Skip to content

SecretHub v1.0.0-rc14

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 16:57
v1.0.0-rc14
a462a58

SecretHub v1.0.0-rc14

Appbar version badge

The appbar now displays the current version in a rounded badge beside
the SecretHub logo. Development builds add a -dev suffix. Hovering or focusing
the badge shows the version, environment, Git ref, commit SHA, and UTC build time.

Build metadata is embedded at compilation and preserved in Core release archives,
Docker images, and Nix builds, so the tooltip works without Git or Mix at runtime.
Development builds use the actual compilation time instead of Nix's generic
SOURCE_DATE_EPOCH fallback.

Cached builds refresh this embedded metadata when the Git revision or build
inputs change, so development restarts and release builds show current provenance.

Artifacts

Core releases

  • secrethub_core-v1.0.0-rc14-linux-amd64.tar.gz
  • secrethub_core-v1.0.0-rc14-linux-arm64.tar.gz

Agent releases

  • secrethub_agent-v1.0.0-rc14-linux-amd64.tar.gz
  • secrethub_agent-v1.0.0-rc14-linux-arm64.tar.gz
  • secrethub_agent-v1.0.0-rc14-macos-amd64.tar.gz
  • secrethub_agent-v1.0.0-rc14-macos-arm64.tar.gz
  • secrethub_agent-v1.0.0-rc14-windows-amd64.zip
  • secrethub_agent-v1.0.0-rc14-freebsd-amd64.tar.gz

Docker images

  • ghcr.io/gsmlg-dev/secrethub/core:v1.0.0-rc14
  • ghcr.io/gsmlg-dev/secrethub/core-standalone:v1.0.0-rc14
  • ghcr.io/gsmlg-dev/secrethub/agent:v1.0.0-rc14

Upgrade and deployment requirements

This release defaults to the restricted single-operator profile. Read the
runtime contract
and operations guide
before upgrading; the rc10 deployment environment is insufficient.

Core now requires runtime-only DATABASE_URL, SECRET_KEY_BASE,
SECRET_HUB_CLUSTER_NODE_ID, AUDIT_HMAC_KEY, AUDIT_HMAC_KEY_ID,
and SECRET_HUB_MANAGEMENT_ORIGIN. Preserve historical audit signing
keys in AUDIT_HMAC_VERIFICATION_KEYS where required. Core and Agent
require RELEASE_DISTRIBUTION=none. Supply secrets through the documented
environment/file inputs; do not embed them in build arguments or images.

Management binds a private HTTP backend behind the existing Caddy mTLS
boundary, with an explicit canonical HTTPS origin. Machine enrollment
and Agent runtime use separate configured listeners. A published Docker
port alone does not make the loopback management backend reachable;
choose networking consistent with the runtime contract.

Agent requires its HTTPS Core URL, existing host-key path, persistent
state directory, Unix socket path, and Client Auth PKI bundle directory.
Mount these paths for the service UID and preserve identity across upgrades.

Legacy Vault shares (formats 1-3) require explicit authenticated recovery;
ordinary unseal accepts v4 shares. Back up and preserve existing data and
shares; do not reset or reinitialize an existing Vault. Read the
share format
and Vault recovery guide.
Inventory existing dynamic leases and rotation jobs before adopting the
default restricted profile, which disables dynamic engines, rotation, and
Human. The Human Vault subsystem has a separate explicit opt-in and
runtime requirements; see the
Human Vault guide.

Migrate the existing database explicitly and run release preflight as
the service UID before cutover. A successful build does not establish
production acceptance. The standalone embedded-PostgreSQL image and
platforms beyond Linux amd64 remain outside the documented qualification;
standalone still runs database migrations during startup.

Install SecretHub CLI

The secrethub_cli package is published to Hex.pm by this workflow.

mix local.hex --force
mix escript.install hex secrethub_cli 1.0.0-rc14
secrethub version

Validation

  • Test: 1,680 Elixir tests, 0 failures, 2 skipped, and 50 excluded; Go tests passed. E2E passed.
  • Eight focused build-metadata and packaging checks passed, including Git revision changes, changed build inputs without Git, and stable unchanged compilation caches.
  • Public verification covered all eight release archives, embedded production build metadata in both Core archives, all three amd64/arm64 image indexes and OCI provenance labels, and a fresh isolated Hex CLI installation.
  • Compile, formatting, Credo, and Caddy Go checks passed. Dialyzer still reports the same seven existing findings as rc13; no new findings were introduced. Human Vault coverage remains 71.46%, below the unchanged 90% advisory threshold.

Notes

Full changelog: v1.0.0-rc13...v1.0.0-rc14

Assets 10
Loading