This is a minor release recommended for all users.
Resolved issues since v0.14.5:
#3496: In sync percentages no longer go negative for large numbers of deleted files.
#3502: Files that were deleted and then ignored are no longer deleted on other devices that didn't ignore them.
#3525: Configuration is no longer moved away when perfoming an upgrade on a full disk.
fix some build errors I see (using same patches as lang/gcc46)
build still failing at:
unwind-dw2.c:1452:5: error: unknown field 'ptm_ceiling' specified in initializer
unwind-dw2.c:1452:5: warning: missing braces around initializer
unwind-dw2.c:1452:5: warning: (near initialization for 'once_regsizes.pto_mutex.<anonymous>')
go1.7.1 (released 2016/09/07) includes fixes to the compiler, runtime,
documentation, and the compress/flate, hash/crc32, io, net, net/http,
path/filepath, reflect, and syscall packages. See the Go 1.7.1 milestone on our
issue tracker for details.
=== 4.38.0 (2016-09-01)
* Support :driver_options option when using the postgres adapter with pg driver (jeremyevans)
* Don't use after commit/rollback database hooks if the model instance methods are not overridden (jeremyevans)
* Add SQL::NumericMethods#coerce, allowing code such as Sequel.expr{1 - x} (jeremyevans)
* Support ** operator for exponentiation on expressions, similar to +, -, *, and / (jeremyevans)
* Add Sequel::SQLTime.date= to set the date used for SQLTime instances (jeremyevans)
Add filesystem/squashfs 4.3
Squashfs is a highly compressed read-only filesystem for Linux.
It uses either gzip/xz/lzo/lz4 compression to compress both files, inodes
and directories. Inodes in the system are very small and all blocks are
packed to minimise data overhead. Block sizes greater than 4K are supported
up to a maximum of 1Mbytes (default block size 128K).
Squashfs is intended for general read-only filesystem use, for archival
use (i.e. in cases where a .tar.gz file may be used), and in constrained
block device/memory systems (e.g. embedded systems) where low overhead is
needed.
This package contains tools to manipulate squashfs archive files.
0.6.1 (August 22, 2016)
DEPRECATIONS/BREAKING CHANGES:
- Once the active node is 0.6.1, standby nodes must also be 0.6.1
in order to connect to the HA cluster.
- Status codes for sealed/uninitialized Vaults have changed to
503/501 respectively.
- Root tokens (tokens with the root policy) can no longer be
created except by another root token or the generate-root
endpoint.
- Issued certificates from the pki backend against new roles
created or modified after upgrading will contain a set of
default key usages.
- The dynamodb physical data store no longer supports HA by
default.
- The ldap backend no longer searches for memberOf groups as part
of its normal flow. Instead, the desired group filter must be
specified.
- app-id is now deprecated with the addition of the new AppRole
backend.
FEATURES:
- AppRole Authentication Backend: The approle backend is a
machine-oriented authentication backend that provides a similar
concept to App-ID while adding many missing features, including a
pull model that allows for the backend to generate authentication
credentials rather than requiring operators or other systems to
push credentials in.
- Request Forwarding: Vault servers can now forward requests to
each other rather than redirecting clients. This feature is off
by default in 0.6.1 but will be on by default in the next release.
- Convergent Encryption in Transit: The transit backend now
supports a convergent encryption mode where the same plaintext
will produce the same ciphertext.
- Improved LDAP Group Filters: The ldap auth backend now uses
templates to define group filters, providing the capability to
support some directories that could not easily be supported before
(especially specific Active Directory setups with nested groups).
- Key Usage Control in PKI: Issued certificates from roles created
or modified after upgrading contain a set of default key usages
for increased compatibility with OpenVPN and some other software.
- Request Retrying in the CLI and Go API: Requests that fail with
a 5xx error code will now retry after a backoff. The maximum
total number of retries (including disabling this functionality)
can be set with an environment variable.
- Service Discovery in vault init: The new -auto option on vault
init will perform service discovery using Consul.
- MongoDB Secret Backend: Generate dynamic unique MongoDB database
credentials based on configured roles.
- Circonus Metrics Integration: Vault can now send metrics to
Circonus.
