v0.37.0

Highlights

• A service account can administer modules. A tenant administrator can grant a service account the new Manage modules right, letting it activate, renew and configure industry modules without a human sign-in. saconsole login --client-id <id> (secret from SACONSOLE_CLIENT_SECRET) signs it in, which makes an unattended setup possible. The module interface (ABI) is now 1.4.
• The search indexer is safe with two instances. Each document is claimed before it is indexed, so two app instances no longer discard each other's work. A failure now names the document and tenant it affected.
• The security appendix of the manual describes what actually shipped, and the manual now distinguishes the two device passwords: one for files, calendars and contacts, and one for mail and notes. A lost device needs both revoked.

⚠️ Upgrade note: a capability is withdrawn

Every encryption mode that delivers envelopes now requires the Encryption Module: Strict, StrictRehearsal, SealedDeliveryPermissive and SealedDeliveryStrict. Until this release, Strict and StrictRehearsal could run with the Encryption Service alone, taking readers' certificates from the Service's own registry. That registry is retired: it held one certificate per person, replaced it on every registration, and could not tell a stale certificate from a current one.

An installation that runs Strict or StrictRehearsal without the Encryption Module refuses to start on this version, and says why. Before upgrading, either install and activate the Encryption Module for those tenants (and enrol their readers' certificates through it), or set their mode to Storage, which keeps encryption at rest with the Service alone. Certificates kept in the Service's old registry are not migrated and not deleted; the Encryption Service manual describes how to read them and enrol them through the Module.

Storage is unaffected.

Encryption Service compatibility

This version no longer calls the Encryption Service's certificate registry, so it works both with the current Encryption Service image and with the next one, which removes the registry. Upgrade this core before the Encryption Service.

Every change in this release

• The generated notes are structurally empty on the mirror
• The documented verify names an image tag that does not exist
• A service account may administer modules (ABI 1.4, ADR 0870)
• The project's working guide is compacted to rules plus pointers, its rationale moved into design records
• Manual: the security appendix describes the product that shipped; two device passwords (#1592)
• SearchIndexWorker claims each document before syncing it (#1587)
• Release notes come from the private PRs, and refuse what must not be published (#1589, ADR 0889)
• Manual §20.4: name what recently closed (salvaged from #1593)
• Retire the certificate registry; every enveloping mode needs the Module (ADR 0890)
• The contributor guide notes that the hosting service's own merge check ignores the design-record index's merge strategy

Full Changelog: v0.36.0...v0.37.0