Core-2.19.0

What's Changed

✨ New Features

• Record every signing operation as a signing record by @LukasNajman in #1547
• Introduce endpoint for listing signing records of a signing profile by @LukasNajman in #1582
• Add authentication methods and Basic credentials to TSP Profiles by @ivosh in #1592
• Expose callable RFC 3161 timestamping endpoints by @LukasNajman in #1594
• Add CERTIFICATE_EXTENSION custom-OID registry by @klaraf755 in #1646
• Add v3 certificate registration and route state changes through the state machine by @lubomirw in #1681
• Project v3 attribute field mappings into generated PKCS#10 requests by @klaraf755 in #1673
• Add RA-profile request-attribute configuration with value-source bindings by @ivosh in #1689
• Add Attributes v2 NG callback dispatch and registry resolution by @vyskocilm in #1679
• Validate uploaded (Mode B) CSRs against RA-profile request-attribute policy by @ivosh in #1694
• Issue certificates from a pre-registered request by @ivosh in #1720
• Shape request-attribute policy violations into native ACME/EST/SCEP/CMP errors by @ivosh in #1739

🔧 Enhancements

• Add managed TSP timestamping engine by @ivosh in #1542
• Support mTLS and connectors in waiting-for-approval status by @ivosh in #1561
• Add certificate state machine for lifecycle transitions by @lubomirw in #1605
• Add Signing Record dashboard statistics by @ivosh in #1619
• Add v3 authority-instance support (lifecycle and provider operations) by @lubomirw in #1614
• Add TSP authentication filter for timestamping endpoints by @ivosh in #1608
• Fix SCEP profile edit: keep secrets, toggle challenge password, clear stale Intune config by @lubomirw in #1662
• Add async certificate-status polling (due-time table + sweep) by @lubomirw in #1627
• Authorize resource-option listing used by attribute callbacks by @vyskocilm in #1671
• Add reference expander with per-object authorization by @vyskocilm in #1678
• Require a functional interface by category in connector validation by @lubomirw in #1729
• Fire CERTIFICATE_REGISTERED event on pre-registration completion by @lubomirw in #1796
• Add system OID listing endpoint by @lubomirw in #1826
• Resolve the request-attribute set over the CSR-attributes endpoint by @ivosh in #1831
• Add connector WebClient tuning configuration by @lubomirw in #1881
• Register system certificate extensions and resolve RDN code conflicts by @lubomirw in #1895
• Add auditor system role and harden write and role-assignment authorization by @lubomirw in #1915

🐛 Bug Fixes

• Keep event history when a follow-up notification fails by @klaraf755 in #1488
• Revalidate dependent certificates when CA trust mark changes by @LukasNajman in #1456
• Fix information leak in CMP error messages by @ivosh in #1711
• Allow Custom Attribute conditions on Certificate uploaded event triggers by @klaraf755 in #1733
• Forward certificate custom attributes to upload on user create/update by @klaraf755 in #1741
• Stop hourly error log when CBOM repository is unconfigured by @klaraf755 in #1734
• Fix 500 errors when deleting connectors with dependent records by @klaraf755 in #1747
• Keep extensible-list options in the connector attribute response by @lubomirw in #1759
• Merge duplicate search fields by identifier by @klaraf755 in #1755
• Fix evaluation of conditions for attributes with list content by @klaraf755 in #1760
• Preserve saved shared-secret when updating CMP Profile by @klaraf755 in #1761
• Fix discovery stuck in Processing status by @lubomirw in #1806
• Fix CMP revocation falsely rejecting as diverted-to-ISSUED by @klaraf755 in #1840
• Restore connector status to online on successful reconnect by @lubomirw in #1847
• Fix CMP/SCEP handling of pending validation and CRMF replies by @klaraf755 in #1839
• Accept platform RDN codes such as EMAIL in subject DNs by @lubomirw in #1868
• Fix duplicate notification profile version numbers on concurrent edits by @3keyroman in #1849
• Fix discovery ending with a warning on key upload by @lubomirw in #1880
• Persist metadata attribute protection level and protect stored content by @3keyroman in #1852
• Deliver SCEP-issued certificates to EC (non-RSA) client keys by @lubomirw in #1889
• Return a CMP rejection instead of crashing on protection mismatch by @lubomirw in #1888
• Allow deleting scheduled jobs with history by @klaraf755 in #1891
• Reject token profile deletion with dependent keys or signing profiles by @klaraf755 in #1893
• Adopt the surviving cryptographic key when a concurrent upload wins by @lubomirw in #1898
• Resolve OAuth2 username from the configured claim and normalize forwarded token claims by @3keyroman in #1905
• Reject key creation for disabled Token Profiles by @lubomirw in #1908
• Accept and authenticate SCEP renewal without a challenge password by @lubomirw in #1904
• Import discovered certificates per content group and report what was lost by @lubomirw in #1906
• Record CMP Profile UUID in certificate protocol associations by @klaraf755 in #1912
• Import discovered certificates when an action trigger fails by @lubomirw in #1913
• Attribute certificate history events to the correct user by @lubomirw in #1914
• Stop notification delivery failing without recipients by @lubomirw in #1917
• Harden notification delivery and recipient resolution by @lubomirw in #1920
• Propagate CMP revocation reason and accept reason-less requests by @lubomirw in #1926

⚡ Performance

• Skip redundant metadata definition rewrites (discovery import performance bottleneck) by @ivosh in #1824
• Keep connector round-trips out of the issuance transaction by @lubomirw in #1890

📋 Other

• Make Time Quality Monitor messaging optional in Core by @ivosh in #1563
• Rename packages to com.otilm and Czertainly classes to Platform prefix by @klaraf755 in #1575
• Add authority-provider adapter layer and version-dispatch factory by @lubomirw in #1607
• Finish ILM rebrand: Docker paths, broker names, persisted class-name migration by @klaraf755 in #1584
• Replace stale czertainly references with ilm in TSP test and prebuild script by @lubomirw in #1928

Full Changelog: 2.18.0...2.19.0