IMPROVEMENTS:
- audit: Added a unique identifier to each request which will also
be found in the request portion of the response.
- auth/aws-ec2: Added a new constraint bound_account_id to the
role
- auth/aws-ec2: Added a new constraint bound_iam_role_arn to the
role
- auth/aws-ec2: Added ttl field for the role
- auth/ldap, secret/cassandra, physical/consul: Clients with
tls.Config have the minimum TLS version set to 1.2 by default.
- auth/token: Added endpoint to list accessors
- auth/token: Added disallowed_policies option to token store
roles
- auth/token: root or sudo tokens can now create periodic tokens
via auth/token/create; additionally, the same token can now be
periodic and have an explicit max TTL
- build: Add support for building on Solaris/Illumos
- cli: Output formatting in the presence of warnings in the
response object
- cli: vault auth command supports a -path option to take in the
path at which the auth backend is enabled, thereby allowing
authenticating against different paths using the command options
- cli: vault auth -methods will now display the config settings of
the mount
- cli: vault read/write/unwrap -field now allows selecting token
response fields
- cli: vault write -field now allows selecting wrapped response
fields
- command/status: Version information and cluster details added to
the output of vault status command
- core: Response wrapping is now enabled for login endpoints
- core: The duration of leadership is now exported via events
through telemetry
- core: sys/capabilities-self is now accessible as part of the
default policy
- core: sys/renew is now accessible as part of the default policy
- core: Unseal keys will now be returned in both hex and base64
forms, and either can be used
- core: Responses from most /sys endpoints now return normal
api.Secret structs in addition to the values they carried
before.
- physical/etcd: Support ETCD_ADDR env var for specifying
addresses
- physical/consul: Allowing additional tags to be added to Consul
service registration via service_tags option
- secret/aws: Listing of roles is supported now
- secret/cassandra: Add connect_timeout value for Cassandra
connection configuration
- secret/mssql,mysql,postgresql: Reading of connection settings is
supported in all the sql backends
- secret/mysql: Added optional maximum idle connections value to
MySQL connection configuration
- secret/mysql: Use a combination of the role name and token
display name in generated user names and allow the length to be
controlled
- secret/{cassandra,mssql,mysql,postgresql}: SQL statements can
now be passed in via one of four ways: a semicolon-delimited
string, a base64-delimited string, a serialized JSON string array,
or a base64-encoded serialized JSON string array
- secret/ssh: Added allowed_roles to vault-ssh-helper's config and
returning role name as part of response of verify API
- secret/ssh: Added passthrough of command line arguments to ssh
- sys/health: Added version information to the response of health
status endpoint
- sys/health: Cluster information isbe returned as part of health
status when Vault is unsealed
- sys/mounts: MountTable data is compressed before serializing to
accommodate thousands of mounts
- website: The token concepts page has been completely rewritten
BUG FIXES:
- auth/aws-ec2: Added a nil check for stored whitelist identity
object during renewal
- auth/cert: Fix panic if no client certificate is supplied
- auth/token: Don't report that a non-expiring root token is
renewable, as attempting to renew it results in an error
- cli: Don't retry a command when a redirection is received
- core: Fix regression causing status codes to be 400 in most
non-5xx error cases
- core: Fix panic that could occur during a leadership transition
- physical/postgres: Remove use of prepared statements as this
causes connection multiplexing software to break
- physical/consul: Multiple Vault nodes on the same machine
leading to check ID collisions were resulting in incorrect
health check responses
- physical/consul: Fix deregistration of health checks on exit
- secret/postgresql: Check for existence of role before attempting
deletion
- secret/postgresql: Handle revoking roles that have privileges on
sequences
- secret/postgresql(,mysql,mssql): Fix incorrect use of database
over transaction object which could lead to connection
exhaustion
- secret/pki: Fix parsing CA bundle containing trailing whitespace
- secret/pki: Fix adding email addresses as SANs
- secret/pki: Ensure that CRL values are always UTC, per RFC
- sys/seal-status: Fixed nil Cluster object while checking seal
status
0.6.0 (June 14th, 2016)
SECURITY:
Although sys/revoke-prefix was intended to revoke prefixes of
secrets (via lease IDs, which incorporate path information) and
auth/token/revoke-prefix was intended to revoke prefixes of tokens
(using the tokens' paths and, since 0.5.2, role information), in
implementation they both behaved exactly the same way since a
single component in Vault is responsible for managing lifetimes of
both, and the type of the tracked lifetime was not being checked.
The end result was that either endpoint could revoke both secret
leases and tokens. We consider this a very minor security issue as
there are a number of mitigating factors: both endpoints require
sudo capability in addition to write capability, preventing
blanket ACL path globs from providing access; both work by using
the prefix to revoke as a part of the endpoint path, allowing them
to be properly ACL'd; and both are intended for emergency
scenarios and users should already not generally have access to
either one. In order to prevent confusion, we have simply removed
auth/token/revoke-prefix in 0.6, and sys/revoke-prefix will be
meant for both leases and tokens instead.
DEPRECATIONS/BREAKING CHANGES:
- auth/token/revoke-prefix has been removed. See the security
notice for details.
- Vault will now automatically register itself as the vault
service when using the consul backend and will perform its own
health checks.
- List operations that do not find any keys now return a 404
status code rather than an empty response object
- CA certificates issued from the pki backend no longer have
associated leases, and any CA certs already issued will ignore
revocation requests from the lease manager.
FEATURES:
- AWS EC2 Auth Backend: Provides a secure introduction mechanism
for AWS EC2 instances allowing automated retrieval of Vault
tokens.
- Response Wrapping: Nearly any response within Vault can now be
wrapped inside a single-use, time-limited token's cubbyhole,
taking the Cubbyhole Authentication Principles mechanism to its
logical conclusion.
- Azure Physical Backend: You can now use Azure blob object
storage as your Vault physical data store
- Swift Physical Backend: You can now use Swift blob object
storage as your Vault physical data store
- Consul Backend Health Checks: The Consul backend will
automatically register a vault service and perform its own
health checking.
- Explicit Maximum Token TTLs: You can now set explicit maximum
TTLs on tokens that do not honor changes in the system- or
mount-set values.
- Non-Renewable Tokens: When creating tokens directly through the
token authentication backend, you can now specify in both token
store roles and the API whether or not a token should be
renewable, defaulting to true.
- RabbitMQ Secret Backend: Vault can now generate credentials for
RabbitMQ. Vhosts and tags can be defined within roles.
IMPROVEMENTS:
- audit: Add the DisplayName value to the copy of the Request
object embedded in the associated Response, to match the
original Request object
- audit: Enable auditing of the seal and step-down commands
- backends: Remove most root/sudo paths in favor of normal ACL
mechanisms.
- command/auth: Restore the previous authenticated token if the
auth command fails to authenticate the provided token
- command/write: -format and -field can now be used with the write
command
- core: Add mlock support for FreeBSD, OpenBSD, and Darwin
- core: Don't keep lease timers around when tokens are revoked
- core: If using the disable_cache option, caches for the policy
store and the transit backend are now disabled as well
- credential/cert: Renewal requests are rejected if the set of
policies has changed since the token was issued
- credential/cert: Check CRLs for specific non-CA certs configured
in the backend
- credential/ldap: If groupdn is not configured, skip searching
LDAP and only return policies for local groups, plus a warning
- credential/ldap: vault list support for users and groups
- credential/ldap: Support for the memberOf attribute for group
membership searching
- credential/userpass: Add list support for users
- credential/userpass: Remove user configuration paths from
requiring sudo, in favor of normal ACL mechanisms
- credential/token: Sanitize policies and add default policies in
appropriate places
- credential/token: Setting the renewable status of a token is now
possible via vault token-create and the API.
- secret/aws: Use chain credentials to allow environment/EC2
instance/shared providers
- secret/aws: Support for STS AssumeRole functionality
- secret/consul: Reading consul access configuration supported.
- secret/pki: Added exclude_cn_from_sans field to prevent adding
the CN to DNS or Email Subject Alternate Names
- secret/pki: Added list support for certificates
- sys/capabilities: Enforce ACL checks for requests that query the
capabilities of a token on a given path
- sys/health: Status information can now be retrieved with HEAD
BUG FIXES:
- command/read: Fix panic when using -field with a non-string
value
- command/token-lookup: Fix TTL showing as 0 depending on how a
token was created.
