Release 1.15.0:
Added the ability to pass keyword arguments provided in the scp() command through to asyncssh.connect() calls it makes, allowing things like custom credentials to be specified.
Added support for a reuse_port argument in create_server(). If set, this will be passed to the asyncio loop.create_server() call which creates listening sockets.
Added support for “soft” EOF when line editing in enabled so that EOF can be signalled multiple times on a channel. When Ctrl-D is received on a channel with line editing enabled, EOF is returned to the application but the channel remains open and capable of accepting more input, allowing an interactive shell to process the EOF for one command but still accept input for subsequent commands.
Added support for the Windows 10 OpenSSH ssh-agent. Thanks go to SamP20 for providing an initial proof of concept and a suggested implementation.
Reworked scoped link-local IPv6 address normalization to work better on Linux systems.
Fixed a problem preserving directory structure in recursive scp().
Fixed SFTP chmod tests to avoid attempting to set the sticky bit on a plain file, as this caused test failures on FreeBSD.
Updated note in SSHClientChannel’s send_signal() documentation to reflect that OpenSSH 7.9 and later should now support processing of signal messages.
3.7.1:
New features
Added type stubs to enable static type checking with mypy.
New update_after_digest flag for CMAC.
Resolved issues
Fixed problem with gcc 4.x when compiling ghash_clmul.c.
Incorrect digest value produced by CMAC after cloning the object.
Method update() of an EAX cipher object was returning the underlying CMAC object, instead of the EAX object itself.
Method update() of a CMAC object was not throwing an exception after the digest was computed (with digest() or verify()).
A pure Unix shell script implementing ACME client protocol
* An ACME protocol client written purely in Shell (Unix shell) language.
* Full ACME protocol implementation.
* Support ACME v1 and ACME v2
* Support ACME v2 wildcard certs
* Simple, powerful and very easy to use. You only need 3 minutes to learn it.
* Bash, dash and sh compatible.
* Simplest shell script for Let's Encrypt free certificate client.
* Purely written in Shell with no dependencies on python or the official
Let's Encrypt client.
* Just one script to issue, renew and install your certificates automatically.
* DOES NOT require root/sudoer access.
* Docker friendly
* IPv6 support
What's new in Sudo 1.8.26
* Fixed a bug in cvtsudoers when converting to JSON format when
alias expansion is enabled.
* Sudo no long sets the USERNAME environment variable when running
commands. This is a non-standard environment variable that was
set on some older Linux systems.
* Sudo now treats the LOGNAME and USER environment variables (as
well as the LOGIN variable on AIX) as a single unit. If one is
preserved or removed from the environment using env_keep, env_check
or env_delete, so is the other.
* Added support for OpenLDAP's TLS_REQCERT setting in ldap.conf.
* Sudo now logs when the command was suspended and resumed in the
I/O logs. This information is used by sudoreplay to skip the
time suspended when replaying the session unless the new -S flag
is used.
* Fixed documentation problems found by the igor utility.
* Sudo now prints a warning message when there is an error or end
of file while reading the password instead of exiting silently.
* Fixed a bug in the sudoers LDAP back-end parsing the command_timeout,
role, type, privs and limitprivs sudoOptions. This also affected
cvtsudoers conversion from LDIF to sudoers or JSON.
* Fixed a bug that prevented timeout settings in sudoers from
functioning unless a timeout was also specified on the command
line.
* Asturian translation for sudo from translationproject.org.
* When generating LDIF output, cvtsudoers can now be configured
to pad the sudoOrder increment such that the start order is used
as a prefix.
* Fixed a bug introduced in sudo 1.8.25 that prevented sudo from
properly setting the user's groups on AIX.
* If the user specifies a group via sudo's -g option that matches
any of the target user's groups, it is now allowed even if no
groups are present in the Runas_Spec. Previously, it was only
allowed if it matched the target user's primary group.
* The sudoers LDAP back-end now supports negated sudoRunAsUser and
sudoRunAsGroup entries.
* Sudo now provides a proper error message when the "fqdn" sudoers
option is set and it is unable to resolve the local host name.
* Portuguese translation for sudo and sudoers from translationproject.org.
* Sudo now includes sudoers LDAP schema for the on-line configuration
supported by OpenLDAP.
18.3.0:
Changes:
- argon2.PasswordHasher's hash type is configurable now.
18.2.0:
Changes:
- The hash type for argon2.PasswordHasher is Argon2\ **id** now.
This decision has been made based on the recommendations in the latest Argon2 RFC draft <https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-4>_.
- To make the change of hash type backward compatible, argon2.PasswordHasher.verify() now determines the type of the hash and verifies it accordingly.
- Some of the hash parameters have been made stricter to be closer to said recommendations.
The current goal for a hash verification times is around 50ms.
- To allow for bespoke decisions about upgrading Argon2 parameters, it's now possible to extract them from a hash via the argon2.extract_parameters() function.
- Additionally argon2.PasswordHasher now has a check_needs_rehash() method that allows to verify whether a hash has been created with the instance's parameters or whether it should be rehashed.
