: every sensor setting is SENSOR_-prefixed; removed names stop the sensor (#216) (@0xmanhnv)

Performance Improvements

• 671c2c0: perf(image): -nuclei and -trivy images on distroless static (#217) (@0xmanhnv)
• cd99105: perf(image): default platform image on distroless, without Python, git or a shell (#215) (@0xmanhnv)

Other Changes

• 7192bfd: chore(release): v0.17.0 (#219) (@0xmanhnv)
• 3d84456: deps(actions): bump the actions-minor-patch group with 5 updates (#218) (@dependabot[bot])
• a17f77d: docs(security): SECURITY.md matches the disclosure policy (#214) (@0xmanhnv)

---

Full Changelog: v0.16.0...v0.17.0

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.