From 5e63c67a7a50a8e3163bd66a4bb4d365658a8d45 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 05:56:16 +0000 Subject: [PATCH] chore(dev): release 0.2.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 84 +++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 CHANGELOG.md diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 466df71..2be9c43 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.1.0" + ".": "0.2.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..7c89daf --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,84 @@ +# Changelog + +## [0.2.0](https://github.com/otspi/open-eidas/compare/v0.1.0...v0.2.0) (2026-10-13) + + +### Features + +* **actions:** actions d'opérateur signées, vérifiées et exécutées par ca-server ([#17](https://github.com/otspi/open-eidas/issues/17)) ([3c28d73](https://github.com/otspi/open-eidas/commit/3c28d73a7b5823ad5fbcd53921efc65bff2357a5)) +* **actions:** actions signées sur le registre des opérateurs (invitation, confirmation, révocation, rôle) ([#20](https://github.com/otspi/open-eidas/issues/20)) ([255f06c](https://github.com/otspi/open-eidas/commit/255f06c9376d45eb53316a0fff55079c96f1e612)) +* **actions:** amorçage du premier administrateur (ca-server operators bootstrap-admin) ([#18](https://github.com/otspi/open-eidas/issues/18)) ([2c7d29f](https://github.com/otspi/open-eidas/commit/2c7d29ff43a1bd16a32991c58af32d440b375348)) +* **actions:** audit de la chaîne du registre des opérateurs (operators audit) ([#25](https://github.com/otspi/open-eidas/issues/25)) ([e78b606](https://github.com/otspi/open-eidas/commit/e78b60659e6169e1b11f15356644707ea6bf07cb)) +* **actions:** double contrôle des actions sensibles (quorum de signatures) ([#22](https://github.com/otspi/open-eidas/issues/22)) ([127ceb8](https://github.com/otspi/open-eidas/commit/127ceb85d47cbee2ecd306c18ec5a5875836a01f)) +* **actions:** récupération de l'administrateur (recover-admin) et garde du quorum impossible ([#24](https://github.com/otspi/open-eidas/issues/24)) ([b30e8a1](https://github.com/otspi/open-eidas/commit/b30e8a1aa9d089a4e41493ff42c57b8806520d77)) +* **actions:** rejeu du journal, blocage du registre divergent et operators reconcile ([#26](https://github.com/otspi/open-eidas/issues/26)) ([1f58888](https://github.com/otspi/open-eidas/commit/1f588885d778ee3fa78bc35e1864dd3c613b6fb9)) +* **actions:** révocation de certificat par action signée (revoke_certificate) ([#21](https://github.com/otspi/open-eidas/issues/21)) ([603cf44](https://github.com/otspi/open-eidas/commit/603cf447e615ec2b9e2d441fcb79ee49e5deaf8c)) +* **ca-server:** lien interne (routes, mTLS) et enregistrement de clé des opérateurs ([#19](https://github.com/otspi/open-eidas/issues/19)) ([fb1ea95](https://github.com/otspi/open-eidas/commit/fb1ea95e3584430d54e9dc2464f9279df320f66e)) +* **ca-server:** réplication du journal d'audit sur un stockage S3-compatible ([#49](https://github.com/otspi/open-eidas/issues/49)) ([b72fde1](https://github.com/otspi/open-eidas/commit/b72fde179a887d27362a35299b3bf0f667d1a161)) +* **ca-server:** revue a posteriori des décisions de la voie de secours (R-1) ([#82](https://github.com/otspi/open-eidas/issues/82)) ([3e7c952](https://github.com/otspi/open-eidas/commit/3e7c9523b5282e455f4d65781dab59e48e0806bb)) +* **ca:** dépôt public des certificats + marquage STAGING du