Current Series Release Notes¶

23.0.0-14¶

The SimpleCrypto plugin now supports Elliptic Curve (EC) asymmetric key generation in addition to RSA and DSA. Supported EC curves are SECP256R1 (P-256), SECP384R1 (P-384), and SECP521R1 (P-521), selected by the bit_length parameter in the API request (256, 384, or 521 respectively).

Added microversion 1.3 with PUT /v1/secrets/{secret-id}/secret-store/{secret-store-id} to migrate an existing secret onto another configured secret store without changing the secret UUID. The request body is empty. Project admins may target any store; project members may migrate only to the project preferred store. Multiple secret store backends must be enabled. Secret metadata GET/list always return computed secret_store_id / secret_store_ref on microversion 1.3+ (null when multiple backends are disabled or the secret has no payload). A live payload that cannot be mapped to exactly one catalogue store returns HTTP 500. GET /v1/secret-stores (and get-by-id / preferred / global-default) also return secret_store_id so clients need not parse secret_store_ref. See blueprint admin-migrate-secret-store.

Asymmetric key generation requests that do not specify an algorithm parameter will now be rejected with an error. Previously, these requests defaulted to RSA. To avoid disruption, ensure all Order and key generation API calls include an explicit algorithm value (RSA, DSA, or EC).

Bug #2165913: The container-consumer and secret-consumer GET endpoints now verify that the requested consumer actually belongs to the container or secret named in the URL before returning it. Previously a consumer was looked up only by its own id while authorization was checked against the URL’s container/secret, allowing an authenticated user to read another tenant’s consumer metadata by pairing their own container/secret id with an arbitrary consumer id. A mismatch now returns 404.

Bug #2165908: The barbican-manage db command no longer prepends the current working directory to sys.path. Previously, a Python module placed in the invocation directory could shadow a module that barbican or one of its transitive dependencies imports, causing it to be imported and executed with the privileges of the operator running the command. Removing the sys.path insertion closes this module-shadowing path.

Fixed barbican-manage calling logging.setup() before CONF was populated from the configuration files, causing logging to be configured with default settings instead of the ones from barbican.conf. logging.setup() is now called after config parsing.