Open Stack

We are psyched to announce the release of:

barbican 10.1.0: OpenStack Secure Key Management

This release is part of the ussuri stable release series.

The source is available from:

    https://opendev.org/openstack/barbican

Download the package from:

    https://tarballs.openstack.org/barbican/

Please report issues through:

    https://bugs.launchpad.net/barbican/+bugs

For more details, please see below.

10.1.0
^^^^^^


New Features
************

* Added two options for the PKCS#11 Crypto Plugin:
  *[p11_crypto_plugin]/token_serial_number* and
  *[p11_crypto_plugin]/token_label*.  Both are optional and can be
  used instead of *[p11_crypto_plugin]/slot_id* to identify the Token
  to be used by the PKCS#11 plugin.  When either one of the new
  options is defined the plugin will search all slots on the PKCS#11
  device for a token that matches the given value.
  *token_serial_number* has the highest precendence and other values
  will be ignored when this value is set.  If *token_serial_number* is
  not set, then *token_label* has the next highest precedence and
  *slot_id* will be ignored. *slot_id* will be used when neither one
  of the new options is set.

* Added a new boolean option to the PKCS#11 backend:
  *os_locking_ok*. When set to True, the flag CKF_OS_LOCKING_OK will
  be passed to the C_Initialize function.  The new option defaults to
  False.

* A new "token_labels" option has been added to the PKCS#11 driver
  which supersedes the previous "token_label" option.  The new option
  is used to specify a list of tokens that can be used by Barbican.
  This is required for some HSM devices that use separate tokens for
  load balancing.  For most use cases the new option will just have a
  single token.  The old option is deprecated, but will still be used
  if present.

* The hsm subcommand for the barbican-manage command line tool no
  longer requires any parameters at run time.  If any value used by
  the PKCS#11 value is needed it will be taken from
  /etc/barbican/barbican.conf. You may continue to specify any values
  on the command line, and those will take precedence over the values
  specified in barbican.conf, so any existing scripts that use
  barbican-manage should continue to work as expected.


Deprecation Notes
*****************

* The "token_label" option in the PKCS#11 driver is deprecated.  Th
  new "token_labels" option should be used instead.  If present,
  "token_label" will still be used by appending it to "token_labels".


Bug Fixes
*********

* Fixed Story #2008649: Correctly reinitialize PKCS11 object after
  secondary failures.

* Fixed Story # 2007732: Migrations broken on MySQL 8.x.

Changes in barbican 10.0.0..10.1.0
----------------------------------

7cf483e2 Allow multiple token labels for PKCS#11 driver
475074a4 Fix PKCS#11 reinitialization after failure
87822c14 Use system locks in pkcs11 library
35f13677 Drop lower-constraints job to unblock gate
48ea3222 Use barbican.conf in barbican-manage
1e2a1271 Use serial number or label for PKCS#11 tokens
c34591cd Rebase alembic migrations
5214aecc Update TOX_CONSTRAINTS_FILE for stable/ussuri
0c891b74 Update .gitreview for stable/ussuri


Diffstat (except docs and test files)
-------------------------------------

.gitreview                                         |   1 +
.zuul.yaml                                         | 163 ++-----
barbican/cmd/barbican_manage.py                    | 198 ++++----
...20ccbe7fa_remove_transport_keys_column_from_.py |  30 --
...127569afa_create_secret_store_metadata_table.py |  50 --
...9933643_add_project_column_to_consumer_table.py |  46 --
...687_fill_project_id_to_secrets_where_missing.py |  73 ---
.../versions/1a0c2cdafb38_initial_version.py       |  28 --
...f79559e3_new_secret_and_container_acl_tables.py | 118 -----
.../1bc885808c76_add_project_id_to_secrets.py      |  36 --
.../1bece815014f_remove_projectsecret_table.py     |  30 --
...f328bfce0_fixing_composite_primary_keys_and_.py |  97 ----
...8af2dd_add_new_columns_type_meta_containerid.py |  37 --
...5565185_removing_redundant_fields_from_order.py |  35 --
...e0c5f_change_keystone_id_for_external_id_in_.py |  33 --
.../2843d6469f25_add_sub_status_info_for_orders.py |  36 --
...3f5371bde_dsa_in_container_type_modelbase_to.py |  49 --
.../2d21598e7e70_added_ca_related_tables.py        | 116 -----
...95d7_remove_size_limits_on_meta_table_values.py |  41 --
.../30dba269cc64_update_order_retry_tasks_table.py |  64 ---
.../39a96e67e990_add_missing_constraints.py        |  47 --
...f2e645cba_model_for_multiple_backend_support.py |  75 ---
.../versions/39cf2e645cba_ocata_rebase.py          | 530 +++++++++++++++++++++
...040bfe_add_owning_project_and_creator_to_cas.py |  38 --
...36a26b88af_add_order_barbican_metadata_table.py |  48 --
...6f6972_add_orders_plugin_metadata_table_and_.py |  48 --
...f4a69ac_added_secret_type_column_to_secrets_.py |  32 --
.../46b98cde536_add_project_quotas_table.py        |  58 ---
...9e523451_made_plugin_names_in_kek_datum_non_.py |  32 --
...3a72a_add_cas_column_to_project_quotas_table.py |  33 --
...457517a3_rename_acl_creator_only_to_project_.py |  45 --
.../795737bb3c3_change_tenants_to_projects.py      |  95 ----
.../versions/aa2cf96a1d5_add_orderretrytask.py     |  43 --
.../cd4106a1a0_add_cert_to_container_type.py       |  34 --
.../versions/d2780d5aa510_change_url_length.py     |  35 --
.../dce488646127_add_secret_user_metadata.py       |  52 --
.../alembic_migrations/versions/juno_initial.py    |  44 --
.../alembic_migrations/versions/kilo_release.py    |  31 --
barbican/plugin/crypto/p11_crypto.py               |  85 +++-
barbican/plugin/crypto/pkcs11.py                   | 150 +++++-
devstack/settings                                  |   2 +
.../api/v1/functional/test_consumers.py            |   2 +-
.../api/v1/functional/test_containers.py           |   4 +-
.../add-new-pkcs11-options-fc7bb625998e91fc.yaml   |  14 +
.../add-os-locking-ok-option-d0cfc5883355632a.yaml |   6 +
...tiple-pkcs11-token-labels-61b63e34b7c8cc1a.yaml |  14 +
...einitialize-pkcs11-object-4c0dc51c83288c21.yaml |   5 +
.../fixed-mysql-migrations-23221671ba17ea5e.yaml   |   4 +
...n-conf-in-barbican-manage-52035c1cdbfc5a26.yaml |  10 +
tox.ini                                            |   3 +-
60 files changed, 1210 insertions(+), 1950 deletions(-)