vaultrs

This new release includes official support for OpenBao and covers a lot of new endpoints. Thanks to everyone that contributed!

Breaking

• This release follows the change of TLS provider of reqwest 0.13. aws-lc-rs is the default crypto provider and no longer ring. We already use rustls and not native-tls by default so this part doesn't change. A new feature rustls-no-provider can be used if you want to use any other provider.
• The behavior when using VAULT_SKIP_VERIFY was wrong because it was inverted. This release respects the expected semantics.
• Some endpoints have been tweaked if they didn't match the OpenBao/Vault current output
• Bump reqwest from 0.12 to 0.13, it’s breaking change, as it's a public dependency.

What's Changed

• bump tested vault version by @stormshield-gt in #129
• Add support fo vault issuer by @stormshield-gt in #118
• Add transit BYOK support by @avandecreme in #128
• add expiration to SignCertificateResponse by @stormshield-gt in #135
• fix: Add missing ExportKeyType enum values by @gonzalezzfelipe in #133
• Add support for cubbyhole by @isitreallyalive in #131
• fix: add optional role member to LookupTokenResponse by @stormshield-fabs in #136
• fix new clippy lints by @stormshield-gt in #140
• Make token lookup issue time optional by @stormshield-gt in #142
• workaround for #137 in /sys/health by @xMAC94x in #138
• Add list issuer by @stormshield-gt in #143
• transit: add associated_data to encrypt and decrypt requests by @avandecreme in #149
• Make sys/health response backward compatible by @avandecreme in #151
• fix TTL type of create pki role by @stormshield-gt in #147
• fix latest clippy by @stormshield-gt in #162
• Update default_verify() to correctly respect the VAULT_SKIP_VERIFY env var by @randombugfixes1234 in #160
• Remove aws-sdk-iam dependency from vaultrs-login by @goffrie in #165
• Merge pull request #165 from goffrie/patch-1 by @stormshield-gt in #167
• apply cargo build optimisation advise by @stormshield-gt in #168
• Move to workspace dependencies by @stormshield-gt in #114
• move vaultrs into its own folder by @stormshield-gt in #169
• Bump dependencies by @stormshield-gt in #170
• Remove some dev dependencies by @stormshield-gt in #166
• remove default features from all dependencies by @stormshield-gt in #173
• Check in Cargo.lock by @stormshield-gt in #174
• add dependabot by @stormshield-gt in #175
• Add cargo deny by @stormshield-gt in #176
• remove serial_test dependency by @stormshield-gt in #178
• Make the test builder also generic by @stormshield-gt in #179
• add test for openbao by @stormshield-gt in #181
• use aws-lc-rs for rsa operation by @stormshield-gt in #183
• bump-reqwest by @stormshield-gt in #186
• Complete pki generate root endpoint by @stormshield-gt in #157
• feat: add optional proxy param to build reqwest client. by @stormshield-gt in #188
• Bumps vaultrs to 0.8.0 by @stormshield-gt in #189

New Contributors

• @gonzalezzfelipe made their first contribution in #133
• @isitreallyalive made their first contribution in #131
• @stormshield-fabs made their first contribution in #136
• @xMAC94x made their first contribution in #138
• @randombugfixes1234 made their first contribution in #160
• @goffrie made their first contribution in #165

Full Changelog: v0.7.4...v0.8.0

What's Changed

• Switch to testcontainers by @stormshield-gt in #107
• Improve logging message levels to reduce verbosity by @orf in #106
• Fix: remove manually drop from test by @stormshield-gt in #115
• Cleanup testsuite by @stormshield-gt in #113
• Fix taplo job by @stormshield-gt in #124
• add disable sys auth by @stormshield-gt in #119
• add sys remount endpoint by @stormshield-gt in #116
• Add missing parameters to the generate intermediate request by @stormshield-gt in #102

New Contributors

• @orf made their first contribution in #106

Full Changelog: v0.7.3...v0.7.4

Added

• Add disable sys auth
• Add sys remount endpoint
• Add missing parameters to generate intermediate request

Changed

• The internal testsuite use now testcontainers instead of dockertest
• Improve the testing speed by regrouping integration tests
• Reduce log verbosity on some trace

Fixed

• Fix the readme example compilation

What's Changed

• prevent leaking unseal key by @stormshield-gt in #85
• bump reqwest to 0.12 by @stormshield-gt in #89
• Re-export identity to allow users to use a different version of reqwest by @avandecreme in #88
• add /sys/tools/random by @stormshield-gt in #81
• Improve logging by @stormshield-gt in #87
• Add cert option from vault 1.11 by @stormshield-gt in #96
• complete read entity response by @stormshield-gt in #95
• add cert auth configuration by @stormshield-gt in #97
• Complete the mount endpoint by @stormshield-gt in #90
• #93 Add support for asymmetric keys to vault transit engine by @MattDavis00 in #100
• Prepare release 0.7.3 by @stormshield-gt in #110

