Release 1.1

Added

Archive Security

• Added ZIP evasion detection for manipulated archives commonly associated with “Zombie ZIP” techniques.
• Added archive structure inspection for suspicious ZIP metadata inconsistencies.
• Added detection for ZIP<em>STORED</em>SIZE_MISMATCH when an entry is marked as STORED but compressed and uncompressed sizes differ.
• Added archive risk classification pipeline with support for:
• CLEAN
• SUSPICIOUS
• MALFORMED
• EVASIVE
• Added archive inspection result reporting fields for:
• stored<em>size</em>mismatch
• header_mismatch
• invalid_offset
• overlapping_entries
• nested_archive
• risk_score
• reason_code
• detail
• Added ArchiveInspector integration into the realtime anti-ransomware engine.
• Added sandboxed archive analysis through a dedicated archive_worker.
• Added Bubblewrap-based isolation for archive inspection workers.
• Added realtime archive threat signaling through the existing alert socket pipeline.
• Added GUI alert support for suspicious archive detections raised by archive inspection.
• Added delayed archive re-scan support to improve detection reliability after file write completion.
• Added detection coverage for suspicious ZIP files created through atomic rename / moved-to workflows.

Email Security (Mail Proxy)

• Added BastionGuard-mailproxy, a local SMTP protection proxy for outgoing email security.
• Added support for local SMTP relay listeners on:
• plain SMTP
• submission
• implicit TLS ports
• Added outgoing mail relay selection based on sender address and sender domain matching.
• Added support for multiple SMTP relay profiles with per-profile authentication and TLS settings.
• Added automatic fallback import of SMTP relay profiles from Thunderbird when JSON mail configuration is unavailable.
• Added transparent relay mode for production continuity when email protection is disabled.

Email Signature Protection

• Added mandatory outgoing signature injection support for protected email flows.
• Added plain text signature injection for outgoing emails.
• Added HTML signature injection with inline branded logo support.
• Added multipart MIME signature injection support for compatible email structures.
• Added safe fallback handling for unsupported or malformed MIME signature injection cases.

Mail Delivery Reliability

• Added local delivery queueing for failed remote SMTP relay attempts.

TLS & Mail Proxy Infrastructure

• Added self-signed TLS certificate generation for the local mail proxy.
• Added automatic local TLS support for protected SMTP sessions.
• Added Thunderbird certificate installation support for local mail proxy trust.
• Added Thunderbird SMTP redirection support to route outgoing mail through the local BastionGuard proxy.
• Added Thunderbird SMTP restoration logic to safely restore original remote relay settings.
• Added support for STARTTLS and implicit TLS handling in the local SMTP proxy.
• Added support for authenticated SMTP client sessions (AUTH PLAIN and AUTH LOGIN) on the local proxy.
• Added support for protected relay delivery with optional mandatory signature enforcement.

Changed

• Integrated archive inspection into the realtime filesystem monitoring pipeline.
• Updated the realtime ransomware engine to inspect archive files before or alongside standard file scanning.
• Improved anti-ransomware monitoring coverage for compressed archives appearing in watched directories.
• Improved Bubblewrap sandbox profile to work reliably in production service context.
• Refined sandbox namespace configuration to avoid failures caused by unsupported or restricted user/network namespace setup in systemd service environments.
• Preserved sandbox isolation while removing namespace options that caused runtime failures in production.
• Improved alert flow so suspicious archive detections now trigger end-to-end notification correctly.
• Extended BastionGuard with outgoing mail protection through a dedicated local SMTP proxy component.
• Improved email workflow integration by allowing Thunderbird-based relay import and local SMTP redirection.
• Updated email protection flow to preserve delivery continuity through transparent relay fallback and local queueing.

Fixed

Archive Detection

• Fixed realtime archive inspection not triggering alerts for suspicious ZIP files.
• Fixed Bubblewrap sandbox launch failures caused by uid map errors in service context.
• Fixed Bubblewrap failures caused by loopback/network namespace setup inside the realtime daemon.
• Fixed archive inspection pipeline failures where files were detected by inotify but not successfully analyzed in sandbox.
• Fixed end-to-end realtime detection for Zombie ZIP test samples.

Localization

• Fixed language initialization bug in main where locale variables could be missing or improperly loaded, causing translations to fail or the default language not to be applied correctly.
• Fixed loading and fallback handling for LANG, LC_ALL, and LANGUAGE environment variables using lang.conf.
• Ensured safe locale initialization with fallback chain (setlocale) to prevent startup issues on systems without configured locales.

Scan Engine

• Fixed ScanPage automatic scanning logic:
• removed synchronous subprocess waiting inside asynchronous callbacks
• ensured ClamAV scan completes before triggering cloud reputation checks
• fixed asynchronous scan flow so MalwareBazaar lookups only run after scan EOF
• prevented premature cloud checks triggered by intermediate ClamAV output lines
• reduced potential race conditions during automatic file scanning

• Fixed excessive concurrent cloud lookups by introducing a limit on active MalwareBazaar checks.
• Reduced risk of uncontrolled detached cloud-check thread growth during automatic scanning.
• Improved automatic scan stability in production environments.

Security

• Hardened compressed archive inspection against ZIP-based evasion techniques.
• Improved defense against archive-based AV/EDR bypass attempts using manipulated ZIP metadata.
• Added sandboxed parsing path to reduce risk from malformed or adversarial archive inputs.
• Extended realtime protection to detect suspicious archive structures before user interaction.
• Added protected outgoing email routing through a local SMTP proxy layer.
• Improved outbound mail control with signature enforcement and controlled relay selection.
• Added TLS support for local SMTP proxy sessions to reduce exposure of local mail submission traffic.
• Added safer relay fallback and queueing behavior for failed protected email delivery attempts.

Notes

• Zombie ZIP detection is now active in the production realtime monitoring path.
• Realtime archive detection has been validated with:
• normal ZIP samples
• manipulated Zombie ZIP samples
• Service resource usage remains low after integration, making the feature suitable for continuous protection on production systems.