v0.11.0

What's in this release

This release gives background jobs a proper identity.

Act as a named technical user — without impersonation tricks

Queue workers and scheduled tasks that read vault secrets previously had a choice between the global command-line access switch or fragile tricks that swapped TYPO3's global user object. The vault now offers a scoped "run as" API: a job declares which technical backend user it acts as, the vault evaluates every access check with exactly the permissions that user would have in the backend (ownership, groups, admin), and the audit log records the named technical actor instead of an anonymous command-line operator.

The scope is strict: users that could not log in interactively — deleted, disabled, expired, or misplaced accounts — are rejected before the job runs a single line, and the identity always resets when the scope ends, even on errors. Nothing changes for web requests or for jobs that don't opt in.

Installation

composer require netresearch/nr-vault

Publication status

• TER: extensions.typo3.org/extension/nr_vault — 0.11.0 verified
• Packagist: packagist.org/packages/netresearch/nr-vault — 0.11.0 verified
• Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-vault/0.11/en-us/

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-vault-0.11.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-vault-0.11.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.