2.4.0-rc.15

Breaking change — --encryption-key

At-rest encryption no longer silently derives from --jwt-secret.

A deployment using an asymmetric JWT algorithm (RS*/ES*) with no --jwt-secret will refuse to start until --encryption-key is set. HMAC deployments (HS256/HS384/HS512) are unaffected — the key still falls back to --jwt-secret.

./authorizer \
  --jwt-type=RS256 \
  --jwt-private-key="$(cat jwt-private.pem)" \
  --jwt-public-key="$(cat jwt-public.pem)" \
  --encryption-key="$(openssl rand -hex 32)"

This key protects TOTP shared secrets (AES-GCM) and the OTP digests used by email/SMS verification, signup and password reset. The previous fallback produced a publicly computable constant on asymmetric deployments, which left those values effectively unprotected.

Rotating --encryption-key locks out every user with an enrolled TOTP authenticator until they re-enrol. Where it is unset and falls back to --jwt-secret, rotating the JWT secret rotates the at-rest key too.

See Server Configuration and the security notes.

---

What's Changed

• fix(e2e): use OIDC userinfo profile for linkedin spec by @lakhansamani in #741
• ci(release): push images to Docker Hub alongside Quay by @lakhansamani in #743
• security: at-rest key, storage not-found contract, and agent identity in FGA by @lakhansamani in #742

Full Changelog: 2.4.0-rc.14...2.4.0-rc.15