v0.4.24 — Management access before equipment control

v0.4.24 — Management access before equipment control

General access-control improvements prompted by the France supermarket refrigeration incident. These changes apply to management interfaces across connected equipment and services; no refrigeration-specific control rules were added.

Changes

• A write-key-protected POST /api/v1/access/check lets a trusted gateway obtain an explicit decision before forwarding management requests.
• Access requires a configured IP/CIDR, an exact allowed operator, and independently verified identity context. Empty policies deny all requests.
• Public management exposure alerts and Internet-to-sensitive-zone segmentation detection extend IoT Shield's existing event handling.
• Config validation rejects malformed policies; policy changes require restart and cannot be partially applied by reload.
• Bounded, strict request parsing; accurate OT alert wording; shared-config regression coverage for the Rust sidecar.

Deployment requirements

Upgrade the Go CLI to v0.4.24. Configure management_access.allowed_sources and allowed_operators, enable IoT Shield, and integrate the decision API with your trusted gateway. Forward only after HTTP 200 and allowed: true; errors and timeouts must deny access. Keep the write key private to that gateway and use TLS for networked API calls.

The gateway must independently verify operator sessions, derive trustworthy client addresses, and enforce resource/action permissions. Target/action fields are audit context. The new API does not install a proxy, validate identity tokens, or protect a controller reachable around the gateway. Telemetry alerts remain distinct from request rejection; existing alert-response dry-run defaults remain available.

Linux, macOS, and Windows Go archives and portable Rust sidecars are available for amd64 and arm64, with checksums, Sigstore bundles, Go SBOMs, and GitHub provenance. Optional packet capture/PQC sidecar features require a source build.

Evidence and limits

The regression suite includes a simulated management gateway that rejects outside-network and forged-session requests before backend access, permits an authorized request, and denies access when the policy API is unavailable. This is not a replay of the France attack. We do not claim that 1-SEC was deployed at affected stores or prevented the historical incident.

See the integration contract and implementation notes.

v0.4.23 — Security catch-up

v0.4.23 — Security catch-up

This release includes the October 13 security implementation and dependency updates. Upgrade both the Go CLI and the optional Rust sidecar to receive the complete update.

What changed

• SAML structural alerts: Auth Fortress detects duplicate IDs, displaced assertions, mismatched signature references, unsigned plaintext assertions, unsafe XML constructs, and inspection-limit violations in supplied saml_response telemetry.
• Trusted agent authority: MCP registration checks no longer accept unverified bearer-token role claims. Agent delegation requires a verified attestation, bound identities, and a future expiry. Linked Token Vault grants expire, renew correctly, and require both user and agent identities during tool-use monitoring.
• Exfiltration detection: LLM Firewall correlates sensitive-file reads, encoding, and outbound HTTP requests within 60 seconds. Destination checks parse actual hostnames, and concurrent web-taint processing uses the existing lock.
• Go security updates: Go 1.26.9, compress v1.18.7, x/crypto v0.56.0, and x/sys v0.47.0.
• Rust maintenance: maintained yaml_serde v0.10.7 replaces the unmaintained YAML backend; chacha20 moves to v0.10.2. Configuration format compatibility is preserved.

Upgrade and integration requirements

Download the archive matching your operating system and architecture from this release. If you use the Rust sidecar, download its matching engine binary as well. Verify the checksum manifests, Sigstore bundles, and GitHub artifact attestations before installation. Linux and macOS installer users can select this version with sh install.sh --version v0.4.23 from the repository checkout.

The release supplies Go archives and Rust sidecars for Linux, macOS, and Windows on amd64 and arm64. Go archives have SBOMs. Prebuilt Rust sidecars use the existing portable configuration without optional packet capture or PQC features; build from source to enable those features.

SAML inspection requires event telemetry and is structural: your service provider must still verify signatures, trusted issuers, audience, lifetime, and replay. Delegation integrations must supply boolean attestation_verified: true only after trusted verification; missing verification now generates alerts. These telemetry checks do not replace an identity provider or an authorization service.

Verification and remaining work

The implementation passed Go tests with race detection, build, vet, staticcheck, Gosec, vulnerability reachability checks, Rust tests and static checks, and repository dependency gates. The release workflow repeats its quality gates and builds the published targets.

Govulncheck finds no affected imported Go package or reachable function. An unused deprecated OpenPGP advisory remains in the required crypto module. Five existing optional PQC/paste maintenance warnings remain tracked for provider migration. Live packet capture was not exercised in this cycle.

See implementation notes and telemetry contracts and the changes since v0.4.21.

v0.4.21

Changelog

• 55cf539 Allow OSV scanner to install with a newer Go toolchain.
• 2f6527d Extend PQC unmaintained OSV ignores through April 2027.
• 01576e7 Point clone, install, and release URLs at simpleending/1-sec.
• 4135210 Unblock release gates with Go 1.26.8 and rustls 0.23.45.