We are stoked to announce the release of: barbican 12.0.0: OpenStack Secure Key Management This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/barbican Download the package from: https://tarballs.openstack.org/barbican/ Please report issues through: https://bugs.launchpad.net/barbican/+bugs For more details, please see below. Changes in barbican 11.0.0..12.0.0 ---------------------------------- c8d3c580 Fix RBAC and ACL access for managing secret containers ed8de959 Fix transport key policies b211dec0 Add ACL default to allow project read 9c31e868 Update TOX_CONSTRAINTS_FILE for stable/wallaby 0e11b9c4 Update .gitreview for stable/wallaby 0d98c189 Fix RBAC for transportkeys resource a0bc52c8 Implement secure RBAC for quota API 060ca2ee Implement secure RBAC for secretstore API f2456aa2 Optimize conditional statements 3be848d0 Implement secure RBAC for ACLs API 9a16e911 Implement secure RBAC for transport key API f02d81be Implement secure RBAC for secretmeta API 265908ec Implement secure RBAC for orders API e2c8e537 Implement secure RBAC for consumers API 0faf2246 Implement secure RBAC for containers API eade0cfc Implement secure RBAC for secrets API 1ca03610 Allow multiple token labels for PKCS#11 driver fa7722bf Fix PKCS#11 reinitialization after failure b5b350b4 Use system locks in pkcs11 library d6c01bba [goal] Deprecate the JSON formatted policy file 089f748a Switch to collections.abc.MutableMapping 80c2a960 Imported Translations from Zanata a1a21a7a Imported Translations from Zanata 7562dda2 [doc] Fix hmac/mkek generation commands cb64ae82 remove unicode from code 0fcfe426 Imported Translations from Zanata d9ec7dd6 Update doc8 version 75b19cad Update requirements for secure RBAC work 5734539d Imported Translations from Zanata 960c5ef5 [doc] Adjust documentation for Thales Luna 90cae5ae Imported Translations from Zanata dbda8ecb Fix hacking min version to 3.0.1 66603447 Use barbican.conf in barbican-manage c6d50003 Imported Translations from Zanata 69459a0e Use serial number or label for PKCS#11 tokens e3bb9572 Python 3.9: use base64.{decode,encode}bytes 85b52526 corrects typo in cp command 9dbeefb5 Update hacking for Python3 49de1a9d Bump py37 to py38 in tox.ini 4d017c4c [doc] Add documentation for Vault plugin a3acde74 Delete deprecated url of readme.rst ask.openstack.org is read-only and cannot raise a new question b0ec7edf Fix admin can not delete other user's secrets 6be43dff Imported Translations from Zanata f0bb09da Remove six.add_metaclass 0e041689 Add Python3 wallaby unit tests 30b07c2a Update master for stable/victoria 3fc072d9 Add a /healthcheck URL Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 2 +- README.rst | 3 - api-guide/source/conf.py | 1 - barbican/api/controllers/__init__.py | 22 ++- barbican/api/controllers/containers.py | 6 + barbican/api/controllers/secrets.py | 6 + barbican/cmd/barbican_manage.py | 198 ++++++++++++--------- barbican/cmd/keystone_listener.py | 1 + barbican/cmd/pkcs11_kek_rewrap.py | 1 + barbican/cmd/pkcs11_migrate_kek_signatures.py | 1 + barbican/cmd/status.py | 10 +- barbican/cmd/worker.py | 1 + barbican/common/config.py | 20 +++ barbican/common/policies/acls.py | 47 +++-- barbican/common/policies/consumers.py | 38 +++- barbican/common/policies/containers.py | 40 +++-- barbican/common/policies/orders.py | 21 +-- barbican/common/policies/quotas.py | 20 ++- barbican/common/policies/secretmeta.py | 17 +- barbican/common/policies/secrets.py | 40 +++-- barbican/common/policies/secretstores.py | 22 +-- barbican/common/policies/transportkeys.py | 18 +- barbican/common/policy.py | 8 + barbican/common/utils.py | 4 +- barbican/common/validators.py | 3 +- barbican/hacking/checks.py | 80 ++------- barbican/locale/en_GB/LC_MESSAGES/barbican.po | 24 ++- barbican/locale/zh_CN/LC_MESSAGES/barbican.po | 5 +- barbican/model/clean.py | 4 +- barbican/model/repositories.py | 26 +-- barbican/plugin/castellan_secret_store.py | 3 +- barbican/plugin/crypto/base.py | 5 +- barbican/plugin/crypto/p11_crypto.py | 85 +++++++-- barbican/plugin/crypto/pkcs11.py | 150 +++++++++++++++- barbican/plugin/crypto/simple_crypto.py | 3 +- barbican/plugin/dogtag.py | 1 + barbican/plugin/interface/certificate_manager.py | 7 +- barbican/plugin/interface/secret_store.py | 4 +- barbican/plugin/snakeoil_ca.py | 2 +- barbican/tasks/resources.py | 5 +- etc/barbican/barbican-api-paste.ini | 6 + .../api/v1/functional/test_containers.py | 1 + .../api/v1/functional/test_secretstores.py | 15 +- .../add-new-pkcs11-options-fc7bb625998e91fc.yaml | 14 ++ .../add-os-locking-ok-option-d0cfc5883355632a.yaml | 6 + ...tiple-pkcs11-token-labels-61b63e34b7c8cc1a.yaml | 14 ++ ...son-formatted-policy-file-b135aa7551e81066.yaml | 20 +++ .../notes/fix-story-2006978-aa5f2r9cqpfa0tm8.yaml | 6 + ...einitialize-pkcs11-object-4c0dc51c83288c21.yaml | 5 + .../secure-rbac-acl-policy-b534614ee7190108.yaml | 15 ++ ...cure-rbac-consumer-policy-5ff67280dc2a2c09.yaml | 9 + ...ure-rbac-container-policy-f7814e65dc2ab130.yaml | 13 ++ .../secure-rbac-order-policy-2068c64cb6830c6c.yaml | 15 ++ ...secure-rbac-quotas-policy-f725a2752d1ba3f4.yaml | 11 ++ ...re-rbac-secretmeta-policy-587cdad4e2ecee3a.yaml | 17 ++ ...ecure-rbac-secrets-policy-61d49439a043f865.yaml | 13 ++ ...e-rbac-secretstore-policy-ffa782850082add8.yaml | 9 + ...-rbac-transportkey-policy-3e904787694f8471.yaml | 10 ++ ...n-conf-in-barbican-manage-52035c1cdbfc5a26.yaml | 10 ++ releasenotes/source/conf.py | 14 +- releasenotes/source/index.rst | 1 + .../locale/en_GB/LC_MESSAGES/releasenotes.po | 84 ++++++++- releasenotes/source/victoria.rst | 6 + requirements.txt | 10 +- setup.cfg | 2 +- test-requirements.txt | 5 +- tox.ini | 29 ++- 80 files changed, 1306 insertions(+), 506 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 031dbcc7..61a1ed72 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ oslo.config>=6.4.0 # Apache-2.0 -oslo.context>=2.19.2 # Apache-2.0 +oslo.context>=2.22.0 # Apache-2.0 @@ -15,2 +15,2 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.log>=3.36.0 # Apache-2.0 -oslo.policy>=1.33.0 # Apache-2.0 +oslo.log>=4.3.0 # Apache-2.0 +oslo.policy>=3.6.0 # Apache-2.0 @@ -19 +19 @@ oslo.service!=1.28.1,>=1.24.0 # Apache-2.0 -oslo.upgradecheck>=0.1.1 # Apache-2.0 +oslo.upgradecheck>=1.3.0 # Apache-2.0 @@ -28 +28 @@ ldap3>=1.0.2 # LGPLv3 -keystonemiddleware>=4.17.0 # Apache-2.0 +keystonemiddleware>=5.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 4a70342e..1a40c4f8 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ -hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 +hacking>=3.0.1,<3.1.0 # Apache-2.0 @@ -10 +9,0 @@ coverage!=4.4,>=4.0 # Apache-2.0 -ddt>=1.0.1 # MIT @@ -24 +23 @@ bandit!=1.6.0,>=1.1.0 # Apache-2.0 -doc8>=0.6.0 # Apache-2.0 +doc8>=0.8.1 # Apache-2.0