staging ([#10](https://github.com/otspi/open-eidas/issues/10)) ([9329b5f](https://github.com/otspi/open-eidas/commit/9329b5f4389f91ff3b91a17d8f91874f241e87fd)) +* **ca:** provenance des décisions RA et des révocations (R-1) ([#58](https://github.com/otspi/open-eidas/issues/58)) ([c075b4f](https://github.com/otspi/open-eidas/commit/c075b4f9832d50fe183fd0e1943d2b9e34fbf3b8)) +* **ca:** révocation de l'autorité émettrice et ARL de la racine (C-1) ([#56](https://github.com/otspi/open-eidas/issues/56)) ([1301fe8](https://github.com/otspi/open-eidas/commit/1301fe8101e392a01aa706d3e1fdb759ef39a731)) +* **castore:** registre des opérateurs et droits en lecture seule de ra-console ([#15](https://github.com/otspi/open-eidas/issues/15)) ([ea3a702](https://github.com/otspi/open-eidas/commit/ea3a702e86e0685d985b727daa74068b028733c6)) +* **config:** refus de l'OID de test en production et script de bascule vers l'arc PEN ([#44](https://github.com/otspi/open-eidas/issues/44)) ([0b26fcd](https://github.com/otspi/open-eidas/commit/0b26fcdf4da0061ffc42738eabd4cd2d0981a784)) +* **deploy:** image, chart Helm et surcouche compose de ra-console ([#86](https://github.com/otspi/open-eidas/issues/86)) ([1e0ffd0](https://github.com/otspi/open-eidas/commit/1e0ffd04c7841cc4880eba0650047c4f71b08a59)) +* **deploy:** port interne, ConfigMap et NetworkPolicy de la CA dans le chart Helm ([#23](https://github.com/otspi/open-eidas/issues/23)) ([f0d3ea5](https://github.com/otspi/open-eidas/commit/f0d3ea5853b1f8818dc73794a0392c8d35f9f32e)) +* enhance mirror setup script with initial sync for all repos ([b53129c](https://github.com/otspi/open-eidas/commit/b53129c914fadb4bc2c1387af38b3af3c021e41e)) +* **oe-ca-core:** journal bloquant avant toute écriture durable ([#42](https://github.com/otspi/open-eidas/issues/42)) ([6d4fe5a](https://github.com/otspi/open-eidas/commit/6d4fe5a5d67848bcd93440fb79e25fa958ca59ad)) +* **oe-raflow:** journal bloquant, exception documentée pour Decider::decide ([#45](https://github.com/otspi/open-eidas/issues/45)) ([1a3b496](https://github.com/otspi/open-eidas/commit/1a3b4964f694699e9ca08026da28c2b1d16f085f)) +* **oe-s3:** client S3-compatible minimal (SigV4) ([#43](https://github.com/otspi/open-eidas/issues/43)) ([a600350](https://github.com/otspi/open-eidas/commit/a600350b9a392641efc255971789de810ea7146c)) +* **oe-tsa-core,oe-timesource:** journal bloquant, deux traits restent synchrones ([#47](https://github.com/otspi/open-eidas/issues/47)) ([4ba7ab0](https://github.com/otspi/open-eidas/commit/4ba7ab02e28926fa520e4ad6c243b1d7f83ca349)) +* **oid:** poser l'arc d'OTSPI (PEN 67027) à la place des OID provisoires ([#93](https://github.com/otspi/open-eidas/issues/93)) ([b21cd94](https://github.com/otspi/open-eidas/commit/b21cd94185e548f93ed62668f9a4a4ddbefc235c)) +* **provenance:** copie hors poste de l'archive et archivages concurrents ([#48](https://github.com/otspi/open-eidas/issues/48)) ([0a3d834](https://github.com/otspi/open-eidas/commit/0a3d834473b3861d27ce196ebec37f57d18aa8cd)) +* **ra-console:** connexion par nom, login/begin et login/finish (1c-1) ([#34](https://github.com/otspi/open-eidas/issues/34)) ([0530043](https://github.com/otspi/open-eidas/commit/0530043550e625d4fc6b2dc403bf86dc29945ee9)) +* **ra-console:** dossiers d'incident dans le navigateur (étape 