CipherRun v0.4.0

CipherRun v0.4.0

CipherRun v0.4.0 is a major release focused on trustworthy findings, stable automation contracts, secure API operation, durable execution, and reproducible validation.

Highlights

Trustworthy scan results

• Added explicit finding statuses, detection methods, confidence levels, stable finding IDs, structured evidence, limitations, references, remediation, and probe-safety metadata.
• Added the versioned scan-result contract and JSON Schema 1.1, including cipherrun schema export and compatibility fixtures.
• Added SARIF 2.1.0, JUnit XML, and version-aware JSON exports.
• Added semantic cipherrun diff, baseline drift detection, stable automation exit codes, --fail-on, and the --fail-on-policy alias.
• Added safe, standard, and aggressive scan profiles plus explicit private-network policy with --allow-private and CIDR-scoped exceptions.

Security and API hardening

• API startup now requires explicit credentials; generated configurations use owner-only permissions and are not overwritten.
• Added bearer authentication, hashed credential records, key identity and tenant metadata, lifecycle and expiry handling, scan ownership, and cross-owner access denial.
• Restricted query-string API keys to WebSocket stream endpoints and deprecated that transport.
• Added signed, scan-bound, single-use WebSocket tickets with 60-second expiry.
• Added HMAC-signed scan webhooks with stable delivery IDs and bounded transient retries.
• Added explicit CORS origin allowlists, optional native HTTPS, client-certificate verification, request IDs, Prometheus metrics, bounded audit events, and proxy-CIDR validation.

Durable jobs and workers

• Connected durable file-backed job storage with restart recovery for the standalone API server.
• Added SQLite/PostgreSQL job backends, conditional claims, lease recovery, heartbeats, bounded retries, and dead-letter records.
• Added standalone SQL-backed workers and feature-gated API-only mode.
• Added principal-scoped atomic scan idempotency, terminal-job TTLs, persisted-artifact cleanup, and administrator-owned worker CIDR scopes.

Detection, probes, and validation

• Added explicit GREASE, early-data, renegotiation, POODLE oracle-variant, and external OpenSSL validation coverage.
• Added reproducible differential validation with SSLyze and TLS-Scanner, pinned vulnerable/patched OpenSSL controls, and an isolated Opossum parser fixture.
• Clarified remote Opossum attestation limits and distinguish potential exposure or inconclusive results from confirmed vulnerabilities.
• Added per-IP finding evidence, published timing methodology, versioned compliance rule packs, and optional CT monitoring integration.

Distribution and release engineering

• Stabilized publishable contracts for the protocol, policy, data, probes, server, CLI, and worker crates.
• Added a standalone worker binary and feature-aware builds for API, database, monitoring, email, CT, PQC, and TLS provider selection.
• Added Rust 1.88 minimum-version and beta checks, reduced feature-matrix coverage, dependency and packaging gates, and release validation fixtures.
• Added separate hardened production and packet-capture laboratory images; the production image uses a non-root distroless runtime with no shell or Linux capabilities.
• Release automation now builds multi-platform packages, checksums, package-manager manifests, SBOMs, crates, and the production container.

Upgrade notes

This release contains breaking public Rust API and scan-result contract changes. Review the API and schema migration documentation before upgrading downstream integrations. API deployments must provide an explicit credentials file, and query-string API keys should be replaced with WebSocket stream tickets.

Packaging Note

The GitHub release assets were generated from the successful multi-platform build and validation jobs. crates.io accepted the protocol, policy, data, probes, and server crates before applying its publication rate limit; the remaining crate publications are pending.

Validation

The main CI workflow passes on Linux, macOS, Windows, Rust 1.88, beta, the external vulnerable TLS fixture, the differential TLS laboratory, quality gates, and the production image smoke test.

CipherRun v0.3.1

CipherRun v0.3.1

Summary

CipherRun's first automated release, with crates.io publication and binary packages for Linux, Windows, and macOS on x64 and ARM64. The repository history contains 1,791 commits. These notes summarize the product capabilities and the fixes, correctness work, test coverage, and release automation included in this release.

