Chalk — The Cyber Toolchain

Chalk v1.2.0

Tue, 11 Aug 2026 16:07:39 GMT

Chalk v1.2.0 adds a DNS telemetry sink, sink fallback chains, per-chalk reporting, new runtime timing keys, and metadata headers on HTTP sinks. • New `dns` sink type encodes chalk key values into DNS lookup hostnames via a `domain_template` with `{KEY}` placeholders, providing a telemetry channel for environments where HTTPS egress is restricted; supports `dns_server`, `require_chalk_mark`, and per-key `normalize..callback` fields in `sink_config`. • New `fallback_sink_config` field on all `sink_config` sections names a backup sink to use when the primary is unavailable or disabled; chalk walks the full fallback chain on each delivery failure, with each sink tracking its own `disable_after_errors` counter independently. • `outconf` sections now support `per_chalk_reports: true` and `custom_report` sections support `per_chalk: true` to emit one report per chalk mark instead of bundling all marks into a single report. • `post`, `presign`, and `s3` sinks now automatically disable themselves on repeated errors via a configurable `disable_after_errors: ` threshold (default 3); 4xx responses (except 429) disable immediately, while 5xx, 429, and network errors increment a consecutive-failure counter. • `post` and `presign` sinks now send chalk metadata headers with every request: `X-Chalk-Version`, `X-Chalk-Operation`, `X-Chalk-Action-Id`, `X-Content-Length`, `X-Chalk-Digest-Sha256`, and `X-Chalk-Attempt` (1-based retry counter). • `presign` sink now supports `x-forward-headers`: header names listed in that response header are copied from the redirect response into the upload PUT, enabling metadata injection (e.g. `X-Amz-Meta-*`) that cannot be encoded in the presigned URL. • New `exec.nice` config field sets the nice level (range `0`-`19`, default `5`) for the chalk reporting process after fork, reverted before postexec and heartbeat so each phase uses its own independent value. • Four new runtime host keys for timing and heartbeat tracking: `_MONOTIME` (monotonic clock at operation start, in ms), `_SINCE_TIMESTAMP` (wall-clock ms since process start), `_SINCE_MONOTIME` (monotonic ms since process start), and `_HEARTBEAT_COUNT` (1-based counter, present only in heartbeat reports). • Two new runtime artifact keys capture post-mark errors: `_ERR_INFO` (superset of `ERR_INFO`, full error log through end of operation) and `_FAILED_KEYS` (superset of `FAILED_KEYS`, includes post-build step failures); all report templates except `report_all` now subscribe to these instead of the chalk-time originals. • GitLab CI log output is now automatically wrapped in `section_start`/`section_end` markers with `collapsed=true` when `GITLAB_CI` is set, making chalk reports collapsible in the GitLab job log UI. Breaking changes: • `report_default`, `report_large`, and `insertion_default` templates have had `FAILED_KEYS` removed and `_FAILED_KEYS` added; consumers reading `FAILED_KEYS` from these report templates must switch to `_FAILED_KEYS`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v1.1.1

Mon, 22 Jun 2026 20:55:09 GMT

Chalk v1.1.1 adds `docker_context_upload` to attach build context as OCI attestation and supports OCI Referrers API. • Adds `docker_context_upload` configuration under `docker.docker_registry..docker_push.` to upload the build context as a `.tar.gz` layer attached to an OCI attestation manifest • Adds support for OCI Referrers API via new `attestation_use_oci_tag` config key to attach attestations using the `subject` field instead of legacy tags • Starts populating `DOCKER_CHALK_ADDED_LABELS` with labels injected during `docker build`, keyed by original name • `FAILED_KEYS` and `_OP_FAILED_KEYS` now store a list of error objects per key instead of a single object to record multiple distinct failures Breaking changes: • `FAILED_KEYS` and `_OP_FAILED_KEYS` now store a **list** of error objects per key instead of a single object; consumers must handle the new list format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.6.6

Tue, 10 Feb 2026 02:23:38 GMT

Adds `log_format` config key to control log output format (json/plain/auto) • Adds `log_format` configuration option allowing users to force plain or JSON log output for non-interactive runs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.6.4

Fri, 12 Dec 2025 17:04:14 GMT

Chalk v0.6.4 adds BUILD_WORKFLOW_NAME, BUILD_WORKFLOW_PATH, BUILD_WORKFLOW_HASH, and BUILD_REF environment variables to build reports. • Adds `BUILD_WORKFLOW_NAME`, `BUILD_WORKFLOW_PATH`, and `BUILD_WORKFLOW_HASH` fields to describe the CI workflow used for a build. • Adds `BUILD_REF` field to expose the raw git ref of the build (e.g. `refs/pull/5/merge`). • Sanitizes git origin keys in reports to strip embedded basic auth credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.6.1