5c) ([#100](https://github.com/otspi/open-eidas/issues/100)) ([4e14f16](https://github.com/otspi/open-eidas/commit/4e14f1683a45655ddbff81b3904538b357f564eb)) +* **ra-console:** dossiers d'incident, entrées et clôture signée (étape 5b) ([#99](https://github.com/otspi/open-eidas/issues/99)) ([05bfef5](https://github.com/otspi/open-eidas/commit/05bfef5e2021b3a97793ed1cd62c7f279eddf430)) +* **ra-console:** dossiers d'incident, ouverture et lecture (étape 5a) ([#98](https://github.com/otspi/open-eidas/issues/98)) ([b86de20](https://github.com/otspi/open-eidas/commit/b86de2097f3fd2ba36991f86190d10aad86bc3f4)) +* **ra-console:** double contrôle, co-signature et salle d'attente (étape 4b) ([#83](https://github.com/otspi/open-eidas/issues/83)) ([6189e52](https://github.com/otspi/open-eidas/commit/6189e527d94725ad17ced7db9320942cb74b4754)) +* **ra-console:** exécution des décisions signées approve/reject (étape 3b) ([#77](https://github.com/otspi/open-eidas/issues/77)) ([37d4eb8](https://github.com/otspi/open-eidas/commit/37d4eb89b8ae39c6e22c48c42ea9466a93cdafea)) +* **ra-console:** explorateur d'audit dans le navigateur (étape 6d) ([#94](https://github.com/otspi/open-eidas/issues/94)) ([3b49432](https://github.com/otspi/open-eidas/commit/3b49432f14a6ab928ee3215e9c28010118a49b72)) +* **ra-console:** file des demandes et modale de signature (étape 6b) ([#89](https://github.com/otspi/open-eidas/issues/89)) ([fdb7ccd](https://github.com/otspi/open-eidas/commit/fdb7ccd72c97aa1f83ac08a0ad9807b2bbb2af53)) +* **ra-console:** frontend, socle (étape 6a) ([#87](https://github.com/otspi/open-eidas/issues/87)) ([a07a772](https://github.com/otspi/open-eidas/commit/a07a7722c438ff162a3572a24d72a144e226d5de)) +* **ra-console:** gestion du registre des opérateurs depuis la console ([#85](https://github.com/otspi/open-eidas/issues/85)) ([922d707](https://github.com/otspi/open-eidas/commit/922d707aaa9fde4a542d7778c6e9b8b24e724318)) +* **ra-console:** GET /api/v1/audit/search, lecture et vérification des deux journaux ([#78](https://github.com/otspi/open-eidas/issues/78)) ([f636e6d](https://github.com/otspi/open-eidas/commit/f636e6d1511d838a2359d6b56b3f9675dc38aa70)) +* **ra-console:** journal d'audit propre à la console (2b-A) ([#41](https://github.com/otspi/open-eidas/issues/41)) ([d3b0309](https://github.com/otspi/open-eidas/commit/d3b03091c180e3d166c13f1017b3e5f0aaea12f2)) +* **ra-console:** lecture seule de la file d'enrôlement (2a) ([#40](https://github.com/otspi/open-eidas/issues/40)) ([357608e](https://github.com/otspi/open-eidas/commit/357608ed5d52f2af53ca877cc3911db072a7907f)) +* **ra-console:** préparation des actions signées approve/reject (étape 3a) ([#64](https://github.com/otspi/open-eidas/issues/64)) ([219bebb](https://github.com/otspi/open-eidas/commit/219bebb648472956ccdbccc8ffdc9c6d48119daa)) +* **ra-console:** purge périodique des sessions et challenges expirés (1c-2b) ([#39](https://github.com/otspi/open-eidas/issues/39)) ([b451c85](https://github.com/otspi/open-eidas/commit/b451c857a1d16e65640dda2976e3dd837eceb71f)) +* **ra-console:** registre des opérateurs dans le navigateur (étape 6e) ([#91](https://github.com/otspi/open-eidas/issues/91)) ([3a0b4b5](https://github.com/otspi/open-eidas/commit/3a0b4b5ca760d5d154f8b46e667e1030e3cd301e)) +* **ra-console:** relais de l'enregistrement de clé vers ca-server ([#29](https://github.com/otspi/open-eidas/issues/29)) ([bb8b19f](https://github.com/otspi/open-eidas/commit/bb8b19f458c798038b34e2b9e9a2b10514e476d0)) +* **ra-console:** réplication best-effort du journal d'audit sur S3 ([#50](https://github.com/otspi/open-eidas/issues/50)) ([de7ff68](https://github.com/otspi/open-eidas/commit/de7ff68b3c8df0266c4460b6c85d0953ae0a560b)) +* **ra-console:** révocation d'un certificat, première signature (étape 4a) ([#81](https://github.com/otspi/open-eidas/issues/81)) ([3f72825](https://github.com/otspi/open-eidas/commit/3f72825ce4090cff27970c367e0844e5be8a68d3)) +* **ra-console:** révocation et salle de quorum dans le navigateur (étape 6c) ([#90](https://github.com/otspi/open-eidas/issues/90)) ([42fce8e](https://github.com/otspi/open-eidas/commit/42fce8e8079dc28b8a55f012b22a9790a73f157b)) +* **ra-console:** sessions, cookie, /api/v1/me et déconnexion (1c-2a) ([#37](https://github.com/otspi/open-eidas/issues/37)) ([0abcb28](https://github.com/otspi/open-eidas/commit/0abcb2893dba3581f6f30590a69c2303792543ab)) +* **ra-console:** squelette de la console (lien mTLS, garde du rôle PostgreSQL, healthz) ([#28](https://github.com/otspi/open-eidas/issues/28)) ([566e04d](https://github.com/otspi/open-eidas/commit/566e04d013a78b5e9b117bf08987902734d1c812)) +* **tsa-server:** scellement périodique du journal et copie S3 (constat J-1) ([#101](https://github.com/otspi/open-eidas/issues/101)) ([b29bdf3](https://github.com/otspi/open-eidas/commit/b29bdf37a579cb58181f30f69bf2ae9bde6c0e33)) +* **tsa:** CORS configurable pour l'API HTTP, activé pour demo.open-eidas.eu ([#7](https://github.com/otspi/open-eidas/issues/7)) ([2d97c3c](https://github.com/otspi/open-eidas/commit/2d97c3c6ab9e1e668ed2d9ac35d5b9d7d6163cd3)) +* **webauthn:** vérification WebAuthn des opérateurs (oe-webauthn) ([#16](https://github.com/otspi/open-eidas/issues/16)) ([d2110d8](https://github.com/otspi/open-eidas/commit/d2110d8d2546010735367e1813a9d7573de3bf34)) + + +### Bug Fixes + +* **ca-server:** commandes d'exploitation sans secret de HSM, et garde de CI contre les tests PostgreSQL ignorés ([#27](https://github.com/otspi/open-eidas/issues/27)) ([59bd6fc](https://github.com/otspi/open-eidas/commit/59bd6fcc713fb2fcab918c8bf18d964281f26d85)) +* **ca-server:** recover-admin, audit et reconcile sur Config::load_without_hsm ([#33](https://github.com/otspi/open-eidas/issues/33)) ([a50318e](https://github.com/otspi/open-eidas/commit/a50318ed7e1e013700ae7dc686424b923358ba6b)) +* **chart:** ajoute fsGroup aux pods ca/tsa/ocsp pour SoftHSM ([cf00ec6](https://github.com/otspi/open-eidas/commit/cf00ec6e39a0768d0aa343248b29c12335d2ae79)) +* **chart:** ajoute fsGroup aux pods ca/tsa/ocsp pour SoftHSM ([c4f8a71](https://github.com/otspi/open-eidas/commit/c4f8a719492eac21b1c17cb09b633f71db6af7ed)) +* **ci:** demander le jeton de la GitHub App pour l'organisation otspi ([#96](https://github.com/otspi/open-eidas/issues/96)) ([a82074b](https://github.com/otspi/open-eidas/commit/a82074b755ba22c49b67eb4e5ca40909f5c325f1)) +* **ci:** publier et épingler les images sous l'organisation otspi ([#88](https://github.com/otspi/open-eidas/issues/88)) ([0d23d9f](https://github.com/otspi/open-eidas/commit/0d23d9f67bafbab71ada7355d0dd727b5bd6acc9)) +* corrige des vulnérabilités HIGH introduites par l'ajout de golang.org/x/crypto/ocsp ([5c5dabc](https://github.com/otspi/open-eidas/commit/5c5dabc8c031a9b61399707372c1d9e2e4cd0f80)) +* corrige une vulnérabilité CRITICAL golang.org/x/crypto (CVE-2026-56854) ([91fac96](https://github.com/otspi/open-eidas/commit/91fac96cd40b066e928aa07ed93afb10138baf91)) +* **deps:** quinn-proto 0.11.19 (RUSTSEC-2026-0338, -0340, -0343) ([#97](https://github.com/otspi/open-eidas/issues/97)) ([6a9e47f](https://github.com/otspi/open-eidas/commit/6a9e47f817bc4eff0b0485dfc9d2beef04f71ab9)) +* **helm:** approbation RA automatique désactivée par défaut (R-2) ([#57](https://github.com/otspi/open-eidas/issues/57)) ([259e7ab](https://github.com/otspi/open-eidas/commit/259e7ab306961a3c9d0cb28c1dbdee227b5429bb)) +* **images:** applique les correctifs de sécurité Debian au build ([83b0f72](https://github.com/otspi/open-eidas/commit/83b0f727e4ce84cd61dd6c0aec36c456f85665b4)) +* **images:** applique les correctifs de sécurité Debian au build ([e95781c](https://github.com/otspi/open-eidas/commit/e95781c8d4c385dc562f5f06d6429d1529097691)) +* **images:** invalide le cache apt-get une fois par jour (CACHEBUST) ([fd40e43](https://github.com/otspi/open-eidas/commit/fd40e43199cb00857c585e25b2b89695fdec5113)) +* **oe-ca-core,oe-conformance,oe-tsa-core:** expiration de la clé TSU, contrôlée à chaque signature ([#80](https://github.com/otspi/open-eidas/issues/80)) ([484f233](https://github.com/otspi/open-eidas/commit/484f2333b36e6d4f6a470b30e5b2735da6590fe8)) +* **oe-castore,oe-ca-core,oe-ocsp-core:** unknown pour un certificat jamais émis ([#55](https://github.com/otspi/open-eidas/issues/55)) ([5621e82](https://github.com/otspi/open-eidas/commit/5621e827ab413b4d9813bff4fe3be5bb85871db8)) +* **oe-rfc3161-asn1,oe-tsa-core,oe-config:** genTime porte sa fraction de seconde ([#76](https://github.com/otspi/open-eidas/issues/76)) ([cedb73c](https://github.com/otspi/open-eidas/commit/cedb73c24e4fefaf3804a61fa97c77bd45b1460f)) +* **oe-tsa-core,tsa-server:** le journal trace le jeton émis, pas le certificat ([#52](https://github.com/otspi/open-eidas/issues/52)) ([7fed5cd](https://github.com/otspi/open-eidas/commit/7fed5cdbbf3fc54a1985fb4c92d7e5996ef64c54)) +* **oe-tsa-core:** encodage DER du failInfo des refus RFC 3161 ([#62](https://github.com/otspi/open-eidas/issues/62)) ([0cf221c](https://github.com/otspi/open-eidas/commit/0cf221c0c20eb7615cae2caed4f2d792ef48088b)) +* probes k8s trop strictes + budget d'attente CI insuffisant ([0738b16](https://github.com/otspi/open-eidas/commit/0738b164ef6880986c86d4bbf99f156e2cd8e84d)) +* **ra-console:** ne plus lier cryptoki (feature pkcs11 d'oe-hsm) ([#30](https://github.com/otspi/open-eidas/issues/30)) ([9f1f0b9](https://github.com/otspi/open-eidas/commit/9f1f0b9b30566c7d9f58238a0a5128d1fa437ca0)) +* **tsa:** numéro de série du jeton en DER minimal (1 jeton sur 512 était rejeté) ([#31](https://github.com/otspi/open-eidas/issues/31)) ([3a9e2e2](https://github.com/otspi/open-eidas/commit/3a9e2e247167f436bbfd2a44e1af6aacb6ca941e)) +* **tsa:** restreint vraiment le CORS à l'origine configurée ([#8](https://github.com/otspi/open-eidas/issues/8)) ([5a7acf1](https://github.com/otspi/open-eidas/commit/5a7acf1bd0d1db822eed87dff0728d18eabe2dc9)) +* valide la longueur du PIN SoftHSM (4-255) au lieu de bloquer sur une invite ([81decf3](https://github.com/otspi/open-eidas/commit/81decf3a4a520fde5c8ba96430a57c978648c028))