Skip to content

Releases: EvilBit-Labs/opnDossier

Release list

v1.6.0

v1.6.0 Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jul 05:03
v1.6.0
This tag was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.
a104e06
This commit was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.

opnDossier v1.6.0 — Capability discovery, SNMPv3 key redaction, and CVE remediation

v1.6.0 adds a machine-readable list command group for capability discovery, closes a cleartext SNMPv3 encryption-key leak in the sanitize command, and remediates a batch of Go stdlib CVEs. It is a drop-in upgrade from v1.5.0 — no breaking changes and no public Go API changes.

Highlights

New list command group for capability discovery. opndossier list plugins, opndossier list devices, and opndossier list formats enumerate what the running binary supports — compliance plugins (built-in, plus dynamic ones when --plugin-dir is set), supported device-config parsers, and available output formats. Each subcommand emits one entry per line for shell pipelines and accepts --json for structured output, so AI agents and automation can enumerate capabilities without scraping --help text. (#623)

# Plain text (one name per line)
opndossier list formats

# Structured output for automation
opndossier list plugins --json

SNMPv3 encryption keys are now redacted. opnDossier sanitize walks raw XML element names — <password> was caught by the generic pass match, but <enckey>, the SNMPv3 privacy/encryption key, was leaking to output in cleartext. It is now redacted. The same change deduplicated the two divergent SNMP ServiceDetails redaction paths (processor and converter) behind a single non-mutating analysis.RedactServiceDetails primitive, with a convergence test pinning that both paths redact identically. (NATS-163, #667)

Go stdlib CVE remediation. The Go toolchain was bumped to 1.26.5 to pick up the fix for GO-2026-5856, and a govulncheck crash was resolved alongside remediation of outstanding stdlib CVEs — unblocking Dependabot coverage. (#656, #683)

Also in this release

  • Performance: converter allocation and memoization improvements — NAT-heavy conversion benchmarks, firewall-row allocation cut ~41%, multi-format export statistics memoized, and the CoreProcessor serialization mutex removed. (#598, #601, #604, #608)
  • Project housekeeping: modernized issue templates, added SUPPORT.md and FUNDING.yml (#676), removed the tessl integration (#665), plus routine dependency and GitHub Actions bumps.

Upgrade notes

Drop-in upgrade from v1.5.0. No config changes, no breaking changes, no public Go API changes.

Full changelog

Full Changelog: v1.5.0...v1.6.0

Security Information

This release includes:

  • SBOM (Software Bill of Materials) generated with CycloneDX-gomod
  • SLSA Level 3 provenance attestation
  • Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.6.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier_1.6.0_amd64.deb
sudo dpkg -i opndossier_1.6.0_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier-1.6.0-1.x86_64.rpm
sudo rpm -i opndossier-1.6.0-1.x86_64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier_1.6.0_x86_64.apk
sudo apk add --allow-untrusted opndossier_1.6.0_x86_64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier-1.6.0-1-x86_64.pkg.tar.zst
sudo pacman -U opndossier-1.6.0-1-x86_64.pkg.tar.zst

Note: For pre-release versions (e.g., 1.4.0-rc.1), package filenames
use format-specific version transforms (~ for deb/rpm, _ for apk,
concatenated for archlinux). Check the release assets list for exact filenames.

Download Binary

Download the appropriate binary for your platform from the assets below.

Verify Checksums

sha256sum -c opnDossier_checksums.txt
Assets 26

v1.5.0

v1.5.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Apr 00:42
v1.5.0
This tag was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.
f74614d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

opnDossier v1.5.0 — Public Go API lock, secret redaction, and parsing correctness

v1.5.0 locks down the public Go API surface in pkg/model, pkg/schema/*, and pkg/parser/* for cross-repo consumption — sibling products can now depend on opnDossier as a stable library. It also ships a high-severity sanitizer fix for OpenVPN keys, a subtle but pervasive parsing correctness fix, and plugin-loader hardening.

