v1.4.5 release notes

Release Date: 2025-12-14 Type: Feature Release (Supply Chain Security & Documentation Reorganization)

Overview

Version 1.4.5 significantly enhances supply chain security through Docker Scout attestations and modernizes the project’s documentation structure. This release improves container image transparency, enables SLSA compliance, and provides better documentation navigation for contributors and users.

Docker Scout Supply Chain Attestations

What’s New

Enhanced container image security and transparency through automated attestation generation in the GitHub Actions release workflow.

Workflow Updates (.github/workflows/mcp-release.yml):

Upgraded docker/build-push-action from v5 to v6
Added provenance: mode=max for maximum build provenance detail
Added sbom: true for automatic SBOM generation

Build Provenance Attestation

SLSA Level 2+ Compliance:

Records complete build process metadata (builder, materials, recipe)
Enables verification of artifact authenticity
Provides cryptographic proof of build integrity
Supports supply chain security standards (SLSA, SSDF)

What’s Recorded:

Builder information (GitHub Actions runner)
Source materials (Git commit SHA, repository)
Build recipe (Dockerfile, build arguments)
Build environment (timestamps, dependencies)

Verification:

# Inspect provenance attestation
docker buildx imagetools inspect ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 --format "{{json .Provenance}}"

# Verify with cosign (if configured)
cosign verify-attestation --type slsaprovenance \
  ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5

SBOM Attestation

CycloneDX Format SBOM:

Complete dependency tree with version information
Enables vulnerability tracking and compliance auditing
Automatically generated and attached to container images
Supports security scanning tools (Trivy, Grype, Snyk)

What’s Included:

All npm dependencies (production and dev)
Operating system packages (Alpine Linux)
Version numbers and licenses
Package URLs (purl) for dependency tracking

Access SBOM:

# Extract SBOM from image
docker buildx imagetools inspect ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 --format "{{json .SBOM}}"

# Scan with SBOM-aware tools
trivy image --sbom ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5
grype sbom:ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5

Docker Scout Health Score Improvement

Previous: ‘C’ rating due to missing attestations Expected: ‘B’ or ‘A’ rating with full attestations

Why This Matters:

Demonstrates commitment to supply chain security
Meets enterprise security requirements
Enables automated compliance checks
Improves visibility into container dependencies

Documentation Reorganization

New Directory Structure

Reorganized 39 documentation files using git mv (history preserved) into logical subdirectories:

docs/
├── architecture/              # Technical design (3 files)
│   ├── architecture.md
│   ├── technical_implementation.md
│   └── performance-tuning.md
│
├── guides/                    # User-facing guides (2 files)
│   ├── commands.md
│   └── user_guide.md
│
├── internal/                  # Internal working documents (4 files)
│   ├── project_summary.md
│   ├── TODO.md
│   ├── TASKS.md
│   └── PROJECT-STATUS.md
│
├── planning/
│   ├── phases/                # Development phase breakdowns (7 files)
│   │   ├── overview.md
│   │   ├── phase-1-core-infrastructure.md
│   │   ├── phase-2-security-hardening.md
│   │   ├── phase-3-performance-optimization.md
│   │   ├── phase-4-advanced-features.md
│   │   ├── phase-5-enterprise-features.md
│   │   └── phase-6-multi-modal-support.md
│   │
│   ├── strategies/            # Strategic planning documents (5 files)
│   │   ├── UPSTREAM-SYNC-STRATEGY.md
│   │   ├── SECURITY-HARDENING-PLAN.md
│   │   ├── MULTI-MODAL-STRATEGY.md
│   │   ├── PLUGIN-ARCHITECTURE-DESIGN.md
│   │   └── ENTERPRISE-FEATURES-PLAN.md
│   │
│   ├── future-releases/       # Release specifications (23 files)
│   │   ├── release-v1.5.0.md through release-v3.0.0.md
│   │   └── ... (detailed release plans for v1.5.0 - v3.0.0)
│   │
│   ├── roadmap.md            # Master roadmap with Gantt timeline
│   └── tasks.md              # Implementation task tracker
│
├── releases/                  # Release notes (11 files)
│   ├── v1.0.0.md through v1.4.5.md
│   └── ... (comprehensive release history)
│
└── security/                  # Security documentation (3 files)
    ├── audit.md
    ├── SECURITY_MAINTENANCE.md
    └── vulnerability-reports/

Root-level markdown files reduced: 12 → 8

Benefits of Reorganization

For Contributors:

Clear separation between user-facing and internal documentation
Easier to find relevant planning and architectural documents
Better understanding of project structure and roadmap

For Users:

Simplified navigation to guides and commands
Clear distinction between technical docs and user docs
Easier to find release notes and security information

For Maintainers:

Organized planning materials in logical hierarchy
Easier to track development phases and strategies
Better organization of future release specifications

Updated Documentation References

Files Updated:

README.md - Documentation section reorganized with new paths
CLAUDE.md - Updated all documentation path references
Cross-references in all documentation files verified

New README Sections:

User Guides → docs/guides/
Technical Documentation → docs/architecture/
Project Management → docs/planning/
Strategic Planning → docs/planning/strategies/
Supply Chain Security → New section documenting attestations

Additional Improvements

README.md Enhancements

Supply Chain Security Section:

Documentation of provenance attestations
SBOM generation and access instructions
Verification commands and examples
SLSA compliance information

Documentation Section:

Reorganized to reflect new directory structure
Categorized by user role (users, developers, contributors)
Added links to all major documentation areas

CLAUDE.md Updates

Project Guidance Updates:

Updated all documentation path references
Added supply chain security section
Enhanced development workflow documentation
Updated verification steps with attestation checks

