What's New - VersionGopher™

What's New in 0.7.5

Cleaner evidence, broader targets, less guesswork

This release is about making each scan more useful after the first import. Analysts get richer file evidence, operators get more collector choices, and the hosted preview has a stronger foundation for real beta users. Recent PG18 work also made large normal imports faster while keeping encrypted-evidence mode honest about its remaining batch-write work.

Binary detail views now explain more about PE, Mach-O, ELF, and Linux kernel-module files instead of only naming versions.
Release collectors are staged, verified, and synchronized across Windows, macOS, Linux, OpenWrt/Entware ARMv7, MIPS, and PowerPC targets; the Windows collector is Authenticode-signed by AstroSec LLC.
The temporary Miasma response landing page remains active so responders can request emergency access, download offline collectors, and triage developer machines, CI runners, build caches, recovered filesystems, and package artifacts. Incident-response guidance now calls out -m metadata probes for Miasma scans.
Windows PE records can surface Authenticode presence, signer certificate metadata, signing time, signed-content integrity evidence, certificate-table details, and CRL/OCSP/AIA/timestamp URLs without claiming offline trust-chain proof.
New PE imports reduce duplicate version-row noise caused by equivalent Windows build-label variants without hiding CVE evidence from historical pre-0.7.5 scans.
Suspicious signatures are easier to triage: the UI separates valid evidence, present-but-invalid or malformed evidence, and missing/blank evidence, with endpoint URLs available for analyst review when the collector captured them.
Mach-O records can surface LC_CODE_SIGNATURE evidence, CodeDirectory identifiers and hashes where available, and entitlements/notarization clues as evidence-only unless platform verification is present.
Linux ELF handling stays honest: ordinary ELF files keep build-id and hardening metadata, while signed kernel modules can expose module signer, key id, signature type, and hash algorithm evidence.
ELF versioning is more careful about far-away strings, dependency minimums, and parser-hostile binaries, reducing false versions without making the collector heavy.
Hostile ELF/DWARF and binutils/objdump fuzzing specimens are now part of the regression story so malformed binaries produce bounded evidence instead of crashes or hangs.
Archive and firmware-like containers are visible in search results without making the collector unpack them.
Package lockfiles, manifests, installed metadata, and repository configs are visible as lightweight supply-chain evidence with bounded identity peeks for exact npm/PyPI package/version records.
The Package Risk dashboard lane can check exact npm/PyPI identities against OSV advisories while keeping OSV separate from the NVD/CVE matching lane.
Package Advisories and Malicious Packages filters separate ordinary OSV vulnerable-package advisories from OSV MAL-* supply-chain attack advisories.
No-key package-advisory sources are documented and operationalized so OSV/npm/PyPI package-risk feeds can be refreshed or repaired without binding VersionGopher to fragile API-keyed dependencies.
AI assistant instruction files such as .cursorrules and CLAUDE.md are visible as metadata-only prompt-risk evidence, including hidden Unicode and high-risk instruction markers without storing prompt bodies.
Private-key material and crypto-wallet artifacts are visible as metadata-only sensitive exposure evidence; key, wallet, and seed contents are not stored in the scan output or dashboard.
Microsoft Cabinet-family files, including .cab, .diagcab, and .msu, are treated as archive follow-up evidence.
Hash capture and hash search help correlate VersionGopher scans with external incident and malware tooling.
Collector output is centered on JSONL for large scans: stream with -J on POSIX shells or use -o PREFIX -j on Windows so the collector writes UTF-8 JSONL directly.
Assessment Reports package a scan's CVE exposure, package advisory exposure, private-key, wallet, and AI prompt findings, archive evidence, Software Genomics context, and provenance into a printable buyer-ready review.
Organization owners and admins can upload assessment-report branding so buyer-facing reports show the customer logo with VersionGopher attribution.
Scoped CVE lookup can answer exact CVE questions across all visible scans or a selected scan, with readiness state and result rows instead of passive counts. The public blog now includes a field note on historical CVEs found during pre-beta dogfooding.
The public blog route is live for pre-auth education and links from the landing page.
Software Genomics help now separates repeatable fleet drift from generic scan similarity, forensic images, M&A evidence bundles, and random uploads.
Dashboard cards for Files With CVEs and Binary Signals now drill directly into scoped result rows instead of acting as passive counters.
Metadata Probe groundwork preserves bounded classified string evidence and archive clues without changing default scan scope.
Hash-cost controls keep default scans focused on emitted rows, with explicit overrides for large evidence files.
Large hosted PG18 imports now use measured batch-write paths for normal scan rows, reducing wall time, P95 latency, and PostgreSQL call volume on the active large-scan benchmark corpus.
Encrypted artifact dual-write remains a safety-first path: it preserves protected evidence semantics today and will get its own measured batch design before VersionGopher promises the full import-speed gain in encrypted customer-scan mode.
CVE matching now uses centralized guardrails to reduce common filename, vendor, platform, weak-version, and component-scope collisions.
Component-scoped CVE matching is more careful when advisories name a specific source path, parser, demuxer, decoder, format, or function, so sibling files under the same product are less likely to inherit unrelated vulnerabilities.
Managed Runtime Integrity groups .NET/GAC/Framework/WinSxS CVE evidence at the serviced parent level while still elevating unexpected identity in those high-trust runtime paths.
ELF version extraction is more skeptical of dependency minimums such as OpenSSL >= 1.0.2 when a better product-local version signal exists.
Hosted preview accounts now support organization and group scoping, MFA, Google sign-in, and admin workflows.
Security hardening closes CodeQL-reported path, URL, string-rendering, logging, and regex-risk findings in the web/admin/import surface.
Collector build and deployment paths are documented for Windows, macOS, Linux, ARM, OpenWrt/Entware ARMv7, MIPS, and PowerPC targets.
The dashboard now alerts signed-in users when current collectors are available and surfaces the security feed dashboard at the top of the authenticated workflow.
Security feeds now prioritize operator-relevant exploitation and vendor reporting, including BleepingComputer and The Hacker News coverage, while CISA remains a useful but lower-priority source.