Highlights

Public Go API is now stable. pkg/model/, pkg/schema/opnsense/, pkg/schema/pfsense/, and pkg/parser/ are audited, fully godoc'd, and frozen for external consumers. You can now import them directly:

import (
    "github.com/EvilBit-Labs/opnDossier/pkg/parser"
    _ "github.com/EvilBit-Labs/opnDossier/pkg/parser/opnsense" // register parser
    _ "github.com/EvilBit-Labs/opnDossier/pkg/parser/pfsense"
)

doc, _ := parser.NewFactory().Parse(ctx, xmlReader)

No more internal/ imports, stdlib-only production deps, and the blank-import registration pattern follows database/sql. (#569, #575, #580, #586)

OpenVPN TLS-auth keys are now redacted. Previously, opnDossier sanitize on configs containing OpenVPN <tls> or <StaticKeys> elements leaked raw HMAC keys to stdout — enough material to forge OpenVPN handshakes. Path-anchored patterns (openvpn.tls, openvpn.statickeys) now catch the real OpenVPN paths without false-positives against Suricata IDS or IPsec charon syslog. A new IsOpenVPNStaticKey value detector matches the -----BEGIN OpenVPN Static key V1----- envelope. (#587)

Liberal boolean parsing for OPNsense/pfSense. Previously, <enable>0</enable> was treated as enabled because the parser only checked element presence — any non-empty body was "true." Now, boolean elements delegate through a shared truthy vocabulary (1|on|yes|true|enable|enabled, case-insensitive), so <enable>0</enable>, <enable>no</enable>, and <enable>off</enable> all correctly resolve to false. (#558, #577)

Dynamic plugin loader preflight. Before plugin.Open() is invoked, the loader now rejects symlinked .so files, non-regular files (FIFO/socket/device nodes), group/world-writable plugin files, and world-writable parent directories. Every load attempt emits a structured audit log with SHA-256, mode bits, owner UID, and verdict. The dynamic-plugin trust model is now documented explicitly in audit help text. (#587)

Upgrade notes

Breaking: template config keys silently ignored. If your ~/.opnDossier.yaml or environment set any of the following, they are no longer recognized (Viper ignores them without error):

  • Config keys: template, engine, use_template, export.template
  • Env vars: OPNDOSSIER_TEMPLATE, OPNDOSSIER_ENGINE, OPNDOSSIER_EXPORT_TEMPLATE

The template system was removed in favor of the programmatic builder — remove these keys from your config to avoid confusion. (#550, #556)

Breaking (Go API consumers only): pfsense.ValidateFunc → pfsense.SetValidator. The exported var ValidateFunc has been replaced with a sync.Once-guarded SetValidator(fn) function to prevent malicious plugin init() from stomping the validator post-CLI-setup. Migration:

// Before (v1.4.x):
pfsense.ValidateFunc = myValidator

// After (v1.5.0+):
pfsense.SetValidator(myValidator)  // one-shot; first call wins

Only affects code that injects a custom pfSense validator — most consumers don't touch this. (#587)

Otherwise: drop-in upgrade from v1.4.0.

Full changelog

See CHANGELOG.md for the complete list.

Security Information

This release includes:

  • SBOM (Software Bill of Materials) generated with CycloneDX-gomod
  • SLSA Level 3 provenance attestation
  • Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.5.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opndossier_1.5.0_amd64.deb
sudo dpkg -i opndossier_1.5.0_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opndossier-1.5.0-1.x86_64.rpm
sudo rpm -i opndossier-1.5.0-1.x86_64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opndossier_1.5.0_x86_64.apk
sudo apk add --allow-untrusted opndossier_1.5.0_x86_64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.5.0/opndossier-1.5.0-1-x86_64.pkg.tar.zst
sudo pacman -U opndossier-1.5.0-1-x86_64.pkg.tar.zst

Note: For pre-release versions (e.g., 1.4.0-rc.1), package filenames
use format-specific version transforms (~ for deb/rpm, _ for apk,
concatenated for archlinux). Check the release assets list for exact filenames.

Download Binary

Download the appropriate binary for your platform from the assets below.

