Goldfish Versions Save

v0.6.0 is an update focused on deployment, security, and bug fixes.

The deployment has been simplified. Goldfish no longer requires a wrapping token at launch time, but will require the operator to provide one through the UI to bootstrap. Transit encryption is also now optional. See wiki for details

Memory lock (identical to vault's implementation) is on by default in this version. A couple of race conditions have been fixed as well.

Fixes:

• 2dd3d5d Fixed theoretical race conditions in server token renewal
• 9beb290 Fixed theoretical race conditions in request system
• 2735bce Added cache control middleware to prevent clients from caching responses (e.g. Safari)
• 82a546d Fixed a cosmetic bug that occurred when switching tabs too fast in user listing page

Major:

• 40f1946 Allow for provisioning of the vault wrapping token after launching in the UI
  • This means goldfish can launch without being bootstrapped!
• c1298b6 Transit encryption is now optional (will only be used if ServerTransitKey is set in config)
• 975e1be e7f97fe ecb5c66 LDAP group & user listing has been added
• 2633a57 84074bd Added mlock by default (just like vault)
• 7f12f9d Updated bulma to v0.5.0
  • Requests page should now display properly regardless of the max width of policy body

Minor:

• 457705a API has been versioned. Note this does not guarantee backwards compatibility.
• 9cf5dd6 Added an endpoint for goldfish server's health
• e671d1e Requests page unseal key entry is starred out on the client side
• e966bc3 Use highlightJS for token creator page role details
• 47e8640 Wrapper page can now handle unwrapping wrapped credentials

Deployment steps have not changed from v0.5.0. However, as of v0.5.0, you may want to update your goldfish approle to periodic (see wiki deployment instructions)

Fixes:

• e42ba32 Fixed a channel bug that prevented goldfish from renewing its own token (#124)
• 0643355 Fixed missing fmt error messages. Thanks to @Albibek #123
• 10a72d1 Fixed an LDAP and Userpass login bug #128
• 5494004 Fixed 404s in dependencies tool #132

Major:

• de8aa0f Updated bulma css to v0.4.3 - a couple of UI elements updated as a result
• 6792408 HCL syntax highlight has been switched to ruby, since that is syntactically closer
• 847d8d6 Allow for nested mount names (#115)
• 8ea4537 Unwrapping no longer requires user to be logged in

Minor:

• eb693f2 Listing tokens, userpass, and approle logic have been separated
• 7dc0b13 Vault API locked to v0.7.3 release
• 834dc9e Switched breadcrumb component to bulma native
• 968ea93 716ed9c Navbar updated to bulma native. Renew and Logout buttons added to navbar
• c03ad48 Secrets page is no longer purged on error as long as current path does not change
• 3f2d3e7 3377479 On launch, goldfish will assert whether it can renew itself (#124)
• d9821a5 Warning messages added to token creator page when conflicting options are selected

Deploying goldfish is even simpler - public folder is packed inside the binary. You only have to deploy ONE binary! See wiki for details

Major:

• bb7f94d Switched authentication from cookies to token based (#105)
  • All cookies and CSRF protection have been removed (no cookies => no CSRF)
• af9aaa8 Static assets folder public is built into the binary with go.rice (#112)
• 76014b0 Static assets are gzipped before being served. Most assets will see a 50%+ size reduction
• 1e5d578 Mount resource type added to dependencies tool (#99)

Minor:

• ac9e561 Pagination of tokens moved to client-side; theoretical race condition fixed (#97)
• 6e16899 Allow for empty values to valid keys when writing secrets
• 496acff Added capability to write secrets with special characters (e.g. &) (#109)
• 62395f7 Fixed a hardcoded display name in dropdown
• 878e219 Request body size limited to 32MB (like vault)
• edcc9de Extra vault verification when displaying transit page's default key
• 2b865fb Fixed a bug when trying to go up in directory while already at a mount's top level (#108)
• c459082 Added option to display secret as JSON (#110)
• 9b84fa1 Added proper autofocus to input fields in secrets page (#111)
• 0990f5d Fixed headers in secrets page (#114)

Deploying goldfish is now simpler - public folder is packed inside the binary. You only have to deploy ONE binary! See wiki for details

This is a release candidate. Nothing is guaranteed.