Release at a Glance

A bigger preview build

0.7.5 touches the collectors, importer, database, web dashboard, matching engine, hosted identity model, and deployment workflow. These are the changes analysts and operators will feel first.

Enhanced scan schema Importer support for richer collector records, including signature/provenance fields, while preserving compatibility with older JSONL scans.

Signature-aware binary evidence PE Authenticode, Mach-O code-signature, ELF hardening, kernel-module signature clues, certificate URLs, hashes, and provenance flow into detail views.

Signed release collectors Production downloads are synchronized to 0.7.5, with the Windows collector signed by AstroSec LLC and every published artifact covered by checksums.

Archive detection ZIP, TAR, RAR, 7-Zip, LHA, CAB/MSU, package, and firmware-style containers are recorded for analyst follow-up without unpacking them on constrained systems.

Hash search Find files by SHA-256 across visible scans, with collector-side hash capture and an opt-out for tiny targets.

Measured import path Normal PG18 imports now batch large scan-row writes, with benchmarked gains and row-count parity checks instead of guesswork.

Embedded collectors Windows, macOS, Linux x64, ARM64, ARM32, OpenWrt/Entware ARMv7, MIPS, and PowerPC builds are represented in production downloads.

Scoped beta access Organizations, groups, users, MFA, Google sign-in, and role-aware scan visibility are now part of the hosted flow.

Software Genomics guidance Groups can now be explained as fleet-drift boundaries when scans are repeatable, while random uploads remain scan similarity.

Actionable dashboard cards Files With CVEs and Binary Signals counters open filtered result rows for immediate analyst review.

CVE matching guardrails Centralized expert rules reduce noisy filename-only matches, platform/vendor mismatches, and component-scoped advisories that do not apply to sibling binaries.

Production polish Collector update alerts, top-level security feeds, deploy checks, materialized matching progress, and local preview workflows were tightened.

Examples

Four workflows 0.7.5 makes easier

The goal is not just to find more rows. It is to shorten the path from a raw filesystem scan to a defensible analyst decision.

01

Review a suspicious executable

Open the file card and inspect Authenticode or code-signature evidence, publisher strings, original filename, architecture, PE Rich Header clues, ELF runtime traits, hashes, and scan provenance before deciding whether the CVE match is credible.

Open dashboard

02

Check a hash from another tool

Paste a SHA-256 from an EDR alert, malware note, supplier advisory, or case record and see whether that exact artifact appears in any scan you are allowed to view.

Search hashes

03

Find archives worth unpacking

Filter for archives, firmware images, install bundles, and compressed containers, then unpack them in a controlled workspace and rescan the extracted directory.

out="versiongopher-${HOSTNAME}-rescan-extracted-20260606-154233.jsonl"; version_gopher -d extracted-dir -m -J > "$out"

04

Organize drift-ready fleet groups

Create narrow Groups for workstations, servers, kiosks, or golden images that are scanned on the same cadence with the same options. Use Software Genomics relatedness for everything else.

Read group guidance

Analyst Signals

More evidence on every executable

The detail view now carries more of the context analysts usually have to chase by hand: provenance, hashes, compiler/toolchain clues, publisher hints, and binary hardening data.

PE Forensics

Rich Header and identity clues

PE scans can surface original filename, internal name, product strings, publisher metadata, file size, architecture, checksum status, and likely Microsoft toolchain families.

ELF Forensics

Hardening and runtime evidence

ELF detail cards are prepared for interpreter paths, build IDs, needed libraries, architecture notes, and hardening indicators from the enhanced collector schema.

Hash Search

Find known artifacts fast

Paste a SHA-256 from another tool, provider, or incident note and quickly check whether the file or collector binary appears in your imported scans.