Verify Checksums

sha256sum -c opnDossier_checksums.txt
Loading

v1.4.0

v1.4.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Apr 16:27
v1.4.0
This tag was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.
0ec9309
This commit was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.

opnDossier v1.4.0 — Kea DHCP, full compliance posture, and container support

This release unifies DHCP parsing across ISC and Kea backends, overhauls blue mode into a true compliance posture report, and ships a Dockerfile and GitHub Action for CI integration. Security hardening and a 710-line net code reduction round it out.

Highlights

Kea DHCP4 parsing. Previously, opnDossier only extracted general-level Kea fields — subnets, pools, and reservations were invisible. Now, full Kea DHCP4 data is parsed and normalized into the same DHCPScope model as ISC DHCP, so reports, diffs, and exports work uniformly regardless of backend.

# CommonDevice DHCP scopes now include:
  - source: kea        # or "isc"
    subnet: 10.0.1.0/24
    gateway: 10.0.1.1
    staticLeases: ['...']

Three-state compliance posture. Blue mode reports previously showed only findings. Now every control reports PASS, FAIL, or UNKNOWN — with 75 new controls across STIG, SANS, and Firewall plugins. The new --failures-only flag filters to just what needs attention.

Docker and GitHub Action. Dockerfile and action.yaml are wired into goreleaser v2 for container image builds on release. Run opnDossier in CI pipelines without installing Go. (#521, closes #482)

LDAP pseudonymization. The sanitizer now pseudonymizes authserver LDAP bind passwords (e.g., ldap-bindpw-001) instead of flat-redacting them, preserving the structure needed for config comparison while removing secrets. (#529)

Upgrade notes

No breaking changes. Drop-in upgrade from v1.3.0.

New optional flags:

  • --failures-only — show only failing controls in blue mode (markdown format only)
  • Docker image available on release for CI/CD pipelines

Full changelog

Full Changelog: v1.3.0...v1.4.0

See the weekly changelog discussion for the complete list of changes, contributors, and dependency updates.

Security Information

This release includes:

  • SBOM (Software Bill of Materials) generated with CycloneDX-gomod
  • SLSA Level 3 provenance attestation
  • Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.4.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Docker

docker pull ghcr.io/evilbit-labs/opndossier:v1.4.0

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opndossier_1.4.0_amd64.deb
sudo dpkg -i opndossier_1.4.0_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opndossier-1.4.0-1.x86_64.rpm
sudo rpm -i opndossier-1.4.0-1.x86_64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opndossier_1.4.0_x86_64.apk
sudo apk add --allow-untrusted opndossier_1.4.0_x86_64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.4.0/opndossier-1.4.0-1-x86_64.pkg.tar.zst
sudo pacman -U opndossier-1.4.0-1-x86_64.pkg.tar.zst

Download Binary

Download the appropriate binary for your platform from the assets below.

Verify Checksums

sha256sum -c opnDossier_checksums.txt
Loading

v1.3.0

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Mar 23:58
v1.3.0
This tag was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.
00b6149
This commit was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.

opnDossier v1.3.0

Multi-platform support, starting with pfSense.

v1.3.0 adds pfSense configuration analysis alongside the existing OPNsense parser, built on a new multi-device architecture designed for extensibility.

Highlights

pfSense Support

opnDossier now parses pfSense config.xml files with the same analysis capabilities available for OPNsense: security findings, dead rule detection, unused interface identification, and multi-format export. Auto-detection identifies the firewall platform from the configuration file, so the workflow is unchanged -- just point opnDossier at your config and it works.

Dedicated Audit Command

The new opndossier audit command is a first-class entry point for security analysis. It replaces the previous convert --audit-mode workflow with cleaner flags, glamour-rendered terminal output, and built-in support for processing multiple configuration files concurrently. The default audit mode is now blue (remediation-focused).

Pluggable Parser Registry

New DeviceParser registry follows the database/sql driver pattern. External Go projects can register custom parsers via blank imports. This is the foundation for community-contributed platform support in future releases. See the plugin development guide for details.

