v0.9.1

OpenCTEM Sensor v0.9.1

Security scanning sensor for the OpenCTEM platform (binary openctemio-sensor,
formerly agent). Settings from the agent releases keep working: AGENT_*
variables, -agent-id and the agent: config block are read with a
deprecation warning, and ~/.openctem/agent-credentials.json is moved to
~/.openctem/sensor-credentials.json on first start.

Installation

Linux/macOS (amd64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_linux_amd64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Linux (arm64):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_linux_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

macOS (Apple Silicon):

curl -sSL https://github.com/openctemio/sensor/releases/download/v0.9.1/openctemio-sensor_0.9.1_darwin_arm64.tar.gz | tar xz
chmod +x openctemio-sensor
sudo mv openctemio-sensor /usr/local/bin/

Windows:
Download openctemio-sensor_0.9.1_windows_amd64.zip and extract to your PATH.

Docker (GHCR - primary):

# Available variants: default, ci, semgrep, trivy, nuclei, betterleaks
docker pull ghcr.io/openctemio/sensor:v0.9.1-default
docker pull ghcr.io/openctemio/sensor:v0.9.1-semgrep
docker pull ghcr.io/openctemio/sensor:v0.9.1-trivy
docker pull ghcr.io/openctemio/sensor:v0.9.1-nuclei
docker pull ghcr.io/openctemio/sensor:v0.9.1-betterleaks

Docker (Docker Hub mirror):

docker pull openctemio/sensor:v0.9.1-default

Verify

# checksums.txt is signed (Sigstore, keyless) by this repository's release workflow
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/release.yml@refs/tags/v0.9.1"
sha256sum -c checksums.txt --ignore-missing

# images are signed by digest by the docker-publish workflow
cosign verify ghcr.io/openctemio/sensor:v0.9.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity "https://github.com/openctemio/sensor/.github/workflows/docker-publish.yml@refs/tags/v0.9.1"

Changelog

Bug Fixes

• a226a10: fix(nuclei): non-intrusive by default; default-login, brute-force and intrusive templates never run ( <>)
• b656920: fix(recon): dnsx, naabu and subfinder use the sensor's resolvers; dnsx that resolves nothing fails ( <>)

Other Changes

• 1140da4: Merge remote-tracking branch 'origin/main' into fix/recon-sensor-resolver (@0xmanhnv)
• ecc8808: chore(release): v0.9.1 (@github-actions[bot])

---

Full Changelog: v0.9.0...v0.9.1

Docker Images: GHCR.
The ghcr.io/openctemio/agent:* images are frozen at their last release:
still pullable, never updated.