v0.40.0

Find an ID, and polish

• vmsctl explain --list prints every control and check with its title (Korean with --lang ko), to find the ID to explain.
• The dashboard says "1 host" and "1 day" (English) for a count of one.
• English docs proofread: the README sample, the essentials paragraph, VISION (the agent uses its token and a pinned key, not mutual TLS), and awkward sentences.

Changelog

Features

• e4a9c66 feat: explain --list: every control and check with its title (#299)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.40.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.39.0

Dashboard wording and a KISA page

• Korean dashboard wording reworked after an independent proofread: a host that stopped reporting is now "보고 끊김", hosts are counted in 대, literal phrases are gone.
• A Korean page for the 67 KISA controls, generated from the rules: https://with-developer.github.io/vmsctl/ko/kisa/

Changelog

Features

• a3a0faf feat: a Korean page for the KISA 2026 controls, generated by make docs (#295)

Other changes

• fcee967 content: Korean dashboard wording (#296)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.39.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.38.0

Korean polish

• GitHub Action: a lang input (en or ko) for the log and the job summary.
• Korean text of the rules and the Korean docs proofread by an independent reviewer: wrong or loan terms, stiff phrasing, particles. 강제 접근 제어 is now one term for mandatory access control.

Changelog

Features

• 4182dad feat: action: a lang input (en or ko) for the log and the job summary (#292)

Other changes

• 611c34d content: Korean proofreading fixes (#290)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.38.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.37.0

essentials revision 7 (waivers need rewriting)

The essentials profile now has 29 controls and its revision is 7:

• ES-28 SSH offers no broken ciphers, MACs or key exchanges (ssh.weak-algorithms: 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, hmac-md5, hmac-sha1-96, umac-64, diffie-hellman-group1-sha1, gss-group1-sha1). A stock CentOS/RHEL 7 fails it through the defaults of OpenSSH 7.4; modern distributions pass.
• ES-29 SSH logs who logs in (ssh.log-level: LogLevel INFO or VERBOSE).

A waiver of an essentials control names the revision it was written for, so existing waivers stop applying until you write them again for revision 7 (the scan says which). kisa-2026 is unchanged.

Also: the scan table ends with a pointer to vmsctl explain when a check failed.

Changelog

Features

• 24b9b35 feat: essentials revision 7: ES-28 no broken SSH algorithms, ES-29 SSH log level (#288)
• 4ef27f0 feat: scan table: a pointer to vmsctl explain when a check failed (#287)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.37.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.36.0

Korean, all the way down

• Korean rule reference: docs/rules.ko.md lists every control and check with the Korean title, description, reason and fix. It is generated with the English one, so the two cannot drift.
• Manual checks in Korean: the guidance of the checks a person must review (reasonKo, a new optional field of the result) is shown in Korean by scan --lang ko, the Markdown and HTML reports and the dashboard.
• Dependency: golang.org/x/sys v0.50.0.

Changelog

Features

• 90e3cbf feat: Korean guidance of manual checks (reasonKo) (#285)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.36.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.35.0

Fleet sheets and Korean diff

• Matrix as a sheet: GET /api/v1/matrix?format=csv and an "Export CSV" button on the dashboard's matrix page: a row per host, a column per control, the status in each cell (?lang=ko for Korean column titles). The host list's CSV now starts with a byte order mark too, so Excel reads Korean text correctly.
• Matrix filter: the matrix page can be filtered by host name.
• vmsctl diff --lang ko: the table shows the Korean titles of controls and checks.

Changelog

Features

• 363f89f feat: dashboard: filter the matrix by host name (#278)
• bfa4df1 feat: diff --lang ko: Korean titles in the table of vmsctl diff (#279)
• bcec045 feat: matrix as CSV, and a BOM for the hosts CSV (#280)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.35.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.34.0

essentials revision 6 (waivers need rewriting)

The essentials profile now has 27 controls and its revision is 6:

• ES-26 No account has an empty password (accounts.no-empty-passwords).
• ES-27 Printing and network discovery are off unless needed (services.no-print-discovery: CUPS, cups-browsed, Avahi). A desktop or print server waives it with a reason.

