OpenBao: vanhemmat versiot ja versiohistoria

SECURITY
- core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148]
- core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148]
- auth/approle: Ensure Secret ID cannot be used for authentication after expiration but before tidy is called. GHSA-7m59-mp95-w6ph. [GH-4148]
- auth/approle: Fix incorrect JSON-decode path when parsing login requests with form data bodies. GHSA-5v22-543h-wg96. [GH-4148]
- auth/cert: Fix omission of TLS connection propagation when calculating role-based quota. GHSA-5v22-543h-wg96. [GH-4148]
- auth/kubernetes: Ensure Service Account JWT is validated on renewal, preventing post-revoke usage. GHSA-gf3j-hm38-jhh5. [GH-4148]

CHANGES
- packaging: Update the default server config included in Linux packages to use the pebbledb backend instead of the removed file backend. [GH-4088]

BUG FIXES
- core/barrier: Persist updates to key rotation config on changes to disabled field. [GH-4107]
- core/grpc-invalidation: Ensure dispatcher lifecycle correctly handles active, standby state changes without locking conflicts. Resolves GRPC invalidation drops and pre-seal active node hangs. [GH-4117]
- storage/raft: Fix auto_join breaking on providers that include ports with their discovered addresses. [GH-4113]
- storage/postgresql: Switch to pg_last_wal_replay_lsn() for applied index value checks. [GH-4118]
- api: Honor the error backoff interval after failed LifetimeWatcher renewal attempts. [GH-4036]

What's Changed
- docs(guides): add migration guide for File to PebbleDB storage backends on Kubernetes (#4092 by @pree) backported by @pree in #4109
- Update default config included in linux packages (#4088 by @satoqz) by @satoqz in #4121
- KeyRotationConfig equals() method should compare disabled field (#4107 by @wslabosz-reply) backported by @satoqz in #4122
- Use persistent JobManager in GRPC Invalidation (#4117 by @cipherboy) backported by @satoqz in #4123
- Fix Auto Join with provider-specified port (#4113 by @satoqz) backported by @satoqz in #4124
- Honor backoff after failed LifetimeWatcher renewals (#4036 by @haxonittech) backported by @satoqz in #4125
- Swap to pg_last_wal_replay_lsn() (#4118 by @cipherboy) backported by @satoqz in #4126
- Ensure release artifact signatures are verified on creation (#3838 by @cipherboy) backported by @satoqz in #4128
- Bump ubi10-minimal from e3a5632 to 204e153 (#4129 by @dependabot) backported by @satoqz in #4138
- Bump github.com/hashicorp/cap from 0.13.0 to 0.14.0 (#4133 by @dependabot) backported by @satoqz in #4143
- v2.7.1 - Security Fixes against release/v2.7.x #4146 by @06kellyjac, @cipherboy, @phil9909, @satoqz, @wslabosz-reply) backported by @cipherboy in #4147
- Add release notes for v2.7.1 by @satoqz in #4149

SECURITY
- agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065]
- auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065]
- core/plugins: Ensure plugin command name is relative to plugin_directory prior to executing. GHSA-j6wc-jpvg-xfxq. [GH-4065]
- core/plugins: Ensure writes to sys/plugins/catalog/* endpoints are restricted to the root namespace. GHSA-cg72-x35g-xfp8. [GH-4065]
- core/policies: Ensure denied ACL policy template evaluation returns an error and is not silently dropped. GHSA-hr5j-3j78-4vh2. [GH-4065]
- core/policies: Prevent cross-namespace policy resolution traversal in the LRU policy cache, allowing unintentional cross-namespace access. GHSA-mjch-vcw3-hhmf. [GH-4065]
- sdk: Prevent TypeKVPair, TypeHeader from leaking malformed request data into audit logs in plaintext. GHSA-8xxq-mq9m-xmhw. [GH-4065]
- secrets/pki: Forbid issuance of non-validated SANs through ACME. GHSA-x8fg-h69x-p28f. [GH-4065]
- ui: Remove support for prompt=none redirection in the OIDC provider. GHSA-2cjw-94fw-wqjx. [GH-4065]