New Contributors

• @MattDavis00 made their first contribution in #100

Full Changelog: v0.7.2...v0.7.3

Added

• Add sys tool random
• Add cert auth configuration
• Add disable mount endpoint
• Add support for reading asymmetric keys from the /transit/keys route

Changed

• bump rewest to 0.12 (which also bump rustls to 0.23)
• re-export identity to allow different version of reqwest
• improve logging
• update read certificate to vault 1.11.0

Fixed

• do not log unseal key
• fix formatting
• Fixed links in changelog

Added

• Support for initial vault setup

Fixed

• Bug to fail by compiling with disabled default features and native-tls

What's Changed

• KV2: add support for custom metadata by @nicoulaj in #47
• Fix/rustsec 2023 0052 by @Haennetz in #74
• Bugfix/derivation key by @ValentinColin in #71
• Add the expiration field to GenerateCertificateResponse. by @grahambinns in #59
• Update README.md by @matteosister in #53
• Add support for client TLS by @outscale-fba in #62
• Make X-Vault-Request a default header by @AdrienneCohea in #67
• Fix URL-Encoding in Path applied twice by @darkecho731 in #56
• native tls vendored feature by @cobbinma in #54
• feat: AWS Secret Engine by @PierreBeucher in #58
• Add support for login via certificate by @avandecreme in #76
• use empty response for oidc set role by @Haennetz in #78
• Add identity secrets engine: Entity, EntityAlias, Group and GroupAlias by @stormshield-gt in #77
• Feature/prepare release 0.7.1 by @Haennetz in #82

New Contributors

• @nicoulaj made their first contribution in #47
• @Haennetz made their first contribution in #74
• @ValentinColin made their first contribution in #71
• @grahambinns made their first contribution in #59
• @matteosister made their first contribution in #53
• @outscale-fba made their first contribution in #62
• @AdrienneCohea made their first contribution in #67
• @darkecho731 made their first contribution in #56
• @cobbinma made their first contribution in #54
• @avandecreme made their first contribution in #76
• @stormshield-gt made their first contribution in #77

Full Changelog: v0.7.0...v0.7.1

Added

• The X-Vault-Request Header to each request.
• Support for Client Certificate.
• Support custom metadata in KV2 secret engine.
• Support expiration field to GenerateCertificateResponse.
• Support for AWS secret engine.
• Partial support for identity secret engine (entity, entity_alias, group and group_alias).

Fixed

• Issue with the native-tls feature where it doesn't compile.
• Issue where a URL was encoded twice what leads to wrong paths.
• Wrong name for derived filed in CreateKeyRequest.
• RUSTSEC-2023-0052 by bumping aws modules to the latest version.

Added

• AWS auth method
• Support for transit secret engine
• Implements Key Value v1 APIs

Changed

• Allows choosing between rustls and native-tls
• Adds missing revocation_time when reading certificates
• Adds missing namespace header
• Removes printing of AWS login request

Added

• feat: allow timeout setting on client builder
• feat: add support for cas option for kv2 backend

Changed

• fix: makes rustls-tls usage consistent across dependencies
• fix: change login method from GET to POST
• fix: allow building VaultClientSettings without address
• fix: updates TLS verification according to VAULT_SKIP_VERIFY
• chore: upgrades dependencies
• chore: bumps supported Vault version to v1.10.3

Added

• Support for kubernetes authentication engine
• Support for sys/unseal

Fixed

• Makes version field optional in secrets

Added

• Support for database secrets engine
• Tracing using the tracing crate

Changed

• Internal structure of tests

Removed

• Dependency on openssl

Changed

• Bumps rustify to v0.4.4

Fixed

• Fixes bug where server status returned incorrectly with network errors

Added

• Support for working with policies

Changed

• Pins tests to Vault v1.8.2
• Adds Client trait to allow making mock clients
• Uses dockertest over testcontainers for running tests
• Refactors test code to separate vaultrs-test crate
• Refactors login code to separate vaultrs-login crate

Removed

• Removes token file methods from client

Added

• Support for AppRole auth method
• Support for Userpass auth method
• Support for sealing server
• Support for getting server status
• Support for using CA certificates in requests
• Generic login method for clients to easily obtain tokens
• Methods for listing available auth methods on a server
• Additional support for automating OIDC logins

Added

• Support for interacting with token backend
• Support for OIDC auth method
• Support for SSH secrets engine

Changed

• Applied changes from latest version of rustify
• Converted all functions to be async rather than synchronous

Fixed

• Incorrect doc comments in library file

Added

• Initial release