Skip to content

v0.4.0

Choose a tag to compare

View all tags
@jh-lee-cryptolab jh-lee-cryptolab released this 08 Jun 04:59
v0.4.0
d3653ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠ BREAKING CHANGES

No in-place upgrade from v0.3.x — the server must be reinstalled. Your FHE keys and encrypted indexes carry over unchanged; what breaks is the deployment and config format, and there is no automated config migrator.

  • Vault rewritten in Go as the single binary runevault (#61, #68). Python/Docker deployments cannot be upgraded in place — reinstall via install.sh. On-disk keys (<keys.path>/<key-id>/{Enc,Sec,Eval}Key.json) are read natively by envector-go-sdk, so no key migration is needed.
  • Configuration consolidated into runevault.conf (YAML) — the env-var fallback (VAULT_TLS_DISABLE, VAULT_TEAM_SECRET, VAULT_AUDIT_LOG, …) is removed with no migration helper. Tokens/roles remain file-based via tokens.roles_file / tokens.tokens_file indirection.
  • Admin transport moved from HTTP to a Unix domain socket — 127.0.0.1:8081 → /opt/rune-vault/admin.sock (mode 0600). Update any admin tooling.

What's New

Single Go binary runevault (#68)

  • Entire vault reimplemented in Go; no Python runtime, no pyenvector dependency
  • Built on github.com/CryptoLabInc/envector-go-sdk
  • Daemon lifecycle delegated to the OS service manager (systemd / launchd) instead of Docker

Production installer (install.sh)

  • --target local|aws|gcp|oci, SHA256SUMS checksum verification, systemd/launchd service registration, and an --uninstall flow
  • Dev installer scripts/install-dev.sh for local/CSP testing without GitHub releases
  • runevault group lets members run the CLI without sudo

Multi-CSP provisioning

  • Terraform-based provisioning for AWS, GCP, and OCI: preflight CLI/auth checks, cloud-init bootstrap, CA-cert SCP polling
  • CSP uninstall flow wrapping terraform destroy

New CLI subcommands

  • runevault status — daemon + admin-socket health
  • runevault logs — audit log tail
  • EnsureVault startup hook activates keys and ensures the index on first run

Release & distribution

  • Multi-platform release pipeline (linux/darwin × amd64/arm64) with a SHA256SUMS checksum manifest
  • Cloud VM images bumped to Ubuntu 24.04 LTS

Removed

  • Python sources, docker-compose.yml, Dockerfile, and the GHCR-published Docker image
  • pyenvector runtime dependency
  • Env-var configuration fallback (VAULT_TLS_DISABLE, VAULT_TEAM_SECRET, VAULT_AUDIT_LOG, …)

Upgrade Guide

  1. Reinstall via install.sh --target <local|aws|gcp|oci> — no in-place upgrade from the Python deployment.
  2. Reuse your existing keys: point keys.path in runevault.conf at your current vault-keys directory. Keys and encrypted indexes (1024d) are preserved — do not regenerate.
  3. Recreate configuration in runevault.conf (env vars are gone); reference your token/role files via tokens.roles_file / tokens.tokens_file.
  4. Update admin tooling to use the Unix domain socket instead of the old HTTP admin port.
  5. Verify with runevault status.

Full Changelog: v0.3.0...v0.4.0

Assets 7
Loading