Repository navigation
SupiVPN v0.7.1
SupiVPN v0.7.1
Patch release for public Lambda SAML assertion-encryption key delivery.
Changes
Fix SAML assertion-encryption key delivery in public Lambda. Version 0.7.0
supported only file-based keys; public Lambda can now load its dedicated RSA
recipient key directly from AWS Secrets Manager during initialization.
Configuration
In the public controller JSON, replace assertion_encryption.private_key_file
with assertion_encryption.private_key_secret_arn, using the complete ARN.
Keep certificate_file pointing to the matching public certificate, delivered
for example in a Lambda layer. Configure exactly one private-key source.
Store the raw, multiline PKCS#1 or PKCS#8 RSA PEM as SecretString. Do not use a
JSON wrapper, base64 wrapper or SecretBinary. Grant only the public execution
role GetSecretValue on the specific secret and, if needed, Decrypt on its
customer-managed KMS key. Agent and recovery do not need these permissions.
The public function reads AWSCURRENT once at initialization and retains the
parsed key in memory, without a filesystem copy. Retrieval failure, invalid PEM
or certificate mismatch prevents startup; there is no plaintext/file/previous-
version fallback. Warm environments do not refresh automatically: coordinate
secret, certificate and IdP rotation with a new Lambda deployment and retire
old environments. Only one recipient key is supported per process.
See the encryption guide
for the full configuration, IAM requirements and rollout limitations.
Compatibility
File-based VM configuration, encryption modes, database schema, dependency
versions and release workflow permissions are unchanged from v0.7.0.
Verification
Local unit/race tests, vet, repository checks and both architectures' Lambda
builds passed. Tests use mocked Secrets Manager reads and synthetic recipient
keys, including signed-assertion decryption and optional/required enforcement.
Live deployment IAM/KMS and endpoint connectivity have not been exercised.
Hosted Checks and CodeQL passed on the release commit. Real Okta passed
signed/encrypted assertion acceptance in optional and required modes,
wrong-recipient-key rejection, plaintext policy enforcement and six browser
profile downloads. These browser scenarios cover the SAML and profile flows;
they do not perform a live AWS Secrets Manager read.
Main Checks ·
CodeQL ·
Real Okta.
Source commit: d7fc06bc9bf04529af1943d2f5269347bcdce8e8.
Packages
Commit: d7fc06bc9bf04529af1943d2f5269347bcdce8e8. License: AGPL-3.0-only.
Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.
Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.
GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.
Database schema: 10; compatible VM schemas: 7, 8, 9, 10.
Isolated Lambda required schema: 10.
Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.