Testing & Validation

# All tests passing
npm test
✓ 1,933 unit tests (1,716 operation + 217 Node API)

# Documentation link verification
grep -r "docs/" README.md CLAUDE.md docs/
✓ All links point to correct new locations
✓ No broken internal references

# Git history verification
git log --follow docs/architecture/architecture.md
✓ Full history preserved through git mv

# Build verification
docker build -f Dockerfile.mcp -t cyberchef-mcp .
✓ Webpack 5.103.0 compiled successfully
✓ All 5 worker compilations succeeded
✓ Image size: ~285MB

# Attestation verification
docker buildx imagetools inspect ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5
✓ Provenance attestation present
✓ SBOM attestation present

# MCP server operational
npm run mcp
✓ All 465 tools functional

Upgrade Instructions

No breaking changes. Update via:

# Pull latest from GitHub Container Registry
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

# Or rebuild from source
git pull origin master
git checkout v1.4.5
npm install
docker build -f Dockerfile.mcp -t cyberchef-mcp .

Verification Steps

1. Verify Version:

echo '{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}' | \
  docker run -i --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 | \
  jq -r '.result.tools[0].name'
# Should include v1.4.5 in startup logs

2. Verify Attestations:

# Check provenance
docker buildx imagetools inspect ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 \
  --format "{{json .Provenance}}" | jq .

# Check SBOM
docker buildx imagetools inspect ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 \
  --format "{{json .SBOM}}" | jq .

3. Verify Documentation:

# Clone repository
git clone https://github.com/doublegate/CyberChef-MCP.git
cd CyberChef-MCP

# Verify directory structure
ls -R docs/
# Should match new structure with subdirectories

Files Changed

Version Updates:

package.json - mcpVersion 1.4.4 → 1.4.5
src/node/mcp-server.mjs - VERSION 1.4.4 → 1.4.5

GitHub Actions:

.github/workflows/mcp-release.yml - Upgraded to docker/build-push-action@v6, added attestations

Documentation (39 files moved with git mv):

Created docs/architecture/ (3 files)
Created docs/guides/ (2 files)
Created docs/internal/ (4 files)
Created docs/planning/phases/ (7 files)
Created docs/planning/strategies/ (5 files)
Created docs/planning/future-releases/ (23 files)
Created docs/releases/ (11 files)
Created docs/security/ (3 files)

Updated References:

README.md - Documentation section reorganization, added Supply Chain Security
CLAUDE.md - All documentation path references updated
CHANGELOG.md - v1.4.5 section added

Docker Image

Registry: ghcr.io/doublegate/cyberchef-mcp_v1 Tags: v1.4.5, latest Size: ~285MB compressed

New Metadata:

Provenance attestation (SLSA format)
SBOM attestation (CycloneDX format)
Enhanced Docker Scout health score

# Pull by version tag
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5

# Pull latest
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

# Offline install (tarball available in GitHub Releases)
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.4.5/cyberchef-mcp-v1.4.5-docker-image.tar.gz
docker load < cyberchef-mcp-v1.4.5-docker-image.tar.gz

Security Benefits

Supply Chain Transparency:

Verifiable build integrity through provenance attestations
Complete dependency visibility through SBOM
Cryptographic proof of artifact authenticity
Support for compliance frameworks (SLSA, SSDF, NIST SSDF)

Vulnerability Management:

SBOM enables automated vulnerability scanning
Dependency tracking for security updates
License compliance verification
Software composition analysis support

Enterprise Readiness:

Meets supply chain security requirements
Supports zero-trust deployment models
Enables policy-based access controls
Facilitates security audits and compliance

Compliance & Standards

SLSA (Supply-chain Levels for Software Artifacts):

Level 2+ compliance through provenance attestation
Verifiable build process
Non-falsifiable build metadata

NIST SSDF (Secure Software Development Framework):

PO.3: Produce well-secured software releases
PS.3: Verify third-party software components
RV.1: Identify and confirm vulnerabilities

CycloneDX SBOM:

Complete component inventory
License information
Vulnerability correlation
Dependency graph representation

Migration Notes

For Existing Users

No action required - version update is transparent. Docker images remain backward compatible.

For Documentation Contributors

Update any documentation links to reflect new structure:

Old Paths:

RELEASE_NOTES.md → docs/releases/v1.0.0.md
SECURITY_AUDIT.md → docs/security/audit.md
to-dos/roadmap.md → docs/planning/roadmap.md
to-dos/tasks.md → docs/planning/tasks.md

New Paths:

All release notes in docs/releases/
All planning in docs/planning/
All architecture docs in docs/architecture/
All user guides in docs/guides/

For CI/CD Integrations

If using attestation verification:

# Example GitHub Actions integration
- name: Verify attestations
  run: |
    docker buildx imagetools inspect \
      ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.5 \
      --format "{{json .Provenance}}" | jq .

Known Limitations

Attestation Support:

Requires Docker Buildx v0.11+ for attestation inspection
Some older container registries may not support attestations
Verification requires additional tooling (cosign, oras)

Documentation:

Some external links may reference old paths (will update incrementally)
Search results may cache old documentation URLs

Future Enhancements

v1.4.6+ Planned Improvements:

Sigstore cosign signatures for additional verification
Enhanced SBOM with vulnerability ratings
Automated attestation verification in CI/CD
Documentation search index update

Contributors

@doublegate - Supply chain attestations and documentation reorganization

Previous Releases

Acknowledgments

Special thanks to:

Docker Scout team for attestation framework
SLSA community for supply chain security standards
CycloneDX community for SBOM specifications
GitHub Actions team for attestation support in workflows