Repository navigation
Publish a detector catalog with each release - #4
Merged
Merged
Conversation
`earlylight detectors --format json` prints every detector's ID, title, CVEs, advisories, disclosure date, the commands that run it (fs, image, host, repo, fix) and its finding kinds, all taken from the manifests. The release workflow writes it to detectors.json before the checksums are taken, so the signed checksums.txt covers it, and fails if its version does not match the tag. Plain `earlylight detectors` is unchanged. A contract test checks every real detector's entry: ID, a real disclosure date, https advisories, at least one command and unique finding kinds. eMudhra's unpatched-go findings now carry CVE-2026-111943, so tools that file findings under CVEs can group them. Trust findings are about the CA keys and still carry no CVE. The engine comment now lists the note level brotli already uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
earlylight detectors --format jsonprints the detector catalog: schema, tool, version, and for each detector its ID, title, CVEs, advisories, disclosure date, the commands that run it (fs,image,host,repo,fix) and its finding kinds. Everything comes from the manifests. Plainearlylight detectorsprints the same list as before.dist/detectors.jsonfrom the linux/amd64 binary before the checksums are taken, so the signedchecksums.txtcovers it. The step fails if the file's version doesn't match the tag.install.shand the Homebrew formula script look up files by name, so the extra asset doesn't affect them.unpatched-gofindings now carry CVE-2026-111943, so tools that file findings under CVEs can group them. Trust findings are about the CA keys and still carry no CVE.detectors/all/all_test.gois a contract test over every real detector's entry. It caught brotli'snotelevel, which the engine comment now lists.Why
Tools that track Early Light releases, including DefectDojo, need to know which detectors a release contains and how to run each one, without downloading and running a binary.
Checks
go vet ./...andgo test -race ./...pass.govulncheck ./...finds no vulnerable code that is called.-X main.version=v0.4.0-rc). It produced a 9 KB catalog listing all three detectors with the tag as its version.🤖 Generated with Claude Code