Schema V3

Richer records without bloating the collector

Collectors can emit structured evidence for binaries, archives, provenance, and identity while the importer normalizes older records into the current model.

Suspicion Cues

More than patch lists

The dashboard is being prepared to call attention to strange binary traits, weak evidence, and forensic context alongside vulnerability priority.

Baseball Cards

Better executable detail views

Analysts can drill into identity, build fingerprints, scan provenance, CVE rationale, nearby files, archive follow-up, and same-directory context from one place.

Typical Use Cases

Where this release should feel immediately useful

Embedded and hardware labs Inventory routers, appliances, lab images, FPGA-adjacent payload files, and update media without installing a resident agent.

Mission and satellite operators Carry provenance and version evidence from disconnected systems back to a ground-side review workflow.

Incident response Correlate hashes, suspicious paths, archive containers, and binary build fingerprints across scans and cases.

MSP and MSSP pilots Keep customer or group scan data scoped while testing CVE triage, exports, ownership, and review workflows.

IT and small-business fleets Use Groups to separate comparable machines, then read repeatable scans as drift and unrelated uploads as software similarity.

Software supply-chain review Use local collectors to produce compact evidence for offline packages, mounted images, dependency bundles, and legacy software.

False-positive research Inspect the matching rationale and binary context that explain why a CVE did or did not survive VersionGopher's guardrails.

Collector Coverage

More places to scan

The 0.7.5 preview keeps emphasizing small, portable collectors for field systems, lab appliances, embedded Linux, and disconnected environments where network agents are not realistic.

Windows and macOS Desktop, lab, and operator workstation scans with PE, Mach-O, plist, script, hash, and archive records.

Linux x64, ARM64, and ARM32 Server and embedded Linux collectors for normal host inventories and offline appliance review.

OpenWrt / Entware ARMv7 Router-class and storage-frontline ARMv7 Linux appliances can use the Entware/OpenWrt collector when the ABI matches.

MIPS and embedded network targets Router, payload-support, and hardware lab scanning for MIPS 24Kc little-endian Linux systems.

PowerPC infrastructure targets Telecom-class controllers, storage-frontline appliances, and mission labs can use the Linux PPC32 big-endian collector for offline JSONL inventory.

Less Noise

CVE matching gets more skeptical

VersionGopher still favors broad detection, but the matching layer now has stronger guardrails against common filename collisions and weak version evidence.

Expert Rules

False-positive controls in one place

Windows component-store files, generic product names, toolchain helper binaries, and weak filename-only matches are handled through centralized matching policy instead of scattered patches.

Version Evidence

Dependency strings get less trust

ELF scanning now avoids turning local dependency requirement text into product versions when stronger product-local strings are present.

Materialized Matching

Progress while work runs

Large scans can take time to match. The dashboard now reports matching state more clearly and uses materialized results so CVE filters stay responsive after refresh.

Component Scope

Named components matter

When an advisory names a specific source file, parser, demuxer, decoder, format, or function, sibling files under the same product need matching component evidence before they inherit that CVE.

User Trust

Rationale is visible

When VersionGopher reports a CVE, the analyst can inspect the product, vendor, version rule, CPE, component, and evidence that drove the match.

Operational Safety

Less duplicated work

The matcher avoids duplicate enqueue behavior and gives the UI clearer status while long-running materialization jobs complete.

Containers

Archive files are visible, not unpacked

ZIP, TAR, RAR, 7z, LHA/LZH, CAB/MSU, ISO, DMG, firmware images, and several embedded container formats can now show up as first-class scan results. The collector records the container and gives follow-up guidance without expanding archives on constrained targets.

Why this matters: archives often hide installers, firmware drops, old dependency bundles, and field update packages. VersionGopher points analysts to the containers worth unpacking and rescanning.

Hosted Preview

Identity is becoming product-shaped

The beta service now supports local accounts, MFA enrollment, approved Google sign-in, organization and group ownership, scoped scan visibility, and admin workflows that fit small pilot teams.

Coming next Trust enrichment, software-genome graph views, local package-advisory databases, enterprise evidence controls, and more operator workflow polish.

Operator Quality

The beta is easier to run and review

A lot of 0.7.5 work is not glamorous, but it matters: fewer manual deployment traps, better docs, clearer collector help, and a cleaner split between production, local testing, and embedded build environments.

Admin Workflows

Owners can manage access

Platform and group owners have a clearer path to manage users, groups, roles, MFA resets, and scan visibility inside the preview service.

Performance Discipline

Benchmarks before claims

Importer changes now use restored-snapshot A/B runs, PostgreSQL statement counters, WAL/FPI context, row-count checks, and post-import readiness checks before VersionGopher calls a change faster.

Protected Evidence

Speed does not bypass protection

The normal import path is faster today. Encrypted artifact mode remains deliberately conservative until the protected write path has its own batch-aware design and evidence checks.

VersionGopher™ 0.7.5: software evidence becomes actionable