0.31.0:
- Compatibility with OpenSSL 1.1.1 (partly workaround, maybe requires
further investigation)
- Fixes for Windows builds
- Fixes of installs on AWS Lambda
- Fixes of Mac OS X related failures
- Fix Python 2.6 compatibility issues
2.4.1:
Fixed a build breakage in our manylinux1 wheels.
2.4:
BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL 2.4.x.
Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel.
Added initial :doc:OCSP </x509/ocsp> support.
Added support for :class:~cryptography.x509.PrecertPoison.
* Version 3.6.4 (released 2018-09-24)
** libgnutls: Added the final (RFC8446) version numbering of the TLS1.3 protocol.
** libgnutls: Corrected regression since 3.6.3 in the callbacks set with
gnutls_certificate_set_retrieve_function() which could not handle the case where
no certificates were returned, or the callbacks were set to NULL (see #528).
** libgnutls: gnutls_handshake() on server returns early on handshake when no
certificate is presented by client and the gnutls_init() flag GNUTLS_ENABLE_EARLY_START
is specified.
** libgnutls: Added session ticket key rotation on server side with TOTP.
The key set with gnutls_session_ticket_enable_server() is used as a
master key to generate time-based keys for tickets. The rotation
relates to the gnutls_db_set_cache_expiration() period.
** libgnutls: The 'record size limit' extension is added and preferred to the
'max record size' extension when possible.
** libgnutls: Provide a more flexible PKCS#11 search of trust store certificates.
This addresses the problem where the CA certificate doesn't have a subject key
identifier whereas the end certificates have an authority key identifier (#569)
** libgnutls: gnutls_privkey_export_gost_raw2(), gnutls_privkey_import_gost_raw(),
gnutls_pubkey_export_gost_raw2(), gnutls_pubkey_import_gost_raw() import
and export GOST parameters in the "native" little endian format used for these
curves. This is an intentional incompatible change with 3.6.3.
** libgnutls: Added support for seperately negotiating client and server certificate types
as defined in RFC7250. This mechanism must be explicitly enabled via the
GNUTLS_ENABLE_CERT_TYPE_NEG flag in gnutls_init().
** gnutls-cli: enable CRL validation on startup (#564)
** API and ABI modifications:
GNUTLS_ENABLE_EARLY_START: Added
GNUTLS_ENABLE_CERT_TYPE_NEG: Added
GNUTLS_TL_FAIL_ON_INVALID_CRL: Added
GNUTLS_CERTIFICATE_VERIFY_CRLS: Added
gnutls_ctype_target_t: New enumeration
gnutls_record_set_max_early_data_size: Added
gnutls_certificate_type_get2: Added
gnutls_priority_certificate_type_list2: Added
gnutls_ffdhe_6144_group_prime: Added
gnutls_ffdhe_6144_group_generator: Added
gnutls_ffdhe_6144_key_bits: Added
Noteworthy changes in version 2.2.11:
* gpgsm: Fix CRL loading when intermediate certicates are not yet
trusted.
* gpgsm: Fix an error message about the digest algo.
* gpg: Fix a wrong warning due to new sign usage check introduced
with 2.2.9.
* gpg: Print the "data source" even for an unsuccessful keyserver
query.
* gpg: Do not store the TOFU trust model in the trustdb. This
allows to enable or disable a TOFO model without triggering a
trustdb rebuild.
* scd: Fix cases of "Bad PIN" after using "forcesig".
* agent: Fix possible hang in the ssh handler.
* dirmngr: Tack the unmodified mail address to a WKD request. See
commit a2bd4a64e5b057f291a60a9499f881dd47745e2f for details.
* dirmngr: Tweak diagnostic about missing LDAP server file.
* dirmngr: In verbose mode print the OCSP responder id.
* dirmngr: Fix parsing of the LDAP port.
* wks: Add option --directory/-C to the server. Always build the
server on Unix systems.
* wks: Add option --with-colons to the client. Support sites which
use the policy file instead of the submission-address file.
* Fix EBADF when gpg et al. are called by broken CGI scripts.
* Fix some minor memory leaks and bugs.
Noteworthy changes in version 1.8.4:
* Bug fixes:
- Fix infinite loop due to applications using fork the wrong
way.
- Fix possible leak of a few bits of secret primes to pageable
memory.
- Fix possible hang in the RNG (1.8.3 only).
- Several minor fixes.
* Performance:
- On Linux always make use of getrandom if possible and then use
its /dev/urandom behaviour.
3.7.0:
New features
* Added support for Poly1305 MAC (with AES and ChaCha20 ciphers for key derivation).
* Added support for ChaCha20-Poly1305 AEAD cipher.
* New parameter output for Crypto.Util.strxor.strxor, Crypto.Util.strxor.strxor_c,
encrypt and decrypt methods in symmetric ciphers (Crypto.Cipher package).
output is a pre-allocated buffer (a bytearray or a writeable memoryview)
where the result must be stored.
This requires less memory for very large payloads; it is also more efficient when
encrypting (or decrypting) several small payloads.