Tue, 23 Sep 2025 23:08:59 GMT

Adds `BUILD_ATTEMPT` env var and updates `BUILD_URI` format for GitHub Actions job-level tracking. • `BUILD_ATTEMPT` environment variable is now exposed in custom report context to capture the build attempt number previously embedded in `BUILD_URI`. • `BUILD_URI` environment variable value format changed to include both workflow ID and job ID (`.../actions/runs//job/`) instead of referencing only the build attempt. • `BUILD_ID` environment variable now references the GitHub Actions job ID instead of the workflow ID. Breaking changes: • The format of the `BUILD_URI` environment variable has changed from a build-attempt reference to a URI containing both workflow and job IDs (`.../actions/runs//job/`), which may break parsers expecting the previous short-form ID. • `BUILD_ID` now resolves to the GitHub Actions job ID instead of the workflow ID, potentially changing logic that relied on the previous workflow-level identifier. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.6.0

Tue, 09 Sep 2025 20:55:02 GMT

Chalk v0.6.0 adds X509 codec, postexec async collection, ZIP injection, env var scanning, and JSON logging • Adds `symlink_behavior_chalking`, `--chalk-symlink-behavior`, `symlink_behavior_non_chalking`, and `--scan-symlink-behavior` to control symlink handling for chalked vs non-chalked paths. • Adds X509 codec that parses PEM/DER files and outputs metadata keys like `_X509_SUBJECT`, `_X509_KEY_TYPE`, `_X509_NOT_BEFORE`, `_X509_NOT_AFTER`. Configured via `certs.filter_method`, `certs.always_scan_paths`, `certs.scan_no_extension`, `certs.scan_extensions`, `certs.ignore_filenames`, `certs.ignore_prefixes`, and `certs.ignore_extensions`. • Adds asynchronous metadata collection after `chalk exec` via the `postexec` report, using configs `docker.prep_postexec`, `exec.postexec.run`, `exec.postexec.fork`, `exec.postexec.nice`, `exec.postexec.access_watch.prep_tmp_path`, `exec.postexec.access_watch.initial_poll_time`, `exec.postexec.access_watch.initial_poll_interval`, `exec.postexec.access_watch.scan_codecs`, and `exec.postexec.access_watch.scan_paths`. • Adds `_OP_ARTIFACT_ACCESSED` key to indicate if an artifact was accessed during operation. • Adds `_OP_ARTIFACT_MOUNTED` key to indicate if an artifact file is externally mounted. • Adds `_OP_ARTIFACT_PATH_WITHIN_VCTL` key to report the path of the file in the git repo. • Adds environment variable scanning for artifacts (default on) with configurable `env_vars` setting or `--[no-]env-vars` flag, and adds `_OP_ARTIFACT_ENV_VAR_NAME` key. • Reports all IMDSv2 errors in `FAILED_KEYS` or `_OP_FAILED_KEYS`. • Adds ZIP archive injection support for AWS Lambda via config `zip.inject_binary`, `zip.inject_binary_allowed_extensions` (default `.zip`), and `zip.inject_zip_size_threshold` (default `50Mb`), plus CLI flag `--inject-binary-into-zip`. • Enables setting rlimit for heartbeat processes via configuration. • Outputs logs in `json` format for non-interactive sessions, including fields `chalk_version`, `chalk_commit`, `chalk_magic`, `timestamp`, and `msg`. • Adds `BUILD_UNIQUE_ID` environment variable for GitHub jobs and caches external tool outputs within the same workflow job context. • Enables `chalk.env` to extract chalkmark from `chalk.json` in AWS Lambda environments where `LAMBDA_TASK_ROOT` is defined, and adds run-time keys mirroring `_BUILD_*` keys for non-chalking operations. Breaking changes: • `symlink_behavior` config renamed to `symlink_behavior_chalking`. • `--symlink-behavior` CLI flag renamed to `--chalk-symlink-behavior`. • `exec.heartbeat.*` configs moved to singleton `exec.heartbeat.*` (e.g., `exec.heartbeat.run`, `exec.heartbeat.rate`). • Configuration `ignore_patterns` now applies to all chalk operations, not just chalking ones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.5.9

Thu, 14 Aug 2025 12:46:29 GMT

Adds `docker.update_dockerignore` config to automate .dockerignore updates for legacy Docker builds. • `docker.update_dockerignore` config key to automatically update `.dockerignore` so files are copied during legacy builder builds that don't support `--build-context`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.5.6

Wed, 30 Apr 2025 17:06:07 GMT

Chalk v0.5.6 adds VCS_MISSING_FILES env var to detect uncommitted artifacts • `VCS_MISSING_FILES` environment variable exposes files tracked by version control that are missing on disk during artifact creation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.5.5

