Excubitor 0.2.10. The package is open source and needs no key to review code on your own machine. The image, the charts and the offline bundle are signed with one release key, published here, so you can check each one before it runs.
Apache-2.0, on PyPI. Python 3.10 or newer. Without a key nothing leaves your machine; with a workspace's two values, findings go to your console.
To report to a console, set EXCUBITOR_CONSOLE_URL and EXCUBITOR_TOKEN, which a workspace issues
under Settings, Applications.
The private half never leaves Cloud KMS. Compare the fingerprint below with the one Aurakore gave you out of band, then check what you are about to run.
The release key's public half. Checks the image, the charts and the offline bundle.
Fingerprint, SHA-256 of the key's DER encoding:
9990de52397eb74f5eb1193c705e1152a3d1bb8e2838f2782673d0985707b003
The signed image for amd64 and arm64, both charts, the package with every wheel it needs, and an installer, in one file whose signed checksums check with openssl alone on the far side of the gap.
About 160 MB.
Its checksum, to compare after the transfer.
The image's software bill of materials.
Bundles start with Excubitor 0.2.8. For an earlier release, ask your Aurakore contact.
Each one is served from the same source the release was tested with. Read it before you apply it: the red team and network policy files act on your agents.
Code review on every pull request, in GitHub Actions. Fails on HIGH or worse.
The same code review gate for GitLab CI.
The weekly red team against a staging agent, from GitHub Actions.
The weekly red team as a Kubernetes CronJob, for an agent only reachable in-cluster.
The network policy controller, with RBAC limited to network policies in one namespace.
An attack that works without Excubitor and is stopped with it.
What changed in each release, the same text the release notes carry.
What changed in each release.
No standing vendor access, ever. Managed with evidence, never on faith.