[bencehezso]

Summary

cloudexit 2.0 is the first release that can push assessments to a platform (EscapeCloud or ExitCloud) over the new API v2, while staying offline-first: every run still collects with the user's own credentials and produces a local report, and nothing leaves the machine unless a platform is configured. It also moves configuration out of the repository, gives the catalogue a real version and integrity story, reorganises the code into a single cloudexit package, and closes a batch of security and robustness issues. Install is from a release tag; there is no PyPI.

Changes

Platform integration (API v2)

• Optional uploads through POST /api/v2/syncs using assessment or account keys; the key decides the target, and a provider/scope guard rejects a sync that doesn't fit the assessment.
• Idempotent uploads (the sync id is the idempotency key): retries and replays never store or charge twice.
• --upload auto|required|off, --strict, --dry-run, --output json (one JSON object on stdout, logs on stderr) and cloudexit status.
• Automatic retries with backoff and a local spool for failed uploads; cloudexit spool list|flush|purge and cloudexit upload for air-gapped delivery. Spooled syncs are bound to the key that created them and never delivered with another key.
• TLS is always verified; custom CA bundles and proxies are honoured; the key is checked locally and against the platform's own /meta before anything is sent, and never appears in output or logs.

Configuration

• Settings resolve from flags, CLOUDEXIT_* environment variables, ~/.config/cloudexit/config.toml (with profiles) and key files, with cloudexit config path|show.
• Breaking: config.py and the HOST/KEY environment variables are no longer read; a clear message points to CLOUDEXIT_HOST / CLOUDEXIT_API_KEY_FILE.

Catalogue

• The dataset lives in the user data directory, updates itself via a signed-size manifest, and carries a version and hash. cloudexit catalogue status|update|import and a --catalogue <file> run flag; air-gapped use is supported. A catalogue containing triggers or views is refused.

Reports

• One self-contained offline index.html, report.pdf (Basic Executive Summary) and egress.pdf, with provenance and legal notices and no remote resources. Scores and full reports are produced on the platform after an upload.

Codebase and tooling

• Reorganised into a single cloudexit package (the generic top-level core/utils/main modules are gone); python3 main.py still works from a checkout.
• Python 3.12–3.14, tested on Linux, macOS and Windows; dependencies refreshed (incl. the Azure SDK), with an install and upgrade smoke test in CI.

Hardening

• Untrusted platform text is never parsed as markup; reports are written 0700; credential identifiers never reach reports or logs; catalogue-supplied asset paths are constrained to the report folder; -vv no longer logs cloud credentials.

Breaking changes

• config.py, HOST and KEY are no longer read (move to CLOUDEXIT_*).
• Python import paths changed (core/utils → cloudexit); the cloudexit command and its arguments are unchanged. See docs/migration-2.0.md.