Release Notes - Version 2.0.6

Venafi VaaS PKI certificate events now emit x509.signature_algorithm from the existing normalized certificate signature value at full, standard, and minimal detail levels. The value is emitted when the source provides a signature algorithm; it is not inferred from the public key. Other PKI sources retain their existing output.

CertCentral certificate downloads can fall back from the certificate-ID endpoint to the order-ID PEM endpoint after HTTP 400 or 404. If both PEM endpoints return HTTP 400 or 404, the scanner tries the certificate-ID chain endpoint and requires exactly one end-entity certificate; CA certificates are not used as the leaf. Downloaded certificates must match existing serials and fingerprints; for order-ID downloads when those are unavailable, a unique serial-number lookup must verify the original order and certificate IDs. Verified certificate bytes supply SHA-256 fingerprints and certificate assessments. Unavailable or unverifiable downloads retain order metadata and mark discovery partial when a SHA-256 fingerprint is missing.

TQR-1586: DigiCert CertCentral orders with unknown key assessments now report Not assessed for the vulnerable and post-quantum algorithm fields in JSON and FlatNDJSON, replacing None known at this time. Supported assessments keep their existing results, including when a fingerprint is unavailable. CSV output is unchanged. This wording change does not resolve unavailable certificate fingerprints.

Rejected, canceled, pending, processing, needs-approval, and waiting-pickup orders are excluded from certificate inventory when they have no verified leaf certificate, serial number, or valid source fingerprint. Certificate identity evidence preserves inventory even when the order status disagrees. Issued, expired, revoked, reissue-pending, unknown, and missing-status orders retain their existing inventory behavior; download failures alone do not exclude them.

Windows ADCS discovery can authenticate using the current process identity through SSPI over verified LDAPS or StartTLS, with TLS channel binding and mutual authentication. This path requires a DC DNS hostname and a protected local scanner installation; it rejects plain LDAP and -insecure, and does not fall back to anonymous authentication after a failed Kerberos bind. Empty authenticated discovery reports failed scan health with a no-certificates message. Search or certificate parsing failures report failed or partial discovery while retaining valid certificates.

The application-centric JSON report always includes app_report.orphan_findings at every detail level. A missing findings pointer emits null, an empty findings object emits {}, and populated findings retain their existing contents.

Flat event builders now carry event.kind = "event" into every record, including later summary records. Quick cipher-scan records also emit event.action = "port_scan_result". These fields remain present across output detail levels and tracking runs that produce large numbers of records.

macOS memory scan records now include stable asset IDs based on the host, process binary, and library identity. Distinct process/library assets no longer collapse into one Elasticsearch document because their IDs are missing. IDs remain stable when process IDs change.

An unsupported -cputhrottle value now produces a warning naming the invalid value and the applied medium fallback. The scan continues with the existing fallback limits. See the CPU Throttling Guide.

Windows ADCS configurations with TLSMode=none and no configured credentials now select anonymous LDAP directly instead of Kerberos. When the directory denies anonymous PKI reads, the scanner reports the LDAP search denial instead of a misleading Kerberos TLS error and completes the scan without crashing. When anonymous reads are allowed, CA certificate discovery proceeds. See the ADCS authentication guide.

Filesystem scans now limit cached discovery entries and process certificate and config candidates incrementally, reducing memory growth on systems with large numbers of files. The Linux in-memory certificate scan also honors CPU throttle delays. The throttle level sets a Go runtime soft memory limit: low uses 512 MiB, medium uses 1 GiB, and high uses 2 GiB; none applies no limit. These are soft limits, not caps on total process memory. Set GOMEMLIMIT to override them. See the CPU Throttling Guide.

Native memory_scan events now include tychon.library.path when the detected path is nonempty, allowing libraries with the same display name to be distinguished. The field is included at Full, Standard, and Minimal detail levels. See the FlatNDJSON format guide.

Fixed missing asset IDs in memory scan records when using Minimal FlatNDJSON output.

Fixed intermittent omissions of discovered keystore summaries, including PKCS#12 and JKS files. Filesystem scans now finish collecting all keystore summaries before reporting completion.

Application and PQC inventory events now use the configured Splunk sourcetype (default tychon:crypto:json) instead of tychon:application or tychon:pqc_inventory. The event.dataset field continues to identify each event category.