Prepare PortCVE for verified signed releases

.github/workflows/ci.yml

@@ -14,43 +14,51 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.101
 
+      - name: Verify installer security invariants on Windows PowerShell 5.1
+        shell: powershell
+        run: ./scripts/tests/Test-Installer.ps1
+
+      - name: Verify RFC 3161 signer binding on PowerShell 7
+        shell: pwsh
+        run: ./scripts/tests/Test-Rfc3161Timestamp.ps1
+
       - name: Restore
-        run: dotnet restore BindWitness.sln --locked-mode
+        run: dotnet restore PortCVE.sln --locked-mode
 
       - name: Verify formatting
-        run: dotnet format BindWitness.sln --verify-no-changes --no-restore
+        run: dotnet format PortCVE.sln --verify-no-changes --no-restore
 
       - name: Build
-        run: dotnet build BindWitness.sln -c Release --no-restore
+        run: dotnet build PortCVE.sln -c Release --no-restore
 
       - name: Test
-        run: dotnet test BindWitness.sln -c Release --no-build --logger "trx;LogFileName=tests.trx" --collect "XPlat Code Coverage" --results-directory TestResults
+        run: dotnet test PortCVE.sln -c Release --no-build --logger "trx;LogFileName=tests.trx" --collect "XPlat Code Coverage" --results-directory TestResults
 
       - name: Publish Windows x64
-        run: dotnet publish src/BindWitness/BindWitness.csproj -c Release -r win-x64 --self-contained true --no-build -o artifacts/win-x64
+        run: dotnet publish src/PortCVE/PortCVE.csproj -c Release -r win-x64 --self-contained true --no-build -o artifacts/win-x64
 
       - name: Smoke test
         shell: pwsh
         run: |
-          ./artifacts/win-x64/bindwitness.exe --version
-          $json = ./artifacts/win-x64/bindwitness.exe snapshot --no-firewall 2>$null | ConvertFrom-Json
+          ./artifacts/win-x64/portcve.exe --version
+          $json = ./artifacts/win-x64/portcve.exe snapshot --no-firewall 2>$null | ConvertFrom-Json
           if ($json.schema_version -ne 1) { throw 'Unexpected snapshot schema.' }
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
         with:
           name: test-results
           path: TestResults/
 
       - name: Upload smoke artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
         with:
-          name: bindwitness-win-x64
-          path: artifacts/win-x64/bindwitness.exe
+          name: portcve-win-x64
+          path: artifacts/win-x64/portcve.exe

CHANGELOG.md

@@ -2,7 +2,16 @@
 
 All notable changes will be documented here. The project follows semantic versioning after `1.0`; alpha schemas may still change with an explicit version bump.
 
-## 0.1.0-alpha.1 - unreleased
+## Unreleased
+
+- Renamed the project, executable, namespaces, schemas, scripts, and release artifacts from BindWitness (`bindwitness`) to PortCVE (`portcve`); no behavior changed as part of the rename.
+- Added `scan` for offline known-advisory matching against immutable local Docker image IDs and explicit local SBOMs, with a versioned JSON schema, redaction, database-freshness evidence, and `--strict`/`--fail-on` exit gates.
+- Hardened the Trivy boundary with local non-reparse cache/SBOM/temp validation, inherited environment scrubbing, strict result parsing, bounded process termination, and guarded cleanup.
+- Added a file-backed, self-verifying PowerShell installer template and a fail-closed release workflow that signs and independently verifies both `portcve.exe` and `install.ps1`.
+- Added cryptographic RFC 3161 token decoding, signer-info imprint binding, trusted TSA matching, full-SHA GitHub Actions pinning, release checksums, metadata, and provenance attestation.
+- Live-validated Docker TCP/UDP correlation and the offline vulnerability path; see `docs/validation.md` for dated evidence and claim boundaries.
+
+## 0.1.0-alpha.1 - 2026-08-09
 
 - Native Windows TCP/UDP endpoint collection with IPv4 and IPv6 ownership
 - Process, parent, account, and Windows service attribution

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to BindWitness
+# Contributing to PortCVE
 
 Thanks for helping make local exposure evidence more trustworthy.
 
@@ -13,10 +13,10 @@ Small bug fixes and tests can go directly to a pull request.
 Use Windows x64 and the .NET 10 SDK:
 
 ```powershell
-dotnet restore BindWitness.sln --locked-mode
-dotnet format BindWitness.sln --verify-no-changes --no-restore
-dotnet build BindWitness.sln -c Release --no-restore
-dotnet test BindWitness.sln -c Release --no-build
+dotnet restore PortCVE.sln --locked-mode
+dotnet format PortCVE.sln --verify-no-changes --no-restore
+dotnet build PortCVE.sln -c Release --no-restore
+dotnet test PortCVE.sln -c Release --no-build
 ```
 
 NuGet lockfiles are committed. Keep them synchronized with intentional package changes; `--locked-mode` should fail unexpected dependency-resolution drift.

BindWitness.sln → PortCVE.sln

@@ -1,15 +1,15 @@
-
+
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.0.31903.59
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{827E0CD3-B72D-47B6-A68D-7590B98EB39B}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "BindWitness", "src\BindWitness\BindWitness.csproj", "{175B3219-0CEA-4F04-95A8-AE070700B51C}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PortCVE", "src\PortCVE\PortCVE.csproj", "{175B3219-0CEA-4F04-95A8-AE070700B51C}"
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{0AB3BF05-4346-4AA6-1389-037BE0695223}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "BindWitness.Tests", "tests\BindWitness.Tests\BindWitness.Tests.csproj", "{BECAB928-315D-402B-AA27-8D20793808EB}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PortCVE.Tests", "tests\PortCVE.Tests\PortCVE.Tests.csproj", "{BECAB928-315D-402B-AA27-8D20793808EB}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution