CipherRun v0.4.0

CipherRun v0.4.0

CipherRun v0.4.0 is a major release focused on trustworthy findings, stable automation contracts, secure API operation, durable execution, and reproducible validation.

Highlights

Trustworthy scan results

• Added explicit finding statuses, detection methods, confidence levels, stable finding IDs, structured evidence, limitations, references, remediation, and probe-safety metadata.
• Added the versioned scan-result contract and JSON Schema 1.1, including cipherrun schema export and compatibility fixtures.
• Added SARIF 2.1.0, JUnit XML, and version-aware JSON exports.
• Added semantic cipherrun diff, baseline drift detection, stable automation exit codes, --fail-on, and the --fail-on-policy alias.
• Added safe, standard, and aggressive scan profiles plus explicit private-network policy with --allow-private and CIDR-scoped exceptions.

Security and API hardening

• API startup now requires explicit credentials; generated configurations use owner-only permissions and are not overwritten.
• Added bearer authentication, hashed credential records, key identity and tenant metadata, lifecycle and expiry handling, scan ownership, and cross-owner access denial.
• Restricted query-string API keys to WebSocket stream endpoints and deprecated that transport.
• Added signed, scan-bound, single-use WebSocket tickets with 60-second expiry.
• Added HMAC-signed scan webhooks with stable delivery IDs and bounded transient retries.
• Added explicit CORS origin allowlists, optional native HTTPS, client-certificate verification, request IDs, Prometheus metrics, bounded audit events, and proxy-CIDR validation.

Durable jobs and workers

• Connected durable file-backed job storage with restart recovery for the standalone API server.
• Added SQLite/PostgreSQL job backends, conditional claims, lease recovery, heartbeats, bounded retries, and dead-letter records.
• Added standalone SQL-backed workers and feature-gated API-only mode.
• Added principal-scoped atomic scan idempotency, terminal-job TTLs, persisted-artifact cleanup, and administrator-owned worker CIDR scopes.

Detection, probes, and validation

• Added explicit GREASE, early-data, renegotiation, POODLE oracle-variant, and external OpenSSL validation coverage.
• Added reproducible differential validation with SSLyze and TLS-Scanner, pinned vulnerable/patched OpenSSL controls, and an isolated Opossum parser fixture.
• Clarified remote Opossum attestation limits and distinguish potential exposure or inconclusive results from confirmed vulnerabilities.
• Added per-IP finding evidence, published timing methodology, versioned compliance rule packs, and optional CT monitoring integration.

Distribution and release engineering

• Stabilized publishable contracts for the protocol, policy, data, probes, server, CLI, and worker crates.
• Added a standalone worker binary and feature-aware builds for API, database, monitoring, email, CT, PQC, and TLS provider selection.
• Added Rust 1.88 minimum-version and beta checks, reduced feature-matrix coverage, dependency and packaging gates, and release validation fixtures.
• Added separate hardened production and packet-capture laboratory images; the production image uses a non-root distroless runtime with no shell or Linux capabilities.
• Release automation now builds multi-platform packages, checksums, package-manager manifests, SBOMs, crates, and the production container.

Upgrade notes

This release contains breaking public Rust API and scan-result contract changes. Review the API and schema migration documentation before upgrading downstream integrations. API deployments must provide an explicit credentials file, and query-string API keys should be replaced with WebSocket stream tickets.

Packaging Note

The GitHub release assets were generated from the successful multi-platform build and validation jobs. crates.io accepted the protocol, policy, data, probes, and server crates before applying its publication rate limit; the remaining crate publications are pending.

Validation

The main CI workflow passes on Linux, macOS, Windows, Rust 1.88, beta, the external vulnerable TLS fixture, the differential TLS laboratory, quality gates, and the production image smoke test.