Skip to content

CipherRun v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 16:21
· 175 commits to main since this release
v0.3.1
fa2a58a

CipherRun v0.3.1

Summary

CipherRun's first automated release, with crates.io publication and binary packages for Linux, Windows, and macOS on x64 and ARM64. The repository history contains 1,791 commits. These notes summarize the product capabilities and the fixes, correctness work, test coverage, and release automation included in this release.

Features

  • Modular TLS/SSL scanner covering SSLv2 through TLS 1.3.
  • Cipher, protocol, extension, signature, ALPN/NPN, SNI, renegotiation, session resumption, and STARTTLS analysis.
  • TLS vulnerability checks including Heartbleed, ROBOT, POODLE, LOGJAM, BEAST, CRIME, DROWN, FREAK, LUCKY13, SWEET32, Ticketbleed, Winshock, and other checks.
  • Certificate and trust-chain analysis covering signature algorithms, expiration, key strength, revocation, OCSP, CRL, stapling, and Certificate Transparency logs.
  • JA3, JA3S, and JARM fingerprinting with bundled signature databases.
  • Compliance engine for PCI DSS, NIST, HIPAA, SOC 2, Mozilla, and GDPR, plus configurable policy evaluation.
  • Terminal, JSON, CSV, HTML, and XML output formats.
  • Axum REST/WebSocket API with authentication, rate limiting, metrics, history, certificate inventory, and job progress.
  • SQLite/PostgreSQL persistence with migrations, scan history, and analytics.
  • Continuous certificate monitoring with email, Slack, Teams, PagerDuty, and webhook alerts.
  • Mass, multi-IP, anycast, custom-resolver, DNS-only, response-only, and client-simulation scans.
  • PQC readiness and scanners for code, SSH, and VPN.

Bug Fixes And Correctness

The log contains 8 explicitly titled Fix commits plus additional correctness changes:

  • Fixed native OpenSSL timeout handling and certificate-phase timeout propagation.
  • Fixed formatted validation errors across CT logs, ServerHello parsing, and mTLS validation.
  • Added support for encrypted mTLS private keys, including passphrase validation and secure loading.
  • Fixed Windows session timeout and session-time type handling.
  • Fixed Windows-specific Clippy failures and platform-only test assumptions.
  • Classified transport anomalies consistently as inconclusive instead of treating them as definitive vulnerability results.
  • Unified signature-algorithm normalization across certificate validation, compliance, and policy evaluation.
  • Centralized formula-safe CSV cell formatting to prevent unsafe spreadsheet interpretation.
  • Added bounded concurrency for mass scans to prevent unbounded resource usage.
  • Added anycast result export and validation so incomplete or inconsistent results are rejected explicitly.

Regression Coverage And Maintenance

  • Added table-driven negative tests for invalid database, cipher, curve, protocol, SNI, STARTTLS, SCT, compliance, rate-limit, and scan inputs.
  • Added regression coverage for parser rejection, malformed TLS data, invalid status lines, closed transports, and platform-specific network behavior.
  • Reused shared fixtures and helpers across API, analytics, compliance, certificates, protocols, scanner, output, and vulnerability tests.
  • Removed duplicate tests, dead code, unused imports, and an unused dependency.
  • Tightened internal command visibility and preserved boundaries between commands, application, domain, and infrastructure layers.
  • Added architecture guard coverage and maintained the Ubuntu, Windows, and macOS test matrix.
  • Removed redundant repository metadata and generated agent/tooling files.

Release Automation

  • Tags matching vX.Y.Z are checked against the version in Cargo.toml.
  • The release workflow publishes to crates.io using the GitHub Actions secret CARGO_REGISTRY_TOKEN.
  • Six native packages are built:
    • x86_64-unknown-linux-gnu
    • aarch64-unknown-linux-gnu
    • x86_64-pc-windows-msvc
    • aarch64-pc-windows-msvc
    • x86_64-apple-darwin
    • aarch64-apple-darwin
  • The GitHub Release includes binary packages, LICENSE, README, per-file SHA-256 files, and a combined SHA256SUMS manifest.

Verification

  • cargo fmt --all -- --check: passed.
  • cargo clippy --all-targets --all-features --locked -- -D warnings: passed.
  • cargo test --all --locked: 3,401 passed, 76 ignored.
  • CI run 31703178461: Ubuntu, macOS, and Windows passed.

Full History

See the complete commit history on GitHub.

Assets 15
Loading