Skip to content

Version 1.11.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jul 19:44
· 29 commits to master since this release
v1.11.2
This tag was signed with the committer’s verified signature.
csstaub Cedric Staub
SSH Key Fingerprint: LSdBh9J2YY1pI9VUGZIWXTfdOKxECTehAu1/shlSmPM
Verified
Learn about vigilant mode.
1673906
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug fix release.

Bug Fixes

  • UNIX socket targets in client mode restored. The stricter --target validation added in v1.11.0 (#762) rejected unix:PATH targets in client mode, even though they had worked through v1.10.0 (and remained supported in server mode). Client mode now accepts both HOST:PORT and unix:PATH targets again, while the listen-only systemd:/launchd: schemes stay rejected at startup. This is useful for sidecar setups where two processes rendezvous on a shared socket instead of a localhost port, with mTLS running over the socket. Note that a unix:PATH target carries no hostname, so set --override-server-name to give hostname verification a name to check (unless --use-workload-api or --verify-spki-pin replaces hostname verification) (#799, thanks to @molchalih).

Other

  • Documentation fixes for --use-workload-api-timeout. The v1.11.1 release notes and the Linux man page now correctly document the --use-workload-api-timeout flag introduced in that release, instead of describing the initial SPIFFE Workload API fetch as bounded by the connect timeout (#800).

Contributors

molchalih
Assets 8
Loading
0 Join discussion