jit 2.4.0

jit 2.4.0

Headline: CLI logins sealed in the vault

Cloud CLIs leave refresh tokens in plaintext files, and anyone who copies the file is you, often for weeks. 2.4.0 takes them off disk.

• jit wrap gcloud. The Google Cloud CLI's login is sealed in the vault and unsealed into a private folder only while each command runs. One wrap covers gcloud, bq, gsutil and the docker and git credential helpers, and kubectl on GKE goes through gcloud.
• jit wrap az. The same for the Azure CLI: its Entra ID refresh tokens and service-principal secrets.
  • The Azure SDKs, Terraform's azurerm and kubelogin -l azurecli all borrow the login through az, so they're covered too.
  • Two az commands running at once merge their changes instead of overwriting each other.
• AWS SSO and aws login sign-ins. jit migrate ~/.aws/config seals both kinds of sign-in. Every AWS tool keeps working, because each credential fetch runs AWS's own CLI on the unsealed login.
  • New: jit aws-sso login --profile <p> signs in straight into the vault (--remote over SSH), and jit aws-sso logout signs out.
• AWS credential cache in the service. Fetched AWS credentials are kept in the service's memory (never on disk, dropped when the vault locks), so repeated AWS calls are fast. Only the process that just read the sealed sign-in may fill the cache. Fills, clears and refused attempts are recorded in jit audit.
• kubelogin. jit migrate ~/.kube/config moves kubelogin's OIDC tokens to the macOS keychain. Microsoft's AKS kubelogin is detected and left untouched.
• Signing out really signs out. A sign-out removes the login from the vault, its history and its backups, so no restore or undo can bring it back.

Scan

• New findings: aws login sessions, kubelogin tokens, the Azure CLI's tokens and service-principal secrets, and the GKE auth plugin's cache, each with the command that fixes it.
• "Rotates itself": logins jit can't seal (e.g. a session no profile uses) are listed separately and not counted against your score, with advice on what to do if one was exposed. A tool_minted field (scan schema 0.26.0) marks them in the JSON.
• Directory scans (jit scan ~/.aws) now find these logins too, instead of reporting CLEAN.
• Clearer report:
  • the "try first" line runs the finding's own fix;
  • CLIs are counted once each;
  • long paths are cut in the middle so the folder stays readable.

Security fixes

• Closed a hole that could have let a process plant its own AWS credentials in front of your next aws command.
• Unlock prompts close themselves. An unanswered unlock prompt now closes after 2 minutes instead of staying open and blocking later ones.
• Azure tokens stay off disk if the screen locks during a long command.
• Config files keep their symlinks: ~/.aws/config and ~/.kube/config kept in a dotfiles repo stay links.

Smaller improvements

• Messages and help:
  • the wait message reads "approve the prompt on your Mac (Touch ID or password)", which fits Macs without Touch ID;
  • fresh-auth commands now print it before waiting instead of sitting silent;
  • help text, error messages and jit status wording are clearer for the new features.
• jit wrap list shows whether a store's login is sealed or on disk.
• Vault: jit vault list --format json marks sealed logins, and jit vault set refuses to overwrite one.
• jit vault rm of a backup cleans up the undo index.
• Earlier in this cycle:
  • JSON reports for the commands JitPass shows;
  • wraps protect native tools' credential files;
  • verify checks never print a secret;
  • a fix for one file's two sections being treated as migrated twice.

JitPass app (next release, bundling jit 2.4.0)

• Tools window:
  • gcloud (with its family) and Azure CLI can be protected with one click; Unwrap explains that it writes the login back.
  • The AWS row shows "signed in to AWS · dev and prod use it", with Sign Out of AWS… and Log In as in Terminal.
• Findings:
  • the new logins get a Protect button that runs jit's fix;
  • self-renewing logins move to a grey "Rotates itself" card, out of "Needs you" and the score.
• Doctor: a login back on disk offers Seal Again; a folder left by an interrupted run offers Restart Service.
• Vault window: a sealed login shows only Delete…, with a line naming what unseals it. No Reveal, Copy, Replace or History, since it's a packed login store, not a value.
• History: wording for AWS cache events, with refused attempts to plant credentials shown in red.
• Delete and Remove JitPass: say which tools or AWS profiles get signed out, and that a sealed login comes back from its latest copy.

Full changelog: v2.3.7...v2.4.0