Skip to content

Lockstep 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 21:40
· 1 commit to main since this release
v0.3.0
3f6e336

Added

  • Secret-engine export and import: the Export & import tab (and lockstep export / lockstep import) exports a mount or prefix with its values to a JSON file (schema), leaving out paths and keys you choose, encrypted by default with AES-256-GCM and a one-time key shown once. Imports apply rules first: leave out paths and keys, then transforms (replace text, add a prefix or suffix, change case) on values, key names or paths, saved and loaded as JSON (schema). The preview shows what would change; the write merges with check-and-set and never deletes. Exports are audit-logged; LOCKSTEP_EXPORT_MODE (any / encrypted / off, chart value exportMode) controls them.
  • Compare against an export file: either side can be an opened export instead of a Vault: compare, show values, and copy from the file into a Vault (never into the file).
  • Build a profile by picking: after a comparison, Pick what to ignore… adds Ignore buttons to secrets (the secret, or its folder) and to differing keys (here, or everywhere). Picks show straight away, can be tried with Compare with these rules, and Save as profile… opens the editor with them filled in, as a new profile or added to the selected personal one.
  • Keystore password finder: when the inspector opens a locked PKCS#12/JKS/JCEKS keystore, it looks for the password in the keystore's top-level folder: keys and secrets named like passwords, ranked by closeness and shared name words (certs.p12 → CERT_PASSWORD), each tried on the server. Ones that open it are offered with Use; values are never returned. The certificate expiry scan uses the same ranking for keystores no sibling key opens.
  • Override values: set values yourself on one side or both (Override left / right / both in an expanded secret) instead of copying the other side's. Typed values can be text or JSON, can add new keys, and go through the same review and check-and-set write as copies; they can be combined with copies into the same secret. Override values are never stored or logged (the audit log names the keys) and can't go into a sync plan.
  • JWT sign-in: connect with Vault's JWT auth method by pasting a JWT (an ID token or a CI job's OIDC token), with an optional role and mount. The CLI takes it from LOCKSTEP_LEFT_JWT / --left-jwt-file with --left-auth jwt. Tokens from a JWT login are revoked on sign-out, like other logins.
  • Editor support for CLI reports: reports point to a published JSON Schema (https://getlockstep.cloud/schemas/lockstep-report-v1.json, also printed by lockstep schema). In VS Code with the YAML extension, and other editors using the YAML language server, action: values autocomplete with descriptions and typos are flagged while you edit.
  • The value inspector notes that JKS and JCEKS keystores use weak, format-mandated SHA-1 (and MD5/Triple DES) protection, and gives the keytool command to convert them to PKCS#12.

Changed

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.3.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.3.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.3.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.3.0 --help

Image digest: sha256:d52ebf79ff8eda09d275269a6a45ea71cf55beabc48b34590ce5b90d2620434e · chart digest: sha256:a56540e1d33c2af649666b31e424b0876a2849a50843b7e9992a8f0d669e5f70

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.3.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.3.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading