Kurahi 2.6.0
Also available in Japanese.
Kurahi 2.6.0 extends Kurahi Industrial from understanding legacy systems to proving that a change to them behaves as intended. Kurahi is built by the KODA SōKEN team. The complete list of changes is in the changelog.
With 2.6.0 you can:
- Verify a change to a COBOL or FORTRAN program. Kurahi compiles the original and the changed program, runs both on the same test inputs and compares the outputs, separating the changes you approved from regressions. Every outcome is signed evidence you can verify offline.
- Bring in results you already have from Google Cloud Mainframe Assessment Tool, AWS Transform for mainframe and IBM watsonx Code Assistant for Z (Z Understand), next to Kurahi’s own analysis.
- See what an attacker would see first: the Guardian exposure check looks at the domains your organisation owns, and — with each person’s consent — at the exposure of staff who enrol.
See Change verification, Vendor results import and Kurahi Guardian.
What is new
Section titled “What is new”Kurahi Industrial
Section titled “Kurahi Industrial”- Change verification (
modernise_verify,kurahi legacy verify): frozen source snapshots (SHA-256 per file, compiler identity); GnuCOBOL and GNU Fortran; byte-exact comparison by default, or by fields including packed decimal (COMP-3) with an explicit tolerance; an approved change specification separates intended changes from regressions. Verdicts: PASS, FAIL, INCONCLUSIVE, TIMEOUT, CANCELLED, NOT_RUN_NO_FIXTURES, NOT_RUN_COMPILER_UNAVAILABLE. A PASS covers the test inputs that were run; GnuCOBOL is not IBM Enterprise COBOL; PL/I is analysed, and verified only where a licensed PL/I compiler is configured. - Change cases: independent approval (approver ≠ owner and requester); any change to the candidate, specification, policy or inputs cancels the approval; approval hands off, never deploys.
- Signed evidence for every outcome;
kurahi evidence verify --trust-key. - Vendor results import (
modernise_import,kurahi industrial import): Google MAT (Neo4j graph export), AWS Transform for mainframe (generated requirements), IBM Z Understand (generated documentation) per each vendor’s published format; other exports with a field mapping you provide. Bundles are checked (size, paths, hashes), malware-scanned and recorded as signed evidence; imported results stay labelled as unverified vendor claims until reviewed. Kurahi does not connect to or run these vendor services.
Kurahi Guardian
Section titled “Kurahi Guardian”- Exposure check (
guardian.exposure) for verified domains: certificate-transparency subdomains, SPF/DMARC/MX/CAA and dangling CNAMEs, masked secrets on your own websites, lookalike domains; optional Have I Been Pwned domain search and GitHub code search. - Personal exposure, with consent (off by default): only for people who enrol and prove their identifiers; visible to the person and the security role; revocable; never a search of people who have not enrolled.
Documentation
Section titled “Documentation”- English pages are in English only, with a glossary of the Japanese business terms.
Upgrade from 2.5.0
Section titled “Upgrade from 2.5.0”kurahi update (or install.sh / install.ps1 with --version 2.6.0) installs 2.6.0 as usual;
see Updating. A 2.5.0 configuration loads unchanged; everything new is off until
you configure it. Change verification needs GnuCOBOL (cobc) and/or GNU Fortran (gfortran) on the
server; without them the verdict is NOT_RUN_COMPILER_UNAVAILABLE.
Roll back
Section titled “Roll back”install.sh --version 2.5.0 (Windows: install.ps1 -Version 2.5.0) installs 2.5.0 again; see
Updating. Before you start 2.5.0, remove guardian.exposure from the
configuration (2.5.0 does not accept keys it does not know). Verification runs, change cases and
imports created by 2.6.0 stay on disk; 2.5.0 has no tools for them.
- Kurahi is self-hosted: your servers and any provider you choose are separate from Kurahi.
- Checksums for every asset are in
SHA256SUMS.txtandSHA256SUMS-desktop.txt.