Major:

• bb7f94d Switched authentication from cookies to token based (#105)
  • All cookies have been removed, and thus all CSRF protection has been removed (no cookies => no CSRF)
• af9aaa8 Static assets folder public is built into the binary with go.rice (#112)
  • Deployments don't need to unzip anymore, just run the one binary!
• 76014b0 Static assets are gzipped before being served. Most assets will see a 50%+ size reduction

Minor:

• 1e5d578 Mount resource type added to dependencies tool (#99)
• ac9e561 Pagination of tokens moved to client-side; theoretical race condition fixed (#97)
• 6e16899 Allow for empty values to valid keys when writing secrets
• 496acff Added capability to write secrets with special characters (e.g. &) (#109)
• 62395f7 Fixed a hardcoded display name in dropdown
• 878e219 Request body size limited to 32MB (like vault)
• edcc9de Extra vault verification when displaying transit page's default key
• 2b865fb Fixed a bug when trying to go up in directory while already at a mount's top level (#108)
• c459082 Added option to display secret as JSON (#110)
• 9b84fa1 Added proper autofocus to input fields in secrets page (#111)
• 0990f5d Fixed headers in secrets page (#114)

Major:

• Resource dependency checker page added (#28)
  • Currently only resource type 'Policy' is supported
  • Can detect if any tokens, roles, userpass users, or approles that depend on provided policy
• Session button & dropdown implemented in navigation bar when user is logged in (#51)
• Secret deletion button added to secret list view (#71) (#69)
• Add auto http to https redirect key to config (strictly port 80 to port 443) (#84)

Minor:

• Govendor'd all go libraries for consistency (following vault's suit) (#73)
• Development environment and script updated (#79)
• Config parser strictly requires http or https scheme for vault address (#91) (#77)
• Warning signs added to nonsensical options in token creator page (#56)
• Select element is unsquished (#33)

Deployment instructions have changed

Check the wiki for details

Major:

• Config system has been changed to a file-based system. Now, launching goldfish in production requires just two parameters:

  • token, which used to be vault_token but has been renamed
  • config, which should be the path of a file that specifies everything cmd args used to specify.
  • Full example of a config file can be found here

• When launching goldfish in dev mode, it will also start a localhost dev vault instance. This means you no longer have to spin up your own separate vault instance before developing goldfish.

  • This also means launching a reproducible development environment no longer needs a bash script to feed data into vault.

Note: binaries have gotten much bigger because vault core itself is now packed in.

Note: this is possibly the last update before a config overhaul in #59

Major:

• New 'Wrapper' page, allowing arbitrary map write/read into a wrapping token. Thanks @yonniluu!
• Added tls_disable cmd arg, much like Vault's server config file. Allows goldfish to launch in production settings but without https

Minor:

• Removed github.io scripts, because they are third-party and I'm paranoid

Major:

• Transit tool's key is now modifiable by user
• Extra headers added for older browser versions' security
• Ability to add metadata in token creator page
• JSON and HCL syntax highlighting in policy change requests and payload previews

Minor:

• Removed deprecated node modules
• Token creator received quality of life updates
• Updated Bulma CSS to 0.4.2

Major:

• Policy searching is much smarter. Searching for secret/foo will return policies that contain path secret/*
• Added backend wrapper unit tests and acceptance tests, achieving 80% code coverage
• Added continuous integration for both backend and frontend, allowing for successful/reject compiles every commit

Minor:

• Added tls_skip_verify option to allow for self-signed vault instances
• Added version option to display version of goldfish for consistency and debugging purposes
• General speed and text improvements

New feature: terraform vault by requesting policies from a GitHub commit https://github.com/Caiyeon/goldfish/wiki/Features HTTP error response codes and messages revamped.