Skip to content

Releases

Lockstep 0.4.0

Lockstep 0.4.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 09:17
v0.4.0
530d92f

Added

  • Imports can delete what isn't in the file: Make the target match the file in the import panel (lockstep import --delete-missing) writes each imported secret with only the file's keys and soft-deletes secrets under the target's prefix that the file doesn't have (vault kv undelete restores them). Entries with "keep": true and no data protect a target secret: it's neither written nor deleted. The preview lists every removed key and deleted secret; deletes are checked against the version the preview saw and audit-logged with "action": "delete".
  • Proposal: connection probes, a design for checking that database, LDAP and HTTP credentials stored in Vault still work. Not implemented; written down for discussion.

Security

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.4.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.4.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.4.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.4.0 --help

Image digest: sha256:1f9155578e0ca1d6a8e4b1102ce2dcc2aee76dacc127b5a345ce609db6261766 · chart digest: sha256:9c91e12166786a962d990c222c602155a67a7054ed44756f18c5c414c81f5bc4

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.4.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.4.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading

Lockstep 0.3.0

Lockstep 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 21:40
v0.3.0
3f6e336

Added

  • Secret-engine export and import: the Export & import tab (and lockstep export / lockstep import) exports a mount or prefix with its values to a JSON file (schema), leaving out paths and keys you choose, encrypted by default with AES-256-GCM and a one-time key shown once. Imports apply rules first: leave out paths and keys, then transforms (replace text, add a prefix or suffix, change case) on values, key names or paths, saved and loaded as JSON (schema). The preview shows what would change; the write merges with check-and-set and never deletes. Exports are audit-logged; LOCKSTEP_EXPORT_MODE (any / encrypted / off, chart value exportMode) controls them.
  • Compare against an export file: either side can be an opened export instead of a Vault: compare, show values, and copy from the file into a Vault (never into the file).
  • Build a profile by picking: after a comparison, Pick what to ignore… adds Ignore buttons to secrets (the secret, or its folder) and to differing keys (here, or everywhere). Picks show straight away, can be tried with Compare with these rules, and Save as profile… opens the editor with them filled in, as a new profile or added to the selected personal one.
  • Keystore password finder: when the inspector opens a locked PKCS#12/JKS/JCEKS keystore, it looks for the password in the keystore's top-level folder: keys and secrets named like passwords, ranked by closeness and shared name words (certs.p12 → CERT_PASSWORD), each tried on the server. Ones that open it are offered with Use; values are never returned. The certificate expiry scan uses the same ranking for keystores no sibling key opens.
  • Override values: set values yourself on one side or both (Override left / right / both in an expanded secret) instead of copying the other side's. Typed values can be text or JSON, can add new keys, and go through the same review and check-and-set write as copies; they can be combined with copies into the same secret. Override values are never stored or logged (the audit log names the keys) and can't go into a sync plan.
  • JWT sign-in: connect with Vault's JWT auth method by pasting a JWT (an ID token or a CI job's OIDC token), with an optional role and mount. The CLI takes it from LOCKSTEP_LEFT_JWT / --left-jwt-file with --left-auth jwt. Tokens from a JWT login are revoked on sign-out, like other logins.
  • Editor support for CLI reports: reports point to a published JSON Schema (https://getlockstep.cloud/schemas/lockstep-report-v1.json, also printed by lockstep schema). In VS Code with the YAML extension, and other editors using the YAML language server, action: values autocomplete with descriptions and typos are flagged while you edit.
  • The value inspector notes that JKS and JCEKS keystores use weak, format-mandated SHA-1 (and MD5/Triple DES) protection, and gives the keytool command to convert them to PKCS#12.

Changed

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.3.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.3.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.3.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.3.0 --help

Image digest: sha256:d52ebf79ff8eda09d275269a6a45ea71cf55beabc48b34590ce5b90d2620434e · chart digest: sha256:a56540e1d33c2af649666b31e424b0876a2849a50843b7e9992a8f0d669e5f70

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.3.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.3.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Loading

Lockstep 0.2.0

Lockstep 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 11:43
v0.2.0
c9b9f08

Added

  • Command line: lockstep compare writes a YAML report of the differences, with no values. For each secret it gives both sides' versions, a Vault UI link and a vault kv get command. lockstep apply carries out the actions you set in the report: it asks before each key (or --yes, --dry-run), reads values fresh from the source, and skips any secret that changed since the report. It logs in like the vault CLI (VAULT_ADDR, VAULT_TOKEN, ~/.vault-token, per-side overrides, userpass/LDAP prompts) and returns diff-style exit codes for CI. It's in the Python package and the container image.

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.2.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.2.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.2.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.2.0 --help

Image digest: sha256:beac3c8fa9dc883b0ba4502dff30f91ef9145d867d5644e3e2937ab0a1dbd2f4 · chart digest: sha256:215253b37baaec96784bd4eeac2b1021c82cf5efde74f15f0e07e0bd6d7e59fd

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.2.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.2.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Loading

Lockstep 0.1.0

Lockstep 0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 09:49
v0.1.0
1a78404

First public release.

Added

  • Compare KV v2 secrets engines across two Vaults, or two mounts or prefixes in one Vault. Values are compared on the server and only shown on request; secrets you can't read show as No access, never as one-sided.
  • Copy keys or whole secrets in either direction after a review, with KV v2 check-and-set (no overwriting a target changed since the comparison), nothing ever deleted, and every write audit-logged without values.
  • Sync plans: save a reviewed set of copies as a signed file with no values (and a Markdown report); someone with write access checks and applies it later. If anything in it changed, nothing is written.
  • Comparison profiles: path mappings (services/*/prod/** ⇄ services/*/staging/**) and ignored keys or paths, shared by the server or kept per browser.
  • Value tools: base64, PEM/DER, X.509 certificates and chains (validated), PKCS#12, JKS/JCEKS, keys, CSRs, images, archives; side-by-side certificate comparison and downloads.
  • Certificate expiry dashboard across one or both mounts, including certificates inside keystores, with CSV export.
  • Last-updated metadata per secret and per key, never part of the comparison.
  • Sign-in with token, userpass, LDAP, OIDC (redirect flow) or the pod's Kubernetes service account.
  • Helm chart: hardened defaults, session key kept across upgrades, Ingress, NetworkPolicy, PodDisruptionBudget, Kubernetes auth, shared profiles; validated by a schema and tested in k3s.
  • Runs on Red Hat Hardened Images (distroless, non-root). Every change is scanned (CVEs, secrets, misconfigurations, base image signatures) and tested end to end in a browser.

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.1.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.1.0

Image digest: sha256:36d7f6c58148adec6fdb3c4b6253c8dce417218cac82b24979333b854792ddb3 · chart digest: sha256:68972ebc9f8f337d85f9b810c6863a57e46d36ebb994975c2e49024b784317c5

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.1.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.1.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Loading