- command/various: Tell the JSON decoder to not convert all
numbers to floats; fixes some various places where numbers were
showing up in scientific notation
- command/server: Prioritized devRootTokenID and devListenAddress
flags over their respective env vars
- command/ssh: Provided option to disable host key checking.
- core: Properly persist mount-tuned TTLs for auth backends
- core: Don't accidentally crosswire SIGINT to the reload handler
- credential/github: Make organization comparison case-insensitive
during login
- credential/github: Fix panic when renewing a token created with
some earlier versions of Vault
- credential/github: The token used to log in via vault auth can
now be specified in the VAULT_AUTH_GITHUB_TOKEN environment
variable
- credential/ldap: Fix problem where certain error conditions when
configuring or opening LDAP connections would cause a panic
instead of return a useful error message
- credential/token: Fall back to normal parent-token semantics if
allowed_policies is empty for a role.
- credential/token: Fix issues renewing tokens when using the
"suffix" capability of token roles
- credential/token: Fix lookup via POST showing the request token
instead of the desired token
- credential/various: Fix renewal conditions when default policy
is not contained in the backend config
- physical/s3: Don't panic in certain error cases from bad S3
responses
- secret/consul: Use non-pooled Consul API client to avoid leaving
files open
- secret/pki: Don't check whether a certificate is destined to be
a CA certificate if sign-verbatim endpoint is used
0.5.3 (May 27th, 2016)
SECURITY:
Consul ACL Token Revocation: An issue was reported to us
indicating that generated Consul ACL tokens were not being
properly revoked. Upon investigation, we found that this behavior
was reproducible in a specific scenario: when a generated lease
for a Consul ACL token had been renewed prior to revocation. In
this case, the generated token was not being properly persisted
internally through the renewal function, leading to an error
during revocation due to the missing token. Unfortunately, this
was coded as a user error rather than an internal error, and the
revocation logic was expecting internal errors if revocation
failed. As a result, the revocation logic believed the revocation
to have succeeded when it in fact failed, causing the lease to be
dropped while the token was still valid within Consul. In this
release, the Consul backend properly persists the token through
renewals, and the revocation logic has been changed to consider
any error type to have been a failure to revoke, causing the lease
to persist and attempt to be revoked later.
New Features
Allow creating custom rating columns that support half-stars via Preferences->Add your own columns
Tag Browser: Add an option in Preferences->Look & Feel->Tag Browser to turn off the display of counts in the Tag Browser
Tag browser: Show the book counts on the right edge of the Tag Browser
Cover Browser: Allow any metadata field to be used as the sub-title, not just the rating
Edit Book: A new tool to sort the rules in a CSS stylesheet. To use it add it to the toolbar for CSS editors
Edit Book: The Remove Unused CSS tool now has an option to also merge CSS rules that have identical selectors
Add a tweak in Preferences->Tweaks to exclude some images types from being treated a covers when dropped onto the Book Details panel.
Closes tickets: 1620198
Allow reading more image formats as covers (All images will be converted to JPEG when stored).
Closes tickets: 1619993
Content server: OPDS feeds: Change the value of <updated> for entries in the acquisition feed to be the last modified date for the book. Also make the size and last modified timestamp available as attributes in the acquisition links. Useful for integration with third party applications.
Kobo driver: Add support for firmware version 4 available on the new Kobo Aura One
Bug Fixes
ODT Input: Add support for continued lists.
Closes tickets: 1620581
Edit Book: Fix high-dpi rendering of emblems in the File Browser
Fix regression in previous release that caused wide column icons to be scaled incorrectly
Metadata download dialog: Fix https links in the download summary not working
DOCX Output: Handle nested display:table tags with no rows.
