Current Series Release Notes¶

23.0.0-20¶

The SimpleCrypto plugin now supports Elliptic Curve (EC) asymmetric key generation in addition to RSA and DSA. Supported EC curves are SECP256R1 (P-256), SECP384R1 (P-384), and SECP521R1 (P-521), selected by the bit_length parameter in the API request (256, 384, or 521 respectively).

Added barbican-manage secret migrate, an operator subcommand that discovers secrets from the Barbican database and moves them onto another configured secret store by calling plugin.resources.rewrap_secret in-process. It can migrate every payload secret in a specified Keystone project, or every payload secret currently stored on a specified backend (all projects). Failures are recorded and the command continues; a non-zero exit status is returned if any secret fails. Payloads are never printed.

Asymmetric key generation requests that do not specify an algorithm parameter will now be rejected with an error. Previously, these requests defaulted to RSA. To avoid disruption, ensure all Order and key generation API calls include an explicit algorithm value (RSA, DSA, or EC).

The pkcs11-key-generation console script has been removed. This script was deprecated in the Mitaka release (2016) and has been broken since the PKCS#11 plugin constructor was updated to require hmac_mechanism and key_wrap_mechanism parameters. Use barbican-manage hsm gen_mkek and barbican-manage hsm gen_hmac instead.

Bug #2165913: The container-consumer and secret-consumer GET endpoints now verify that the requested consumer actually belongs to the container or secret named in the URL before returning it. Previously a consumer was looked up only by its own id while authorization was checked against the URL’s container/secret, allowing an authenticated user to read another tenant’s consumer metadata by pairing their own container/secret id with an arbitrary consumer id. A mismatch now returns 404.

Bug #2165908: The barbican-manage db command no longer prepends the current working directory to sys.path. Previously, a Python module placed in the invocation directory could shadow a module that barbican or one of its transitive dependencies imports, causing it to be imported and executed with the privileges of the operator running the command. Removing the sys.path insertion closes this module-shadowing path.

Fixed barbican-manage calling logging.setup() before CONF was populated from the configuration files, causing logging to be configured with default settings instead of the ones from barbican.conf. logging.setup() is now called after config parsing.

Secret-store migrate now records leftover plugin objects in secret_store_cleanup_tasks. The retry scheduler enqueues barbican-worker to delete them, with further retries on failure. Plugin payload bytes are never placed on the queue. Exhausted rows remain in ERROR status for operator inspection.