FEATURES
- External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956]
- Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts.
- Use the PKI engine to sign certificates &co with external private keys.
- Use the Transit engine to sign, verify, encrypt, and decrypt payloads with external key material.
- Several KMS plugins provide support:
- Support for PKCS#11-backed keys is included via the kms-pkcs11 plugin available in openbao-plugins.
- Support for Transit-backed keys is built-in. This is similar in concept to the built-in Transit seal.
- Like Auto Seal support via KMS plugins, the interface is provider-agnostic: Develop plugins and enable support for additional providers at any time.
- ML-DSA Support in PKI: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm for all CA, CSR, and leaf actions. [GH-3903]
- ML-DSA is a widely standardized post-quantum cryptography (PQC) algorithm resistant to attacks from quantum computers.
- Note that Go's OCSP implementation does not support ML-DSA so will be unusable with ML-DSA typed issuers.
- ML-DSA Support in Transit: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm. [GH-3909]
- Generate, import, and export keys of type mldsa-44, mldsa-65 and mldsa-87.
- Create and verify pure ML-DSA signatures.
- Enable Pure-PQC TLS: TLS connections can now use pure post-quantum key exchanges and certificates. [GH-3769]
- Operators can specify tls_key_exchange_preferences in server, agent, and proxy listeners to enforce PQC key exchange algorithms (SecP256r1MLKEM768, SecP384r1MLKEM1024, X25519MLKEM768, and MLKEM1024).
- Operators can use ML-DSA certificates via these listeners as well.
- Outbound TLS connections from OpenBao can now connect to servers with the above key exchange algorithms or presenting a ML-DSA server or CA certificate.
- PostgreSQL Horizontal Scalability: Enable read scalability on the PostgreSQL storage backend similar to existing Raft support. [GH-3904]
- Requires ha_enabled = true to be set and cluster_addr to be reachable (establishing a forwarding RPC connection) from standby nodes to the primary.
- In the event of extended leadership loss, standby nodes will come up as read-enabled.
- Only works with PostgreSQL physical replication; will not work with logical replication.
- Strong Consistency Control: Support X-Vault-Index and X-Vault-Inconsistent headers to ensure client/server consistency. [GH-3839]
- X-Vault-Index is now sent when a write is performed.
- The X-Vault-Inconsistent request header can take the following values t

SECURITY
- agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065]
- auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065]
- core/plugins: Ensure plugin command name is relative to plugin_directory prior to executing. GHSA-j6wc-jpvg-xfxq. [GH-4065]
- core/plugins: Ensure writes to sys/plugins/catalog/* endpoints are restricted to the root namespace. GHSA-cg72-x35g-xfp8. [GH-4065]
- core/policies: Ensure denied ACL policy template evaluation returns an error and is not silently dropped. GHSA-hr5j-3j78-4vh2. [GH-4065]
- core/policies: Prevent cross-namespace policy resolution traversal in the LRU policy cache, allowing unintentional cross-namespace access. GHSA-mjch-vcw3-hhmf. [GH-4065]
- sdk: Prevent TypeKVPair, TypeHeader from leaking malformed request data into audit logs in plaintext. GHSA-8xxq-mq9m-xmhw. [GH-4065]
- secrets/pki: Forbid issuance of non-validated SANs through ACME. GHSA-x8fg-h69x-p28f. [GH-4065]
- ui: Remove support for prompt=none redirection in the OIDC provider. GHSA-2cjw-94fw-wqjx. [GH-4065]

CHANGES
- agent, proxy: The .../quit and .../cache-clear endpoints now require the X-Vault-Request request header when require_request_header = true is specified. [GH-4065]