Tue, 15 Apr 2025 16:52:41 GMT

Adds AWS CodeBuild pipeline support, object store reporting, copy_report_template_keys function, and TCP socket status filtering • `BUILD_ORIGIN_URI` environment key reports the URI of the resource that originated the CI build. • Adds `object_store_config` to upload report keys to an external object store and reference them. • New copy_report_template_keys("source", "dest") function to duplicate keys between report templates. • `network.tcp_socket_statuses` config key filters which TCP socket statuses appear in `_OP_TCP_SOCKET_INFO`. Breaking changes: • The `tech_stack` plugin and its associated configuration keys are removed. • The `_SIGNATURES` field now contains the full cosign attestation payload instead of just the signature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.5.4

Wed, 19 Feb 2025 22:08:18 GMT

Chalk v0.5.4 adds `run_secret_scanner_tools` config and `EXTERNAL_TOOL_DURATION` env var for secret scanning and performance reporting • `EXTERNAL_TOOL_DURATION` environment variable reports external tool duration for each invocation. • `run_secret_scanner_tools` configuration option collects a new `SECRET_SCANNER` key, currently supporting only Trufflehog. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.14

Mon, 11 Nov 2024 17:46:23 GMT

Adds `_EXEC_ID` key for cross-report correlation and a minimal `heartbeat` report template. • The `_EXEC_ID` key is now emitted on every command execution to uniquely identify the `chalk` process lifetime • Added a new `heartbeat` report template used as the default for heartbeat reports • Renamed configuration keys for embed attestation provider: `attestation_key_embed.location` is removed in favor of `attestation_key_embed.filename`, `attestation_key_embed.save_path`, and `attestation_key_embed.get_paths` Breaking changes: • `attestation_key_embed.location` configuration key is removed; use `attestation_key_embed.filename`, `attestation_key_embed.save_path`, and `attestation_key_embed.get_paths` instead. • `chalk setup` now requires an interactive shell to generate new key-material. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.13

Thu, 10 Oct 2024 22:47:32 GMT

Chalk v0.4.13 adds new environment variable keys for exit codes, cloud vendor detection, failed metadata collection, partial traceroute IPs, and Dockerfile paths. • Adds `_OP_EXIT_CODE` key to report the exit code of external commands like `chalk docker build` • Adds `_OP_CLOUD_SYS_VENDOR` key for reporting sys vendor file content used to identify cloud provider • Adds `FAILED_KEYS` and `_OP_FAILED_KEYS` metadata keys containing collected error details (code, message, description) for keys that could not be collected • Adds `_NETWORK_PARTIAL_TRACEROUTE_IPS` to collect local network subnet IPs in docker network-namespaced containers • Adds `DOCKERFILE_PATH_WITHIN_VCTL` key reporting the Dockerfile path relative to the VCS project root Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.9

Tue, 30 Jul 2024 21:49:12 GMT

Chalk v0.4.9 adds DOCKER_TARGET and other keys to the chalk mark; changes default template for build/push • `mark_default` chalk template is now used by `docker build` and `docker push`, changing default metadata in `/chalk.json` • New `DOCKER_TARGET` key added to the chalk mark, providing the name of the target being built • New `DOCKER_BASE_IMAGES` key added to the chalk mark, providing a breakdown of all base images • New `DOCKER_COPY_IMAGES` key added to the chalk mark, providing a breakdown of external `COPY --from` instructions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.5

Fri, 14 Jun 2024 14:23:23 GMT

Adds `BUILD_COMMIT_ID` key to report the CI/CD triggering commit ID. • Added the `BUILD_COMMIT_ID` key to report the commit ID that triggered the build in CI/CD. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.2

Wed, 05 Jun 2024 17:15:59 GMT

Adds `_GCP_PROJECT_METADATA` key and fallback Docker execution for external tools • Adds `_GCP_PROJECT_METADATA` as a new chalk key to hold GCP project metadata • Enables `syft` and `semgrep` to run via Docker when not installed on the host but Docker is available Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.4.1

Thu, 30 May 2024 16:06:56 GMT

Adds `BUILD_ORIGIN_ID`, `BUILD_ORIGIN_KEY`, `BUILD_ORIGIN_OWNER_ID` and `BUILD_ORIGIN_OWNER_KEY` chalk keys for CI/CD origin identification. • Adds `BUILD_ORIGIN_ID`, `BUILD_ORIGIN_KEY`, `BUILD_ORIGIN_OWNER_ID` and `BUILD_ORIGIN_OWNER_KEY` chalk keys to identify the origin repository using a CI/CD-provided identifier Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.3.4

Mon, 18 Mar 2024 17:25:42 GMT

Chalk v0.3.4 adds con4m functions (memoize, auth_headers, parse_json), a get key provider, and optional command name for `chalk exec` • Adds `get` attestation key provider to retrieve key-material over API • Supports con4m function `memoize` to cache function callback results in chalk marks • Supports con4m function `auth_headers` to get auth headers for a specific auth config • Supports con4m function `parse_json` to parse JSON strings • `chalk exec` no longer requires `--exec-command-name`, using args directly instead Breaking changes: • Config keys `use_signing_key_backup_service`, `signing_key_backup_service_url`, `signing_key_backup_service_auth_config_name`, `signing_key_backup_service_timeout`, and `signing_key_location` are removed; use new `attestation.key_provider`, `attestation_key_embed.location`, and `attestation_key_backup.*` settings instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.3.3

Mon, 26 Feb 2024 22:52:44 GMT

Adds `COMMIT_MESSAGE` and `TAG_MESSAGE` keys to chalk marks; improved CA store fallback • Adds `COMMIT_MESSAGE` key to chalk marks containing the most recent commit message • Adds `TAG_MESSAGE` key to chalk marks for annotated tags • Falls back to bundled Mozilla CA Store when system TLS certs are unavailable Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.3.1

Tue, 23 Jan 2024 17:29:25 GMT

Chalk v0.3.1 adds arm64 Linux support and removes `--no-api-login` flag • Adds `arm64` Linux binary support Breaking changes: • The `--no-api-login` flag is removed; passing it will now fail or be ignored as the setup flow no longer requires interactive OIDC authentication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.3.0

Thu, 18 Jan 2024 13:32:24 GMT

Chalk v0.3.0 adds presign sink, JWT/Basic auth for sinks, git context support, and new metadata fields. • Adds `presign` sink to allow uploads to S3 without hard-coded credentials in the chalk configuration • Adds JWT/Basic auth authentication options to sinks • Added support for git context for docker build commands • Added new git metadata fields about authored commit, committer, and tag • Added `github_json_group` for printing chalk marks in GitHub Actions • Added `docker.wrap_cmd` to allow to customize whether `CMD` should be wrapped when `ENTRYPOINT` is missing in Dockerfile • Added minimal AWS lambda metadata collection. It includes only basic information about lambda function such as its ARN and its runtime environment • Added experimental support for detection of technologies used at chalk and runtime (programming languages, databases, servers, etc.) Breaking changes: • `_OP_CLOUD_METADATA` is now a JSON object vs a string containing JSON data. In addition cloud metadata is now nested to allow to include more metadata about running cloud instances • The signing key backup service has been completely overhauled and no longer uses the OIDC Device Code Flow to authenticate to the API. Instead a pre-generated API access token is passed in chalk profile and that value is used as the bearer token. The `setup` command still generates keys for signing but will no longer prompt with a QR code to authenticate to the API. • As a result of the above the `login` and `logout` commands have been removed. • `CHALK_API_KEY` renamed to `CHALK_DATA_API_KEY` • `use_secret_manager` renamed to `use_signing_key_backup_service` • `secret_manager_url` renamed to `signing_key_backup_service_url` • `secret_manager_timeout` renamed to `signing_key_backup_service_timeout` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.2.2

Thu, 18 Jan 2024 13:31:36 GMT

Chalk v0.2.2 adds `--multi-platform` flag for docker multi-platform builds • Adds support for docker multi-platform builds via the new `--multi-platform` flag Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.2.0

Thu, 18 Jan 2024 13:30:15 GMT

Chalk v0.2.0 adds module system, cloud metadata collection, and `chalk login/logout` commands • `chalk help` and `chalk help ` rendering engine is now functional • `chalk login` command for OIDC authentication with the secret manager • `chalk logout` command to clear auth session • Initial metadata collection for GCP and Azure cloud providers via new metadata keys • `docker.wrap_entrypoint = true` config key to wrap Docker entrypoints when `USER` directive is present Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk

Chalk v0.1.2

Thu, 18 Jan 2024 13:28:11 GMT

First open source release of Chalk with automatic signing, `chalk exec` runtime beaconing, and new data collection modules. • Adds the `chalk setup` command to initialize secrets, generate keypairs via Crash Override's secret service, and configure automatic signing • Adds the `--no-api-login` flag to `chalk setup` for users who provide their own secret via environment variable instead of using the hosted service • Adds the `chalk exec` command to inject beacon data into container entry points for runtime metadata collection • Enables periodic `heartbeat` reports from `chalk exec` to collect metadata about running workloads after startup • Adds an AWS IMDSv2 collection module with associated metadata keys for cloud environment data • Adds a proc file system collection module for capturing process-level metadata • Injects environment variables into docker images in addition to the previously supported labels • Places ELF Chalk marks into their own ELF section so they survive `strip` operations Breaking changes: • Config file format changed; existing preview configuration files may require migration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chalk