mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-26 17:11:13 +02:00
Code Issues Projects Releases Wiki Activity

changelog++

Browse Source
This commit is contained in:
Jeff Mitchell 2016-02-25 08:55:23 -05:00
parent 6018c88708
commit 0cadb6cefc
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
CHANGELOG.md
View File

@ -2,11 +2,16 @@
DEPRECATIONS/BREAKING CHANGES: DEPRECATIONS/BREAKING CHANGES:
* secret/pki: RSA keys less than 2048 bits are no longer supported. 1024-bit * RSA keys less than 2048 bits are no longer supported in the PKI backend.
keys are considered unsafe and are disallowed in the Internet PKI. The `pki` 1024-bit keys are considered unsafe and are disallowed in the Internet PKI.
backend has enforced SHA256 hashes in signatures from the beginning, and The `pki` backend has enforced SHA256 hashes in signatures from the
software that can handle these hashes should be able to handle larger key beginning, and software that can handle these hashes should be able to
sizes. [GH-1095] handle larger key sizes. [GH-1095]
* The PKI backend now does not automatically delete expired certificates,
including from the CRL. Doing so could lead to a situation where a time
mismatch between the Vault server and clients could result in a certificate
that would not be considered expired by a client being removed from the CRL.
[GH-1127]
IMPROVEMENTS: IMPROVEMENTS:
@ -16,8 +21,10 @@ IMPROVEMENTS:
nonce [GH-1054] nonce [GH-1054]
* credential/cert: Don't require root/sudo tokens for the `certs/` and `crls/` * credential/cert: Don't require root/sudo tokens for the `certs/` and `crls/`
paths; use normal ACL behavior instead [GH-468] paths; use normal ACL behavior instead [GH-468]
* credential/github: Github backend will check the validity of original token * credential/github: The validity of the token used for login will be checked
during renewal time [GH-1047] at renewal time [GH-1047]
* credential/github: The `config` endpoint no longer requires a root token;
normal ACL path matching applies
* deps: Use the standardized Go 1.6 vendoring system * deps: Use the standardized Go 1.6 vendoring system
* secret/aws: Inform users of AWS-imposed policy restrictions around STS * secret/aws: Inform users of AWS-imposed policy restrictions around STS
tokens if they attempt to use an invalid policy [GH-1113] tokens if they attempt to use an invalid policy [GH-1113]