IMPROVEMENTS
- command/server: Include disable_standby_reads, allow_unauthenticated_workflows, and unsafe_relative_paths in sanitized config output. [GH-3433]
- core/mfa: Handle cache entry invalidation on standby nodes after mfa config deletion on leader node. [GH-4033]
- sdk/logical: Introduce ResolvePathOperation to report canonical URLs prior to ACL evaluation. [GH-4065]

BUG FIXES
- command/operator: Fix double file close in snapshot restoration. [GH-3939]
- command/server: Fix boolean config fields being dropped when multiple -config paths are used. [GH-3433]
- core/auth: Ensure invalidation updates description and reloads on changes to config, options, and plugin versions. [GH-3967]
- core/ha: Fix broken cross-version request forwarding during rolling upgrades to v2.6.x from an earlier minor version. [GH-3900]
- core/identity: Fix periodic key rotation and expiration attempts on standbys resulting in read-only errors. [GH-3949]
- core/listeners: Fix broken TCP listener on OpenBSD. [GH-3951]
- core/mfa: Properly handle MFA enforcement configs deletion from storage. [GH-4033]
- core/mounts: Ensure invalidation updates description and reloads on changes to config, options, and plugin versions. [GH-3967]
- core/recovery: Avoid panic during listing of namespace contents due to uninitialized namespace store. [GH-3925]
- core/recovery: Fix generation of recovery token via bao operator generate-root by allowing status checks. [GH-3924]
- core: The response of sys/leader did not contain is_self when it was supposed to be false. [GH-3932]
- sys/raw: Allow creating new entries via sys/raw; when doing so without compression, compression_type="none" must be specified. [GH-3933]

What's Changed
- Fix backwards-incompatible request forwarding (#3900 by @satoqz) backported by @phil9909 in #3922
- fix(command/server): preserve missing config fields in Config.Merge() and Config.Sanitized() (#3433 by @sivapalan) backported by @Luiggi33 in #3953
- Fix errors in snapshot restore command (#3939 by @Luiggi33) backported by @satoqz in #3945
- Allow none compression type in sys/raw (#3933 by @cipherboy) backported by @satoqz in #3946
- fix: sys/leader does not contain is_self on standbys (#3932 by @phil9909) backported by @satoqz in #3948
- Fix recovery token generation via CLI (#3924 by @cipherboy) backported by @satoqz in #3944
- Fix listing of namespaces in recovery mode (#3925 by @cipherboy) backported by @satoqz in #3947
- docs: remove oidc_discovery_url from kubernetes jwt/oidc provider (#3923 by @tsaarni) backported 

SECURITY
- core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [GH-3831]
- secrets/pki: Also enforce allowed_ip_sans_cidr on IP SANs from CSRs. GHSA-g892-p242-8g86. [GH-3833]

BUG FIXES
- command/agent: Fix file sink chown failing unconditionally on Windows. [GH-3733]
- core: Prevent recovered panic in request handler due to uncanceled active context between initialization and standby/active enablement. [GH-3623]
- core: Propagate requests with wrap info to the active node. [GH-3790]
- core/identity: Write OIDC default keys into per-namespace storage. [GH-3662]
- core/namespaces: Fix fatal failures writing default OIDC keys on standby nodes during namespace creation. [GH-3662]
- sys/raw: Propagate delete and write requests to the active node. [GH-3766]
- sys/leases: Propagate renew, revoke and revoke-prefix requests to the active node by default. [GH-3766]
- sys/quotas: Fix broken enable_rate_limit_audit_logging option. [GH-3673]
- sys/workflows: Allow unauthenticated workflow execution without authentication. [GH-3785]
- audit/http: Fix error wrapping in header parsing so the underlying cause is not lost. [GH-3746]
- ui: Fix client-side validation for auth/userpass user creation. [GH-3625]

What's Changed
- redo the client side validation for userpass (#3625) by @phil9909 in #3677
- Improve stdout audit device description (#3620) by @phil9909 in #3678
- Add context cancellation to initialization (#3623) by @phil9909 in #3679
- Refactor api-docs into docs for better versions (v2.6.x) by @cipherboy in #3727
- Backport unauthed workflow configuration fixes by @cipherboy in #3809
- Fix missing OIDC default keys for namespaces (#3662) by @cipherboy in #3802
- Propagate lease and sys/raw writes to leader node (#3766) by @cipherboy in #3807
- Only attempt to change file sink ownership in agent when explicitly requested (#3733) by @cipherboy in #3805
- Fix HMAC verification for non default algorithms (#3668) by @cipherboy in #3803
- Fix error wrapping in HTTP audit device header parsing (#3746) by @cipherboy in #3806
- Fix enable_rate_limit_audit_logging not working (#3673) by @cipherboy in #3804
- Bump Go and dependencies on 2.6.x by @satoqz in #3811
- Fix malformed Packages.gz (#3826) by @satoqz in #3827
- Propagate all 'wrapped-requested' requests (#3790) by @cipherboy in #3828
- Apply IP SANs filtering on CSRs (#3833) by @cipherboy in #3834
- Fix internal operation dispatch creating tokens (#3831) by @cipherboy in #3832
- Add changelog for v2.6.2 by @satoqz in #3830

CHANGES
- packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504]
IMPROVEMENTS
- core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555]
- core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506]
BUG FIXES
- core/expiration: Ensure leases are not inadvertently cached on standby nodes. [GH-3555]
- core/policies: Allow removal of expiration from policies on POST/PUT to sys/policies/acl/<name> by eliding the parameter; use PATCH to update policies without modifying unnecessary parameters. [GH-3506]
- core/policies: Fix limit=0 and negative limits bypassing the pagination_limit ACL option. [GH-3518]
- core/policies: Fix persistence of new allow_wildcards_in_identity_templates, allow_slashes_in_identity_templates parameters in storage. [GH-3506]
- auth/approle: Ensure initial salt is created without transaction to avoid deadlocks. [GH-3556]
- auth/jwt: Fix patch operation of CEL roles losing existing data (bound_audiences not_before_leeway, clock_skew_leeway and expiration_leeway). [GH-3551]
- auth/token: Ensure salt cache is invalidated properly on standby nodes. [GH-3555]
- sdk/plugin: Ensure all log messages are visible under plugin.ServeMultiplex(...) by default to align with plugin.Serve(...). [GH-3536]
- sdk: Better support non-usr-merged distributions in containerized testing. [GH-3554]
- packaging/container: Ensure that labels on UBI-based images comply with Red Hat's certification requirements. [GH-3504]
What's Changed
- Set user=root when invoking OpenBao for Alpine (#3499 by @cipherboy) backported by @cipherboy in #3501
- Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo) backported by @satoqz in #3524
- Restore container image labels & fix UBI-specific ones (#3504 by @pree) backported by @satoqz in #3525
- Fix policy persistence issue, introduce PATCH support for policies (#3506 by @cipherboy) backported by @phil9909 in #3538
- Allow all log messages in multiplexed plugins (#3536 by @cipherboy) backported by @phil9909 in #3537
- Fix limit=0 and negative limits bypassing pagination_limit ACL cap (#3518 by @RealFakeAccount) backported by @phil9909 in #3548
- Fix profile source headings, response field (#3550 by @cipherboy) backported by @phil9909 in #3553
- auth/jwt: fix patch operation of CEL roles lost data (#3551 by @phil9909) backported by @phil9909 in #3552
- Fix lease renewal cache invalidation (#3555 by @cipherboy) backported by @phil9909 in #3566
- Ensure AppRole salt is created without transaction (#3556 by @cipherboy) backported by @phil9909 in #3565
- Copy binary to additional path in test container (#3554 by @cipherboy) backported by @cipherboy in #3568
- Bump dependencies for v2.6.1 by @satoqz in #3570
- Add changelog for v2.6.1 by @satoqz in #3571
Full Changelog: v2.6.0...v2.6.1