Configuration Diff

New opndossier diff command compares two configuration files and shows what changed. Supports side-by-side mode, HTML output with syntax highlighting, section-level change detection, and security scoring of the delta. Useful for reviewing changes before applying a backup, auditing what changed between maintenance windows, or comparing configs across devices.

# Terminal diff
opndossier diff old-config.xml new-config.xml

# HTML report with side-by-side view
opndossier diff old-config.xml new-config.xml --format html --side-by-side -o diff-report.html

Sanitize Command

New opndossier sanitize command redacts sensitive data (passwords, keys, SNMP strings, RADIUS secrets) from configuration files before sharing. Three sanitization modes target different use cases:

  • Aggressive -- for public sharing (forums, GitHub issues). Redacts credentials, network topology, hostnames, and all identifying information.
  • Moderate (default) -- for internal sharing or vendor support. Redacts credentials and secrets while preserving network structure.
  • Minimal -- credentials only. Strips passwords and keys, leaves everything else intact.

Sanitization maintains referential integrity: the same original value always maps to the same redacted value across the entire config, so network relationships and rule references remain consistent and analyzable. The optional --mapping flag generates a JSON mapping file for reverse lookup when you need to correlate redacted output back to the original.

Built directly from community feedback -- requested by @DevGuyRash and other operators who need to share configs with vendors or post them in support forums without manual redaction.

Additional Output Formats

Export to text and HTML in addition to the existing Markdown, JSON, and YAML formats. HTML output includes alert rendering for security findings. The --redact flag provides opt-in sensitive field redaction during conversion.

Expanded Report Coverage

Reports now include IDS/Suricata configuration, gateway groups, enhanced DHCP reporting (server configuration, static mappings, advanced options), and improved NAT reporting with mode display, forwarding rules, and inbound rules. Compliance checks expanded with password policy and audit logging validation.

Public API Surface

The CommonDevice model and OPNsense schemas are now exported under pkg/model/ and pkg/schema/opnsense/. External tools can import and work with parsed firewall configurations directly as a Go library.

What Changed

Architecture

  • Unified Finding type across audit, compliance, and processor packages -- consistent severity levels and validation everywhere (#280)
  • Shared analysis package eliminates ~400 lines of duplicated detection logic and fixes an inconsistent rule equivalence algorithm (#321)
  • ReportBuilder interface segregation splits a 20-method interface into three focused interfaces (SectionBuilder, TableWriter, ReportComposer) for cleaner consumer code (#323)
  • FormatRegistry centralizes output format dispatch, replacing hardcoded routing (#434)
  • Enum type safety replaces bare string literals with typed constants for firewall rules, NAT modes, DHCP, and protocol types (#298)

Plugin System

  • Panic recovery wraps each plugin's RunChecks() in defer recover() so a misbehaving plugin cannot crash the audit (#309)
  • Load failure reporting surfaces .so plugin errors to the user with per-plugin details; new --plugin-dir flag for custom plugin directories (#311)

Performance & Reliability

  • Streaming generation for large configurations -- reduced memory pressure on real-world configs (#189)
  • Production hardening phases 1-4 (#214)
  • ISO-8859-1 and Windows-1252 encoding support -- properly handles non-UTF-8 configs exported from older systems (#169)
  • Comprehensive service detection for more accurate unused interface analysis (#215)

Bug Fixes

  • Severity breakdown now correctly appears in audit reports (#310)
  • IPv6 validation uses net.ParseIP instead of a dot-check heuristic
  • --include-tunables flag properly wires through display and convert commands (#413)
  • Shared backing array mutations prevented in normalize -- deep copies all mutable slice fields (#313)
  • Section added/removed detection restored for value types in diff output (#388)
  • Deterministic report output via sorted map iterations (#256)

Documentation

  • Comprehensive system architecture documentation
  • Plugin development guide and API reference
  • Rewritten data-model docs for the CommonDevice export model
  • Expanded contributing guide with architecture and governance
  • Restructured user-guide commands documentation

Supported Platforms

Platform Status
OPNsense Fully supported
pfSense New in v1.3.0

Installation

Download pre-built binaries from the Releases page or build from source:

go install github.com/EvilBit-Labs/opnDossier@v1.3.0

Quick Start

# OPNsense (unchanged)
opndossier convert config.xml -o report.md

# pfSense (auto-detected)
opndossier convert pfsense-config.xml -o report.md

# Security audit
opndossier audit config.xml

# Compare two configs
opndossier diff old-config.xml new-config.xml

# Strip secrets before sharing (default: moderate mode)
opndossier sanitize config.xml -o config-safe.xml

# Aggressive mode for public posting
opndossier sanitize config.xml --mode aggressive -o config-public.xml

Full changelog: v1.2.2...v1.3.0

Loading

v1.2.1

v1.2.1

Choose a tag to compare

View all tags
@unclesp1d3r unclesp1d3r released this 12 Feb 06:07
Immutable release. Only release title and notes can be modified.
v.1.2.1
2697020
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v1.2.1

This release includes the following changes:

Full Changelog: v1.1.0...v1.2.1

Security Information

This release includes:

  • SBOM (Software Bill of Materials) generated with CycloneDX-gomod
  • SLSA Level 3 provenance attestation
  • Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.2.1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opndossier_1.2.1_linux_amd64.deb
sudo dpkg -i opndossier_1.2.1_linux_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opndossier_1.2.1_linux_amd64.rpm
sudo rpm -i opndossier_1.2.1_linux_amd64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opndossier_1.2.1_linux_amd64.apk
sudo apk add --allow-untrusted opndossier_1.2.1_linux_amd64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.2.1/opndossier_1.2.1_linux_amd64.pkg.tar.xz
sudo pacman -U opndossier_1.2.1_linux_amd64.pkg.tar.xz

Download Binary

Download the appropriate binary for your platform from the assets below.

Docker

docker pull ghcr.io/evilbit-labs/opndossier:v1.2.1

Verify Checksums

sha256sum -c opnDossier_checksums.txt

What's Changed

  • chore(deps): bump actions/checkout from 5.0.0 to 6.0.2 by @dependabot[bot] in #191
  • feat(diff): add configuration diff tool for OPNsense XML comparison by @unclesp1d3r in #227
  • chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #233
  • chore(deps): bump actions/download-artifact from 4.3.0 to 7.0.0 by @dependabot[bot] in #232
  • feat(sanitizer): add sanitize command to redact sensitive data from OPNsense configs by @unclesp1d3r in #234
  • docs: add Contributor Covenant Code of Conduct by @unclesp1d3r in #236
  • feat: parse and report IDS/Suricata configuration by @unclesp1d3r in #237
  • fix(security): pin GitHub Actions to SHA commits by @unclesp1d3r in #240
  • chore(deps): bump actions/attest-build-provenance from 2.2.3 to 3.2.0 by @dependabot[bot] in #228
  • chore(deps): bump github/codeql-action from 4.32.0 to 4.32.1 by @dependabot[bot] in #231
  • docs(go): add doc comments to all exported symbols for 100% coverage by @unclesp1d3r in #241
  • chore(deps): bump github.com/charmbracelet/bubbles from 0.21.0 to 0.21.1 by @dependabot[bot] in #229
  • chore(deps): upgrade dependencies and fix stdlib vulnerability by @unclesp1d3r in #246
  • feat(diff): add HTML formatter, side-by-side mode, analyzers, and security scoring by @unclesp1d3r in #245

Full Changelog: v1.1.0...v1.2.2

Contributors

unclesp1d3r and dependabot
Loading
0 Join discussion

v1.1.0

v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Feb 06:40
Immutable release. Only release title and notes can be modified.
v1.1.0
8a72408
This commit was signed with the committer’s verified signature.
unclesp1d3r UncleSp1d3r
GPG key ID: 2AB0218B7B2D5EC0
Verified
Learn about vigilant mode.

