Skip to content

Lockstep 0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 09:17
v0.4.0
530d92f

Added

  • Imports can delete what isn't in the file: Make the target match the file in the import panel (lockstep import --delete-missing) writes each imported secret with only the file's keys and soft-deletes secrets under the target's prefix that the file doesn't have (vault kv undelete restores them). Entries with "keep": true and no data protect a target secret: it's neither written nor deleted. The preview lists every removed key and deleted secret; deletes are checked against the version the preview saw and audit-logged with "action": "delete".
  • Proposal: connection probes, a design for checking that database, LDAP and HTTP credentials stored in Vault still work. Not implemented; written down for discussion.

Security

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.4.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.4.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.4.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.4.0 --help

Image digest: sha256:1f9155578e0ca1d6a8e4b1102ce2dcc2aee76dacc127b5a345ce609db6261766 · chart digest: sha256:9c91e12166786a962d990c222c602155a67a7054ed44756f18c5c414c81f5bc4

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.4.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.4.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading