* Add support for PKCSv1_5_NoOID signatures
This assumes a pre-hashed input has been provided to Vault, but we do
not write the hash's OID into the signature stream. This allows us to
generate the alternative PKCSv1_5_NoOID signature type rather than the
existing PKCSv1_5_DERnull signature type we presently use.
These are specified in RFC 3447 Section 9.2.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Exclude new none type from PSS based tests
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add tests for PKCS#1v1.5 signatures
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* adds error handling to auth-jwt component for missing roles and fixes bug where role wasn't being retained when using alternate oidc mount path at login
* fixes jwt login bug from auth mount tabs and adds test
* updates okta-number-challenge success value to arg in template
* adds changelog entry
* fixes issues logging in manually with jwt
* reverts mistaken change
* Store login MFA secret with tokenhelper
* Clean up and refactor tokenhelper paths
* Refactor totp test code for re-use
* Add login MFA command tests
* Use longer sleep times and sha512 for totp test
* Add changelog
Vault's new TLS devvault mode has two nits with certificate
construction:
1. The CA doesn't need to include any SANs, as these aren't checked.
Technically this means the CA could be reused as a leaf certificate
for the one specified IP SAN, which is less desirable.
2. Add hostname to SANs in addition to CNs. This is a best practice, as
(when the CN is a hostname), it is preferable to have everything in
SANs as well.
Neither of these are major changes.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add patch support to CLI
This is based off the existing write command, using the
JSONMergePatch(...) API client method rather than Write(...), allowing
us to update specific fields.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add documentation on PATCH support
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
This appears to be due to a CI change that resulted in different user
IDs between the host and the container image.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* wip
* work in progress
* pki-role-form-test
* clean up
* radio-select-ttl-or-string test
* clean up
* add yielded check
* 12 to 13
* add pki-key-usage test
* remove meep
* key-params test
* clean up
* clean up
* pr comments
* Allow passing AssociatedData factories in keysutil
This allows the high-level, algorithm-agnostic Encrypt/Decrypt with
Factory to pass in AssociatedData, and potentially take multiple
factories (to allow KMS keys to work). On AEAD ciphers with a relevant
factory, an AssociatedData factory will be used to populate the
AdditionalData field of the SymmetricOpts struct, using it in the AEAD
Seal process.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add associated_data to Transit Encrypt/Decrypt API
This allows passing the associated_data (the last AD in AEAD) to
Transit's encrypt/decrypt when using an AEAD cipher (currently
aes128-gcm96, aes256-gcm96, and chacha20-poly1305). We err if this
parameter is passed on non-AEAD ciphers presently.
This associated data can be safely transited in plaintext, without risk
of modifications. In the event of tampering with either the ciphertext
or the associated data, decryption will fail.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add to documentation
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* [CI-only] Update RedHat registry tag
There are a few changes being made to RedHat's registry on October 20, 2022 that affect the way images need to be tagged prior to being pushed to the registry. This PR changes the tag to conform to the new standard.
We have other work queued up in crt-workflows-common and actions-docker-build to support the other required changes.
This PR should be merged to `main` and all release branches on or after October 20, 2022, and MUST be merged before your next production release. Otherwise, the automation to push to the RedHat registry will not work.
----
A detailed list of changes shared from RedHat (as an FYI):
The following changes will occur for container certification projects that leverage the Red Hat hosted registry [[registry.connect.redhat.com](http://registry.connect.redhat.com/)] for image distribution:
- All currently published images are migrating to a NEW, Red Hat hosted quay registry. Partners do not have to do anything for this migration, and this will not impact customers. The registry will still utilize [registry.connect.redhat.com](http://registry.connect.redhat.com/) as the registry URL.
- The registry URL currently used to push, tag, and certify images, as well as the registry login key, will change. You can see these changes under the “Images” tab of the container certification project. You will now see a [quay.io](http://quay.io/) address and will no longer see [scan.connect.redhat.com](http://scan.connect.redhat.com/).
- Partners will have the opportunity to auto-publish images by selecting “Auto-publish” in the Settings tab of your certification project. This will automatically publish images that pass all certification tests.
- For new container image projects, partners will have the option to host within their own chosen image registry while using [registry.connect.redhat.com](http://registry.connect.redhat.com/) as a proxy address. This means the end user can authenticate to the Red Hat registry to pull a partner image without having to provide additional authentication to the partner’s registry.
* docker: update redhat_tag
Co-authored-by: Sam Salisbury <samsalisbury@gmail.com>
Since 1.9 k8s auth method supports setting Name reported by auth method to Service Account name which is not reflected in this doc
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
* runs ember-cli-update to 4.4.0
* updates yarn.lock
* updates dependencies causing runtime errors (#17135)
* Inject Store Service When Accessed Implicitly (#17345)
* adds codemod for injecting store service
* adds custom babylon parser with decorators-legacy plugin for jscodeshift transforms
* updates inject-store-service codemod to only look for .extend object expressions and adds recast options
* runs inject-store-service codemod on js files
* replace query-params helper with hash (#17404)
* Updates/removes dependencies throwing errors in Ember 4.4 (#17396)
* updates ember-responsive to latest
* updates ember-composable-helpers to latest and uses includes helper since contains was removed
* updates ember-concurrency to latest
* updates ember-cli-clipboard to latest
* temporary workaround for toolbar-link component throwing errors for using params arg with LinkTo
* adds missing store injection to auth configure route
* fixes issue with string-list component throwing error for accessing prop in same computation
* fixes non-iterable query params issue in mfa methods controller
* refactors field-to-attrs to handle belongsTo rather than fragments
* converts mount-config fragment to belongsTo on auth-method model
* removes ember-api-actions and adds tune method to auth-method adapter
* converts cluster replication attributes from fragment to relationship
* updates ember-data, removes ember-data-fragments and updates yarn to latest
* removes fragments from secret-engine model
* removes fragment from test-form-model
* removes commented out code
* minor change to inject-store-service codemod and runs again on js files
* Remove LinkTo positional params (#17421)
* updates ember-cli-page-object to latest version
* update toolbar-link to support link-to args and not positional params
* adds replace arg to toolbar-link component
* Clean up js lint errors (#17426)
* replaces assert.equal to assert.strictEqual
* update eslint no-console to error and disables invididual intended uses of console
* cleans up hbs lint warnings (#17432)
* Upgrade bug and test fixes (#17500)
* updates inject-service codemod to take arg for service name and runs for flashMessages service
* fixes hbs lint error after merging main
* fixes flash messages
* updates more deps
* bug fixes
* test fixes
* updates ember-cli-content-security-policy and prevents default form submission throwing errors
* more bug and test fixes
* removes commented out code
* fixes issue with code-mirror modifier sending change event on setup causing same computation error
* Upgrade Clean Up (#17543)
* updates deprecation workflow and filter
* cleans up build errors, removes unused ivy-codemirror and sass and updates ember-cli-sass and node-sass to latest
* fixes control groups test that was skipped after upgrade
* updates control group service tests
* addresses review feedback
* updates control group service handleError method to use router.currentURL rather that transition.intent.url
* adds changelog entry
* VAULT-8719 Support data array for alias clash error response so UI can understand error
* VAULT-8719 Changelog
* VAULT-8719 Update alias mount update logic
* VAULT-8719 Further restrict IsError()
Alexander Scheel