Orin v1.2.0 - Standalone Packaging

Orin v1.2.0 - Standalone Offline Forensic Packaging

This release introduces a standalone packaging pipeline and a secure offline setup bundle. Orin is now fully self-contained, allowing security engineers and forensic analysts to deploy and run it on target systems with zero internet connectivity and no Python requirements.

Key Highlights

• Standalone PyInstaller Executable: Packages the Orin Forensic Engine, its embedded Python runtime, and all required/optional dependencies (including cryptography, psutil, yara-python, and scapy) into a single-file binary.
• Network-Free Offline Installation: The updated install.sh script automatically detects the pre-compiled binary and deploys it locally along with threat signature rules and secure default configurations without making any network or external pip installation requests.
• Deduplicated Telemetry & Rule Lookup: Resolves and deduplicates Sigma and YARA search paths, ensuring rules embedded in the frozen environment (sys._MEIPASS) are loaded efficiently without duplicated listings.
• Full Verification and Test Suite Passed: Validated against all system diagnostics (orin doctor), telemetry collection routines (orin collect), and the complete unit test suite (1,042 tests passed, 85.45% code coverage).

---

Installation & Deployment

To deploy Orin on an air-gapped system or target host, copy the offline setup archive orin-1.2.0-linux-x86_64.tar.gz to the target and run:

# Extract the bundle
tar -xzf orin-1.2.0-linux-x86_64.tar.gz
cd orin-1.2.0-linux-x86_64

# Run the local installer
chmod +x install.sh
./install.sh

---

Artifact Signatures and Verification

In alignment with DFIR integrity practices, use the checksums below to verify the integrity of the downloaded package:

• Archive Name: orin-1.2.0-linux-x86_64.tar.gz
• File Size: 26.18 MB
• SHA-256: dcc33935b954f0580b7964ec1a7edc0197223ef0993c53e5ab5a90537ae55efc

---

v1.0.0 — Offline Forensic Investigation & Integrity Engine

Release Highlights

We are proud to announce the v1.0.0 stable release of Orin – a production-ready, zero-dependency, offline Linux forensics and host integrity engine.

🛠️ Core Capabilities Added

1. Interactive Telemetry Explorer Panel: Inspect all 16 collected system telemetry datasets (processes, ports, users, FIM, crontabs, eBPF, special FDs, wtmp/lastlog, pkg integrity) from a unified, searchable dashboard layout.
2. Local & Remote Process Termination: Directly terminate rogue process IDs from the dashboard. Remote process termination automatically propagates connection configurations securely over SSH.
3. AST-Based Threat Rules Engine: Safe, compile-free Sigma rules parser evaluating authentication logs and journald records with automatic MITRE ATT&CK tagging.
4. Security Hardening: Completely eliminated insecure dynamic eval() calls with a recursive AST evaluator and added path traversal validations checking for sensitive patterns (e.g. ~/.ssh/, .env).
5. Delta Comparators: Quick-diff controls in the recent snapshots ledger calculating structural drifts between adjacent runs.
6. dpkg Integrity Verification: Accelerated verification of debian binary signatures with lazy SHA-256 checksum computations on confirmed mismatches.
7. Tamper-Evident Evidence Logging: Snapshot exports wrapped in HMAC-SHA256 signatures ensuring verifiable, court-admissible triage bundles.

🧪 Verification & Coverage

• Comprehensive unit/integration tests fully passing (171 tests).
• Total codebase coverage reached 89.47% (above the 85% requirement).

v0.2.0 — Crontab Persistence Harvester

What's New

🗓️ Scheduled Task (Crontab) Harvester

• Parses all Linux crontab sources: user spool dirs, /etc/crontab, /etc/cron.d/*, and timed script directories
• Detects cron job drift (newly added jobs), volatile-directory execution, and reverse-shell command patterns
• Full auto-resolution when malicious entries are removed
• First-run false-positive guard prevents alert storms on engine upgrades

📄 Documentation

• CONTRIBUTING.md — step-by-step guide for adding collectors and rules
• SECURITY.md — responsible disclosure policy with response timeline
• README.md — Implemented Capabilities table covering all 16 shipped modules
• ROADMAP.md — now forward-looking only

🗄️ Schema

• New collected_crontabs table — run sudo orin init to apply