Stock images of all supported distributions pass both. A waiver of an essentials control names the revision it was written for, so existing waivers stop applying until you write them again for revision 6 (the scan says which). kisa-2026 is unchanged.

Also: vmsctl server run --webhook-lang ko writes the one-line text of a webhook event in Korean.

Changelog

Features

• 8201d0f feat: essentials revision 6: ES-26 no empty passwords, ES-27 no print and discovery services (#276)
• d9f636c feat: server run --webhook-lang ko: the one-line text of a webhook event in Korean (#274)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.34.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.33.0

Korean guidance for every check

Every built-in check now explains itself in Korean: what it looks at, why it matters and how to fix it, written by hand and not machine-translated.

• vmsctl explain <id> --lang ko prints it, and scan --lang ko (or VMSCTL_LANG=ko) shows Korean titles in the table and the Markdown report with the Korean fix hint.
• The HTML report toggles Korean, and the CSV has a last column how_to_fix_ko.
• The dashboard shows the Korean fix hint and the Korean check title when its language is Korean.
• Results carry the Korean fix hint in the new optional field remediationKo (schema v1 is unchanged otherwise), and the server accepts it from older and newer agents alike.

Changelog

Features

• 65a0b63 feat: Korean guidance in the rules (description_ko, rationale_ko, remediation_ko, guidance_ko) (#270)
• a1ff558 feat: scan --lang ko: Korean titles in the table and in Markdown (#269)

Bug fixes

• efb40b0 fix: dashboard: show the Korean check title in the host detail (#272)

Other changes

• 62a4383 content: Korean guidance for every built-in check (#271)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.33.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.32.0

essentials revision 5: a new SSH check in ES-04 (read this if you waive essentials controls)

ES-04 is now "SSH limits attempts, time and features" and includes the new check ssh.login-grace-time, written by @sarankumar1325 (first contribution, thank you!): LoginGraceTime has to be between 1 and 60 seconds (a parameter). The OpenSSH default of 120 and 0 (no limit) fail. On a live host the value comes from sshd -T, which prints seconds; on a mounted root a plain number is read as seconds and a value with a unit such as 1m reports ERROR rather than a guess.

What you have to do: a waiver of a control of essentials names the revision it was written for, so those waivers stop applying until you write them again for revision: 5 (the scan lists them and says so). A stock OpenSSH already failed ES-04 (MaxAuthTries defaults to 6); a host you hardened for MaxAuthTries and X11Forwarding now also needs LoginGraceTime 60. Waivers of single checks, and everything under kisa-2026, are not affected.

Changelog

Features

• d1b8f8c feat: essentials revision 5: ssh.login-grace-time in ES-04 (#262)
• 4ea75dc feat: ssh.login-grace-time: a client has little time to log in (#259)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.32.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

v0.31.0

essentials revision 4: a new control, ES-25 (read this if you waive essentials controls)

The essentials profile has a 25th control, ES-25 "Mandatory access control is on": it passes when SELinux is set to enforcing in /etc/selinux/config, or the apparmor package is installed and its unit is enabled (Ubuntu and Debian do this by default). permissive, disabled and no mandatory access control at all fail. A stock Amazon Linux 2023 ships SELinux in permissive mode, so it fails ES-25. The check reads what the next boot does, not the running kernel (a kernel started without the module, or setenforce 0 since boot, is not seen), and it does not apply to container images.

What you have to do: a waiver of a control of essentials names the revision it was written for, so after this release those waivers stop applying until you write them again for revision: 4 (the scan lists them and says so). Waivers of single checks, and everything under kisa-2026, are not affected. A host that confines its services another way gets a FAIL for ES-25: waive it with a reason.

Also in this release: the Korean wording in the dashboard and the Korean documentation says 점검 항목 where it said 컨트롤 (KISA's own term); English text and command output are unchanged.

Changelog

Features

• 0ffc46a feat: essentials revision 4: ES-25, mandatory access control is on (#244)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.31.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.