Release v1.1.0

This release includes the following changes:

Full Changelog: v1.0.0...v1.1.0

Security Information

This release includes:

  • SBOM (Software Bill of Materials) generated with CycloneDX-gomod
  • SLSA Level 3 provenance attestation
  • Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.1.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opndossier_1.1.0_linux_amd64.deb
sudo dpkg -i opndossier_1.1.0_linux_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opndossier_1.1.0_linux_amd64.rpm
sudo rpm -i opndossier_1.1.0_linux_amd64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opndossier_1.1.0_linux_amd64.apk
sudo apk add --allow-untrusted opndossier_1.1.0_linux_amd64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.1.0/opndossier_1.1.0_linux_amd64.pkg.tar.xz
sudo pacman -U opndossier_1.1.0_linux_amd64.pkg.tar.xz

Download Binary

Download the appropriate binary for your platform from the assets below.

Docker

docker pull ghcr.io/evilbit-labs/opndossier:v1.1.0

Verify Checksums

sha256sum -c opnDossier_checksums.txt

What's Changed

  • chore: update changelog generation process by @unclesp1d3r in #55
  • chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #56
  • fix(parser): handle comma-separated interface lists as multiple interfaces by @unclesp1d3r in #71
  • fix: firewall rules missing critical protocol information in reports by @unclesp1d3r in #72
  • fix(templates): resolve comprehensive report structural inconsistencies with summary report by @unclesp1d3r in #74
  • Add license scan report and status by @fossabot in #75
  • Feat/pipeline v2 compliance by @unclesp1d3r in #76
  • feat(NAT): prominently display NAT mode and forwarding rules with enhanced security information by @Copilot in #77
  • feat(ci): implement Windows smoke-only testing strategy by @unclesp1d3r in #80
  • feat(ci): add Copilot setup steps workflow for automated project setup by @unclesp1d3r in #81
  • feat(markdown): enhance interface link formatting in markdown reports by @unclesp1d3r in #82
  • feat(reports): implement gateway groups in reports for GitHub Issue 65 by @unclesp1d3r in #83
  • feat(tests): add comprehensive tests for MarkdownBuilder functionality by @unclesp1d3r in #87
  • 85 phase 2 implement smart migration path with hybrid generator by @unclesp1d3r in #88
  • Update AI Agent instructions by @unclesp1d3r in #99
  • [WIP] [Phase 3.1] Create template function to Go method mapping document by @Copilot in #100
  • feat(converter): implement utility functions for template migration Phase 3.2 by @Copilot in #101
  • feat(converter): implement data transformation functions for filtering and aggregation by @Copilot in #102
  • chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.2 by @dependabot[bot] in #103
  • chore(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #104
  • chore(deps): bump slsa-framework/slsa-verifier from 2.5.1 to 2.7.1 by @dependabot[bot] in #105
  • feat(converter): implement Phase 3.4 security assessment functions (risk levels, scoring) by @Copilot in #108
  • feat(test): Create comprehensive test suite with CI-stable performance baselines for ported methods by @Copilot in #110
  • chore(deps): bump slsa-framework/slsa-github-generator from 2.0.0 to 2.1.0 by @dependabot[bot] in #106
  • chore(deps): bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #107
  • chore(deps): bump anchore/scan-action from 4 to 6 by @dependabot[bot] in #109
  • feat(benchmarks): add comprehensive performance benchmarking suite for template vs programmatic comparison by @Copilot in #111
  • feat(cli): Update CLI to use programmatic mode by default with explicit engine selection by @Copilot in #112
  • [Phase 3.8] Update documentation for programmatic markdown generation by @Copilot in #113
  • chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #115
  • chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @dependabot[bot] in #116
  • chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #118
  • feat(docs): add comprehensive migration guide for custom template users by @Copilot in #114
  • chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #135
  • chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.2 by @dependabot[bot] in #138
  • ci: Remove gomod dependency maintenance from config by @unclesp1d3r in #133
  • fix(tests): update test assertions for markdown library v0.10.0 by @unclesp1d3r in #139
  • feat: implement template mode deprecation notices and migration tooling for v2.0 by @unclesp1d3r in #147
  • chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #134
  • chore: coordinate charmbracelet ecosystem update fang lipgloss log x by @unclesp1d3r in #148
  • feat: implement template mode deprecation framework for v2.0 by @unclesp1d3r in #151
  • feat(ci): enhance Grype vulnerability scanning in CI pipeline by @unclesp1d3r in #156
  • feat(display): implement proper text wrapping support for --wrap flag by @unclesp1d3r in #158
  • fix: replace panic based error handling in production code by @unclesp1d3r in #167
  • fix: remove deprecated logging configuration functions by @unclesp1d3r in #168
  • chore(deps): bump actions/download-artifact from 5 to 7 by @dependabot[bot] in #166
  • chore(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #127
  • chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #128
  • chore(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #131
  • feat: implement proper ISO-8859-1 and Windows-1252 XML encoding support by @unclesp1d3r in #169
  • feat: add --no-wrap flag as explicit alias for --wrap 0 by @unclesp1d3r in #170
  • chore: migrate to mise for tool management and CI updates by @unclesp1d3r in #172
  • fix: remove stubbed audit mode code and defer implementation to v2.1 by @unclesp1d3r in #175
  • chore(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #180
  • feat(compliance): add extended checks for password policy and audit logging by @unclesp1d3r in #181
  • feat(display): improve NAT rule directionality presentation in markdown reports by @unclesp1d3r in #182
  • chore:...
Read more

