Skip to content

v0.5.2

Latest
Latest

Choose a tag to compare

View all tags
@passbolt-github passbolt-github released this 28 Aug 15:28
v0.5.2
This tag was signed with the committer’s verified signature.
cedricherzog-passbolt
GPG key ID: 206F521134E0FAE5
Verified
Learn about vigilant mode.
5ad2e0f

Passbolt Go CLI 0.5.2 is a maintenance release that corrects the signature carried by shared v5 metadata written from the command line.

Shared metadata signatures

Shared v5 metadata is encrypted to the shared metadata key and decrypted through it by every user with access, so a client verifying the blob has no single user to verify against and pins verification to the metadata key's own fingerprint instead. The CLI signed that blob with the writing user's private key alone, which meant clients performing that check, such as the ansible lookup plugin, could not validate metadata the CLI had written.

Through Go SDK v0.8.3, shared metadata is now co-signed with both the user's private key and the metadata private key, matching what the browser extension does in encryptMetadataService. Every path that writes v5 metadata is covered: resource creation, resource update and share. Personal metadata is unchanged and still signed with the user's key alone, as there is no shared key to co-sign with.

The second signature is applied when metadata is written, so resources created by earlier versions keep their single signature until they are next updated.

Custom fields in KeePass exports

passbolt export keepass already wrote resource custom fields as protected KDBX entries, correlating names from the encrypted metadata with values from the encrypted secret by UUID. It read the value only when the server returned it as a string, so a custom field holding a number or a boolean exported with an empty value.

That correlation now goes through helper.ParseCustomFields from Go SDK v0.8.2, which normalises string, number, boolean and null values to strings and takes each name from whichever half carries it. Custom fields that previously exported empty now export their value.

API compatibility

The documentation now states the compatibility policy explicitly. The CLI is developed against the latest Passbolt API and tested for backward compatibility down to API 5.6.1. That floor will rise in future releases as the product evolves. A current CLI is backward compatible with supported older APIs, but forward compatibility is not guaranteed, and it is advised to keep it up to date.

Maintenance

This release also bundles the dependency and toolchain updates accumulated since 0.5.1, including the fix for crypto/tls CVE-2026-42505 and minor upgrades for golang.org/x/text, github.com/moby/go-archive and github.com/google/cel-go. Internally the codebase adopts go 1.25 syntax and builds on go 1.26.6. No command, flag or output format changes in this release, which makes the upgrade a drop-in for existing scripts.

Conclusion

Many thanks to everyone who contributed to making Passbolt better!

Changelog

Fixed

  • PB-53937 Sign shared v5 metadata with both the user key and the metadata key

Security

  • PB-53335 Fix crypto/tls CVE-2026-42505 (Medium)
  • PB-53334 Minor upgrade for golang.org/x/text (High)
  • PB-53929 Minor upgrade for github.com/moby/go-archive (High)
  • PB-53356 Minor upgrade for github.com/google/cel-go (Medium)

Maintenance

  • PB-53915 Use the SDK custom field helpers in the KeePass export
  • PB-53919 Bump go version to 1.26.6
  • PB-54017 Update dependencies in SDK and CLI
  • PB-54022 Use go 1.25 syntax
  • PB-53686 Document the minimum supported Passbolt API version
  • PB-54031 Add changelog files to SDK and CLI
  • PB-53914 Remove the community disclaimer from the README
  • PB-53788 Update devcontainer version in go CI
  • Renovate: Add renovate.json
  • Renovate: Adapt renovate config
Assets 13
Loading