Resolved issues
* AES-GCM hangs when processing more than 4GB at a time on x86 with PCLMULQDQ instruction.
Breaks in compatibility
* Drop support for Python 3.3.
* Remove Crypto.Util.py3compat.unhexlify and Crypto.Util.py3compat.hexlify.
* With the old Python 2.6, use only ctypes (and not cffi) to interface to native code.
version 0.7.6 (released 2018-10-16)
* Fixed CVE-2018-10933
* Added support for OpenSSL 1.1
* Added SHA256 support for ssh_get_publickey_hash()
* Fixed config parsing
* Fixed random memory corruption when importing pubkeys
version 0.7.5 (released 2017-04-13)
* Fixed a memory allocation issue with buffers
* Fixed PKI on Windows
* Fixed some SSHv1 functions
* Fixed config hostname expansion
version 0.7.4 (released 2017-02-03)
* Added id_ed25519 to the default identity list
* Fixed sftp EOF packet handling
* Fixed ssh_send_banner() to confirm with RFC 4253
* Fixed some memory leaks
Changes include:
- use jbuilder for building
- allow picking different versions of Bcrypt hashes
- use unbuffered IO to read only required number of bytes from /dev/urandom
Version 1.1.111:
Update clients.py to work with Python 2.6, 3.3, 3.5, and 3.6.
Add Python 3.6 support.
Handle Unicode- and byte-strings consistently.
Add timeout parameter to call_taxii_service2 (@mbekavac)
Add support for STIX 1.2.
Add user_agent parameter to call_taxii_service2
3.0.5:
Fix: use AES256 for CA key
Also, don't use read -s, use stty -echo
Fix broken "nopass" option
Add -r to read to stop errors reported by shellcheck (and to behave)
remove overzealous quotes around $pkcs_opts (more SC errors)
Support for LibreSSL (now works on latest version of MacOS)
EasyRSA version will be reported in certificate comments
Client certificates now expire in 3 year (1080 days) by default
CHANGES:
- `sys/seal-status` now includes an `initialized` boolean in the
output. If Vault is not initialized, it will return a `200` with
this value set `false` instead of a `400`.
- `passthrough_request_headers` will now deny certain headers from
being provided to backends based on a global denylist.
FEATURES:
- AWS Secret Engine Root Credential Rotation: The credential used by
the AWS secret engine can now be rotated, to ensure that only Vault
knows the credentials it is using.
- Storage Backend Migrator: A new `operator migrate` command allows
offline migration of data between two storage backends.
- AliCloud KMS Auto Unseal and Seal Wrap Support (Enterprise):
AliCloud KMS can now be used a support seal for Auto Unseal and
Seal Wrapping.
BUG FIXES:
- auth/okta: Fix reading deprecated `token` parameter if a token was
previously set in the configuration
- core: Re-add deprecated capabilities information for now
- core: Fix handling of cyclic token relationships
- storage/mysql: Fix locking on MariaDB
- replication: Fix DR API when using a token
- identity: Ensure old group alias is removed when a new one is
written
- storage/alicloud: Don't call uname on package init
- secrets/jwt: Fix issue where request context would be canceled too
early
- ui: fix need to have update for aws iam creds generation
- ui: fix calculation of token expiry
IMPROVEMENTS:
- auth/aws: The identity alias name can now configured to be either
IAM unique ID of the IAM Principal, or ARN of the caller identity
- auth/cert: Add allowed_organizational_units support
- cli: Format TTLs for non-secret responses
- identity: Support operating on entities and groups by their names
- plugins: Add `env` parameter when registering plugins to the catalog
to allow operators to include environment variables during plugin
execution.
- secrets/aws: WAL Rollback improvements
- secrets/aws: Allow specifying STS role-default TTLs
- secrets/pki: Add configuration support for setting NotBefore
- core: Support for passing the Vault token via an Authorization
Bearer header
- replication: Reindex process now runs in the background and does not
block other vault operations
- storage/zookeeper: Enable TLS based communication with Zookeeper
- ui: you can now init a cluster with a seal config
- ui: added the option to force promote replication clusters
- replication: Allow promotion of a secondary when data is syncing
with a "force" flag
Version 4.0:
- Removed deprecated modules:
- rsa.varblock
- rsa.bigfile
- rsa._version133
- rsa._version200
- Removed CLI commands that use the VARBLOCK/bigfile format.
- Ensured that PublicKey.save_pkcs1() and PrivateKey.save_pkcs1() always return bytes.
- Dropped support for Python 2.6 and 3.3.
- Dropped support for Psyco.
- Miller-Rabin iterations determined by bitsize of key.
- Added function rsa.find_signature_hash() to return the name of the hashing
algorithm used to sign a message. rsa.verify() now also returns that name,
instead of always returning True.
- Add support for SHA-224 for PKCS1 signatures.
- Transitioned from requirements.txt to Pipenv for package management.
Upstream changes:
0.31 Mon Sep 24 2018
- Remove default of SHA256 for RSA keys. This has caused significant
problems with downstream modules and it has always been possible to
do $key->use_sha256_hash()
