github.com/edgelesssys/marblerun

• Bump version to v1.9.1
• update SGX PSW version to 2.28.100.1-jammy1
• update SGX DCAP version to 1.25.100.1-jammy1
• dockerfiles: remove deprecated libsgx-launch package

Signed-off-by: Daniel Weiße [email protected]

What's Changed

🐛 Bug fixes

• sealing: re-seal KEK if seal mode changes by @daniel-weisse in #922
• charts: fix helm upgrade with default StorageClass for standalone version by @daniel-weisse in #926

🔧 Other changes

• marble-injector: add health probes by @daniel-weisse in #962
• logging: allow setting log level for http error messages using EDG_HTTP_ERROR_LOG_LEVEL by @daniel-weisse in #961
• coordinator: support AKS workload identity for HSM authentication by @daniel-weisse in #963

Full Changelog: v1.9.0...v1.9.1

What's Changed

🎁 New features

• cli: allow specifying custom qcnl config when installing MarbleRun by @daniel-weisse in #851
• security: update P256 elliptic keys to P384 by @daniel-weisse in #857
• recovery: enable clients to send encrypted recovery secrets by @daniel-weisse in #878
• Enable recovery using a subset of recovery keys by @daniel-weisse in #879
• coordinator: HSM seal key wrapping by @daniel-weisse in #885
• Enable FIPS 140 crypto for Go binaries by @thomasten in #897
• coordinator: allow updates to recovery secrets by @daniel-weisse in #893
• coordinator: build with symcrypt for FIPS crypto by @thomasten in #896
• coordinator: allow access to secrets of previous manifest cycle by @daniel-weisse in #899

🐛 Bug fixes

• api: ensure backwards compatbility on update apply by @daniel-weisse in #860

🔧 Other changes

• coordinator: seal with 32 byte key by @daniel-weisse in #850
• Merge enterprise code by @daniel-weisse in #877
• coordinator: reduce grpc logging noise by default by @daniel-weisse in #880
• cli: remove --wait because not waiting isn't supported anymore in helm v4 by @thomasten in #907

📖 Documentation

• markdown: fix redirects and outdated links by @daniel-weisse in #887
• docs: Azure HSM sealing integration by @daniel-weisse in #886
• docs: explain RecoveryThreshold config option by @daniel-weisse in #900
• docs: add note about changing recovery secrets by @daniel-weisse in #901
• docs: explain air-gapped recovery workflow by @daniel-weisse in #902
• docs: root key rotation by @daniel-weisse in #903

New Contributors

• @msanft made their first contribution in #890

Full Changelog: v1.8.0...v1.9.0

What's Changed

🛠 Breaking changes

• This PR introduces two breaking changes in the Go API:
  • ManifestUpdateAcknowledge now returns a list of users who have not acknowledged the update as well as the number of users that still need to send an acknowledgement for the update to be applied. This changes the function's return values from []string, error to []string, int, error.
  • ManifestUpdateApply now returns a list of a users who may acknowledge the update, as well as the number of missing acknowledgements for the update to be applied (in case of full manifest updates with more than 1 user). This changes the function's return values from error to []string, int, error.

🐛 Bug fixes

• cli: report accurate number of missing acknowledgements and users on update by @daniel-weisse in #808
• cli: accept both PKCS#8 and PKCS#1 private keys for recovery by @daniel-weisse in #798
• Update EdgelessRT dependency to fix OE_INVALID_PARAMETER "SGX endorsements are too large" errors during quote verification

Full Changelog: v1.7.0...v1.8.0

What's Changed

⚠️ Security

This release includes a security fix of high severity.
Please read the GHSA-w7wm-2425-7p2h advisory carefully to assess the impact on your deployment and plan the update accordingly.

Please be aware that updating a deployment to v1.7.0 will require manual recovery of the Coordinator.
Additionally, starting with v1.7.0, recovery will require access to the recovery private keys, matching the recovery public keys defined in the manifest, either as files or through a PKCS #11 compatible backend.

🎁 New features

• premain: enable JSON formatted logs if EDG_LOG_FORMAT=json by @daniel-weisse in #766
• cli: support for authenticating with private keys and certificates stored in PKCS #11 backend by @daniel-weisse in #771
• Support injection of Coordinator root and intermediate certificates into Marble environment by @daniel-weisse in #784
• coordinator: add debug logging by @daniel-weisse in #786

🐛 Bug fixes

• fix: JSON formatted logs for all Coordinator and marble-injector messages by @daniel-weisse in #764
• coordinator: fix equality checks for manifest properties by @daniel-weisse in #777
• Fix Marble verification with Coordinator root certificate by @thomasten in #782
• cli: fix certificate command errors when --insecure flag is set by @daniel-weisse in #790

🔧 Other changes

• coordinator: atomically replace the sealed data file on store commit by @thomasten in #762
• charts: allow configuration of Coordinator PVC size through helm values file by @Nabsku in #793

📖 Documentation

• docs: replace base64 command with openssl by @thomasten in #757
• docs: add backup workflow by @thomasten in #763

New Contributors

• @Nabsku made their first contribution in #793

Full Changelog: v1.6.0...v1.7.0

What's Changed

Additions

• Log TCB advisories if status is not UpToDate by @thomasten in #729
• Allow specifying accepted avisories for SWHardeningNeeded TCB status by @daniel-weisse in #733
• Let Coordinator serve monotonic counters to Marbles by @thomasten in #741
• Derive marble private secrets using marble type in addition to UUID by @daniel-weisse in #730
  • Previously, secrets were only derived based on a Marble's UUID, which would provide two different Marbles reporting the same UUID with the same secret. This release enforces two different Marbles will always receive different secrets, regardless of their UUID. If two Marbles require access to the same secret, the secret should be marked as Shared instead. To restore the behavior of MarbleRun previous to v1.6, set the DisableSecretBinding property of the Marble in the manifest to true.

Fixes

• coordinator: fix failing user verification when multiple client certs are provided by @thomasten in #738

Misc

• Change license from MPL-2.0 to BUSL-1.1 by @thomasten in #752

Full Changelog: v1.5.2...v1.6.0

What's Changed

• Fix OE_JSON_INFO_PARSE_ERROR during attestation verification with recent Intel collaterals

Full Changelog: v1.5.1...v1.5.2

What's Changed

Fixes

• coordinator: don't include OE header in signature for raw SGX quotes when calling /sign-quote endpoint by @daniel-weisse in #718
• cli: don't try to download era config if --insecure flag is set by @daniel-weisse in #721

Misc

• api: elaborate on nonce and quote by @thomasten in #683
• charts: use v2 api for probes by @thomasten in #693
• Update samples to Gramine v1.7 by @daniel-weisse in #599

Full Changelog: v1.5.0...v1.5.1