Contributors

unclesp1d3r, dependabot, and fossabot
Loading

v1.0.0

v1.0.0

Choose a tag to compare

View all tags
@unclesp1d3r unclesp1d3r released this 04 Aug 06:00
Immutable release. Only release title and notes can be modified.
v1.0.0
3d1ca29

Release v1.0.0

This release includes the following changes:

Full Changelog: v1.0.0-rc1...v1.0.0

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.0.0/opndossier_1.0.0_linux_amd64.deb
sudo dpkg -i opndossier_1.0.0_linux_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.0.0/opndossier_1.0.0_linux_amd64.rpm
sudo rpm -i opndossier_1.0.0_linux_amd64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.0.0/opndossier_1.0.0_linux_amd64.apk
sudo apk add --allow-untrusted opndossier_1.0.0_linux_amd64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.0.0/opndossier_1.0.0_linux_amd64.pkg.tar.xz
sudo pacman -U opndossier_1.0.0_linux_amd64.pkg.tar.xz

Download Binary

Download the appropriate binary for your platform from the assets below.

Docker

docker pull ghcr.io/evilbit-labs/opndossier:v1.0.0

Verify Checksums

sha256sum -c opnDossier_checksums.txt

What's Changed

  • fix(display): remove validation from display command by default by @unclesp1d3r in #37
  • chore(workflow): remove summary workflow for issue summarization by @unclesp1d3r in #39
  • feat: migrate codebase from opnFocus to opnDossier under EvilBit Labs organization by @unclesp1d3r in #43
  • chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 by @dependabot[bot] in #41
  • 34 feature improve system tunables table display or remove entirely by @unclesp1d3r in #44
  • fix: implement embedded template functionality and testing by @unclesp1d3r in #45
  • refactor: remove JSON and YAML template files and update related func… by @unclesp1d3r in #46
  • fix(validate): display all validation errors instead of just the first one by @unclesp1d3r in #49
  • feat: resolve issue #33 - add missing Target and SourcePort fields to firewall rules by @unclesp1d3r in #52
  • feat: add utility functions for boolean evaluation and formatting by @unclesp1d3r in #53
  • fix: enhancement simplify and standardize template flags and naming conventions by @unclesp1d3r in #54

Full Changelog: v1.0.0-rc1...v1.0.0

Contributors

unclesp1d3r and dependabot
Loading

v1.0.0-rc1

v1.0.0-rc1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@unclesp1d3r unclesp1d3r released this 01 Aug 07:27
v1.0.0-rc1
1ee4eb7

Changelog

Features

Read more
Loading