Features

• Modular TLS/SSL scanner covering SSLv2 through TLS 1.3.
• Cipher, protocol, extension, signature, ALPN/NPN, SNI, renegotiation, session resumption, and STARTTLS analysis.
• TLS vulnerability checks including Heartbleed, ROBOT, POODLE, LOGJAM, BEAST, CRIME, DROWN, FREAK, LUCKY13, SWEET32, Ticketbleed, Winshock, and other checks.
• Certificate and trust-chain analysis covering signature algorithms, expiration, key strength, revocation, OCSP, CRL, stapling, and Certificate Transparency logs.
• JA3, JA3S, and JARM fingerprinting with bundled signature databases.
• Compliance engine for PCI DSS, NIST, HIPAA, SOC 2, Mozilla, and GDPR, plus configurable policy evaluation.
• Terminal, JSON, CSV, HTML, and XML output formats.
• Axum REST/WebSocket API with authentication, rate limiting, metrics, history, certificate inventory, and job progress.
• SQLite/PostgreSQL persistence with migrations, scan history, and analytics.
• Continuous certificate monitoring with email, Slack, Teams, PagerDuty, and webhook alerts.
• Mass, multi-IP, anycast, custom-resolver, DNS-only, response-only, and client-simulation scans.
• PQC readiness and scanners for code, SSH, and VPN.

Bug Fixes And Correctness

The log contains 8 explicitly titled Fix commits plus additional correctness changes:

• Fixed native OpenSSL timeout handling and certificate-phase timeout propagation.
• Fixed formatted validation errors across CT logs, ServerHello parsing, and mTLS validation.
• Added support for encrypted mTLS private keys, including passphrase validation and secure loading.
• Fixed Windows session timeout and session-time type handling.
• Fixed Windows-specific Clippy failures and platform-only test assumptions.
• Classified transport anomalies consistently as inconclusive instead of treating them as definitive vulnerability results.
• Unified signature-algorithm normalization across certificate validation, compliance, and policy evaluation.
• Centralized formula-safe CSV cell formatting to prevent unsafe spreadsheet interpretation.
• Added bounded concurrency for mass scans to prevent unbounded resource usage.
• Added anycast result export and validation so incomplete or inconsistent results are rejected explicitly.

Regression Coverage And Maintenance

• Added table-driven negative tests for invalid database, cipher, curve, protocol, SNI, STARTTLS, SCT, compliance, rate-limit, and scan inputs.
• Added regression coverage for parser rejection, malformed TLS data, invalid status lines, closed transports, and platform-specific network behavior.
• Reused shared fixtures and helpers across API, analytics, compliance, certificates, protocols, scanner, output, and vulnerability tests.
• Removed duplicate tests, dead code, unused imports, and an unused dependency.
• Tightened internal command visibility and preserved boundaries between commands, application, domain, and infrastructure layers.
• Added architecture guard coverage and maintained the Ubuntu, Windows, and macOS test matrix.
• Removed redundant repository metadata and generated agent/tooling files.

Release Automation

• Tags matching vX.Y.Z are checked against the version in Cargo.toml.
• The release workflow publishes to crates.io using the GitHub Actions secret CARGO_REGISTRY_TOKEN.
• Six native packages are built:
  • x86_64-unknown-linux-gnu
  • aarch64-unknown-linux-gnu
  • x86_64-pc-windows-msvc
  • aarch64-pc-windows-msvc
  • x86_64-apple-darwin
  • aarch64-apple-darwin
• The GitHub Release includes binary packages, LICENSE, README, per-file SHA-256 files, and a combined SHA256SUMS manifest.

Verification

• cargo fmt --all -- --check: passed.
• cargo clippy --all-targets --all-features --locked -- -D warnings: passed.
• cargo test --all --locked: 3,401 passed, 76 ignored.
• CI run 31703178461: Ubuntu, macOS, and Windows passed.

Full History

See the complete commit history on GitHub.