Closes tickets: 1619662
PDF Output: Fix OpenType fonts with CFF font data not embeddable on windows
Improved news sources
Ars Technica
init: mark Mercurial 3.7 as supported and prepare for 0.8.5
test-help: fix for Mercurial 3.7
test-renames.t: don't use "seq"
push: better formatting of messages from the server
git_handler: use util method for writing bookmarks
util: add method for writing bookmarks
util: regularize mercurial imports
ignore: add .testtimes to ignored files
version: bump up to 0.8.4
all-version-tests: test Mercurial 3.6.3
git_handler: work around dulwich using unicode for ref names Dulwich treats ref names internally as unicode strings (probably because of Python 3?), which means that at some points it tries to do os.path.join between the repo path and the unicode of the ref name, which fails miserably if we construct the repo with a str and not a unicode. Kludge around this problem. Fixes issue 172. This is a roll-forward of a593069575bb, which should be valid now that th…
hgrepo: ensure all git-origin tags are bytes If we don't do this we might end up with unicodes being written using ui, which then breaks in popbuffer in test-encoding.t. This appears to be an academic concern until we start passing unicode paths to git repos, which we need to do in order to resolve some other problems. Yay.
all-version-tests: wrap to 80 columns and test 3.{5,6}.2
Makefile: respect HGTESTFLAGS environment variable
test-push.t: clean up compat cruft
testutil: clean up compat cruft
test-subrepos.t: clean up compat cruft
gitdirstate: fix up compat comment pathutil isn't in 2.8.
gitrepo: clean up compat cruft
merge
overlay: regularize mercurial imports
gitdirstate: regularize mercurial imports
ssh: regularize mercurial imports
hgrepo: regularize mercurial imports
hg2git: regularize mercurial imports
init: regularize mercurial imports
git_handler: regularize mercurial imports
bookmarks: use bookmarks.recordchange instead of bookmarks.write if available bookmarks.write is deprecated and it was showing warning messages in test-hg-branch.t with the latest test runner from core mercurial. Tested with both hg 2.8 and hg tip.
init: handle AttributeError in addition to ImportError If a module doesn't exist, it yields an ImportError, if an attribtue doesn't exist on a module, it yields an AttributeError
ssh: fix breakage again with dulwich update dulwich 0.12.x changed the way they pass parameters around, so we reformat that to what hg-git expects. This is just plain ridiculous.
push: print messages from the server Some servers, for example, Bitbucket, output helpful messages. This patch reports the output, if any exist, to the user.
init: only activate git ignore logic in reposetup This will massively speed up 'hg status' on repos that are not git based. On my macports repo, status went from Before: 0m0.591s After: 0m0.297s
Backed out changeset a593069575bb This was causing test-encoding.t to fail.
git_handler: work around dulwich using unicode for ref names Dulwich treats ref names internally as unicode strings (probably because of Python 3?), which means that at some points it tries to do os.path.join between the repo path and the unicode of the ref name, which fails miserably if we construct the repo with a str and not a unicode. Kludge around this problem. Fixes issue 172.
readme: document the specific behaviors of hg author translation Particularly the odd ext:(%xx) feature.
manifest: include test and test data Closes issue #154.
determine_wants: deal with refs being None Not clear how this is happening, but this should fix it. Resolves issue #166.
- restrict GUI option to Qt.
- disable compiler optimisation override
- new features:
- support for Apple ProRes videos in MOV/MP4 files
- much improves MPEG TS support
- support WebVTT subtitles
- output of Big Endian PCM to WAV supported
- ${TOOL}_OPTIONS can be used for passing additional arguments to
individual programs via environment
- support for core-less DTS streams consisting solely of XLL extension
sub-streams
- time codes computation for AAC, AC-3, DTS, MP3 and TrueHD packets
was rewritten
- support TrueHD tracks inside MPEG TS by keeping (additional) AC-3
audio track
- support MPEG-H p2/HEVC video in MP4 container
- support for AAC in LOAS/LATM multiplex if read from MPEG transport
streams or raw LOAS/LATM AAC files
- support for h.265/HEVC from MPEG TS and elementary streams
- support for teletext subtitles from MPEG TS
- faster format detection for text subtitle formats
- support for DTS audio streams in MP4
- support for VP9 from IVF and WebM files
- support for Opus
- support for reading ALAC from CAF and MP4 files
- 5 years of various bug fixes and GUI improvements.
------------------------------------------
0.103013 2016-09-06 19:18:12-04:00 America/New_York
- the cpan-uploader program now skips directories, while the
upload_file method throws an exception on non-files; thanks to
Vincent Pit for reporting the weird behavior when trying to upload a
directory
