From bdf6f4ce625d235424dd9f5d129a73c8746fc75f Mon Sep 17 00:00:00 2001 From: Khalid Saifullah Khan Date: Sun, 18 Oct 2026 04:13:14 +0530 Subject: [PATCH] chore(release): 0.3.0 Unreleased becomes 0.3.0: the remote TLS CBOM audit (AUDIT-TLS-CBOM-001). Every component says how it was learned, the document states what the scan covered, no identifier the scan read is dropped, and certificates carry their PSS parameters, every extension and the served chain. The Quadlet unit and the install and distribution docs name the 0.3.0 image. --- CHANGELOG.md | 5 ++++- deploy/cipherhorizon.container | 2 +- docs/engineering/DISTRIBUTION.md | 6 +++--- docs/engineering/INSTALL.md | 2 +- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d1e079b..bba7a4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas ## [Unreleased] +## [0.3.0] - 2026-10-17 + ### Changed - **The remote TLS CBOM says how it knows each fact, and keeps every identifier it read** @@ -749,7 +751,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas - **Storage:** SQLite only. Up to 50 snapshots of up to 32 MiB are kept per machine; there is no overall storage budget yet. -[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...HEAD +[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.3.0...HEAD +[0.3.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...v0.3.0 [0.2.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.1...v0.2.0 [0.1.1]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/offsetsecurity/cipherhorizon/releases/tag/v0.1.0 diff --git a/deploy/cipherhorizon.container b/deploy/cipherhorizon.container index 6bfa62f..8736285 100644 --- a/deploy/cipherhorizon.container +++ b/deploy/cipherhorizon.container @@ -23,7 +23,7 @@ After=network-online.target [Container] ContainerName=cipherhorizon -Image=ghcr.io/offsetsecurity/cipherhorizon:0.2.0 +Image=ghcr.io/offsetsecurity/cipherhorizon:0.3.0 PublishPort=127.0.0.1:8080:8080 Volume=cipherhorizon-data:/data # Another port: set it here and in PublishPort (the health check follows it), e.g. diff --git a/docs/engineering/DISTRIBUTION.md b/docs/engineering/DISTRIBUTION.md index 8e72703..79aa806 100644 --- a/docs/engineering/DISTRIBUTION.md +++ b/docs/engineering/DISTRIBUTION.md @@ -92,7 +92,7 @@ tar -xzf cipherhorizon_0.1.0_linux_amd64.tar.gz docker run -d --name cipherhorizon -p 8080:8080 \ -e CIPHERHORIZON_TOKEN="$(openssl rand -hex 24)" \ -v cipherhorizon-data:/data \ - ghcr.io/offsetsecurity/cipherhorizon:0.2.0 + ghcr.io/offsetsecurity/cipherhorizon:0.3.0 # container, built locally (docker-compose.yml at the repository root) echo "CIPHERHORIZON_TOKEN=$(openssl rand -hex 24)" > .env @@ -136,10 +136,10 @@ gh attestation verify cipherhorizon_0.1.0_linux_amd64.tar.gz --repo offsetsecuri **Container image:** ```sh -cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.2.0 \ +cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.3.0 \ --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com -gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.2.0 --repo offsetsecurity/cipherhorizon +gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.3.0 --repo offsetsecurity/cipherhorizon ``` Air-gapped users: the archives are self-contained, so download on a connected machine, verify there, and move diff --git a/docs/engineering/INSTALL.md b/docs/engineering/INSTALL.md index ae47777..258cb40 100644 --- a/docs/engineering/INSTALL.md +++ b/docs/engineering/INSTALL.md @@ -120,7 +120,7 @@ header lists the commands). The log goes to `~/Library/Logs/CipherHorizon/cipher ```sh docker run -d --name cipherhorizon --restart unless-stopped \ -p 127.0.0.1:8080:8080 -v cipherhorizon-data:/data \ - ghcr.io/offsetsecurity/cipherhorizon:0.2.0 + ghcr.io/offsetsecurity/cipherhorizon:0.3.0 ``` Or, from a checkout, `docker compose up -d` ([docker-compose.yml](../../docker-compose.yml): read-only