luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity
open-vault/internalshared
History
Scott Miller 25960fd034
Add the ability to unseal using recovery keys via an explicit seal option. (#18683) 
* wip

* wip

* Got it 'working', but not happy about cleanliness yet

* Switch to a dedicated defaultSeal with recovery keys

This is simpler than trying to hijack SealAccess as before.  Instead, if the operator
has requested recovery unseal mode (via a flag in the seal stanza), we new up a shamir
seal with the recovery unseal key path instead of the auto seal.  Then everything proceeds
as if you had a shamir seal to begin with.

* Handle recovery rekeying

* changelog

* Revert go.mod redirect

* revert multi-blob info

* Dumb nil unmarshal target

* More comments

* Update vault/seal.go

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Update changelog/18683.txt

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* pr feedback

* Fix recovery rekey, which needs to fetch root keys and restore them under the new recovery split

* Better comment on recovery seal during adjustSealMigration

* Make it possible to migrate from an auto-seal in recovery mode to shamir

* Fix sealMigrated to account for a recovery seal

* comments

* Update changelog/18683.txt

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Address PR feedback

* Refactor duplicated migration code into helpers, using UnsealRecoveryKey/RecoveryKey where appropriate

* Don't shortcut the reast of seal migration

* get rid of redundant transit server cleanup

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
 		2023-01-24 14:57:56 -06:00
..
configutil Add the ability to unseal using recovery keys via an explicit seal option. (#18683) 2023-01-24 14:57:56 -06:00
listenerutil update gofumpt to 0.3.1 and reformat the repo (#17055) 2022-09-07 17:31:20 -07:00
README.md Revert "Migrate internalshared out (#9727)" (#10141) 2020-10-13 16:38:21 -07:00

README.md

HashiCorp-internal libs

Do not use these unless you know what you're doing.

These libraries are used by other HashiCorp software to reduce code duplication and increase consistency. They are not libraries needed by Vault plugins -- those are in the sdk/ module.

There are no compatibility guarantees. Things in here may change or move or disappear at any time.

If you are a Vault plugin author and think you need a library in here in your plugin, please open an issue for discussion.