Skip to content

v0.37.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Nov 12:51
· 22 commits to main since this release
v0.37.0
24b9b35
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

essentials revision 7 (waivers need rewriting)

The essentials profile now has 29 controls and its revision is 7:

  • ES-28 SSH offers no broken ciphers, MACs or key exchanges (ssh.weak-algorithms: 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, hmac-md5, hmac-sha1-96, umac-64, diffie-hellman-group1-sha1, gss-group1-sha1). A stock CentOS/RHEL 7 fails it through the defaults of OpenSSH 7.4; modern distributions pass.
  • ES-29 SSH logs who logs in (ssh.log-level: LogLevel INFO or VERBOSE).

A waiver of an essentials control names the revision it was written for, so existing waivers stop applying until you write them again for revision 7 (the scan says which). kisa-2026 is unchanged.

Also: the scan table ends with a pointer to vmsctl explain when a check failed.

Changelog

Features

  • 24b9b35 feat: essentials revision 7: ES-28 no broken SSH algorithms, ES-29 SSH log level (#288)
  • 4ef27f0 feat: scan table: a pointer to vmsctl explain when a check failed (#287)

Verify

checksums.txt has the SHA-256 of every file here and is signed with Sigstore by this
repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/with-developer/vmsctl/.github/workflows/release.yml@refs/tags/v0.37.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Build provenance: gh attestation verify <file> --repo with-developer/vmsctl.

Assets 16
Loading