From c94eafcfb10752db67059fcb55177766c99bf831 Mon Sep 17 00:00:00 2001 From: dryrun Date: Mon, 19 Oct 2026 22:37:33 +0000 Subject: [PATCH] chore(release): 1.21.4 --- CHANGELOG.md | 13 ++++++++++++- Cargo.lock | 2 +- test/m1-realdata-e2e/Cargo.lock | 2 +- test/w5-policy-runtime-node-e2e/Cargo.lock | 2 +- tinycloud-node-server/Cargo.toml | 2 +- 5 files changed, 16 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 23eb4567..76cad0af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,8 +2,20 @@ ## [Unreleased] +## [1.21.4] - 2026-10-19 + +### Release notes + +- Security dependency updates for open Dependabot alerts (#381), including the S3 storage backend's port from `aws-sdk-s3` 0.19 to 1.x. The S3 client sets request checksums and response validation to `WhenRequired` and pins the SDK behaviour version, which restores the checksum behaviour of the 0.19 SDK. `rustls-webpki` 0.101.7 (via `rocket_http` and `reqwest` 0.11) is still in the dependency graph and is not fixed by this release. +- Pinned per-policy credential issuer set (TC-1452, #378): inert, no runtime effect until `share_email.credential_issuers` is configured. +- Tests and docs only (#364): Policy/v3 root revocation tests and a doc, no runtime effect. +- No database migrations. +- Rollback is the 1.21.3 image (digest 601d91f1), with no database step. + ### Changes +- Dependency updates for open Dependabot alerts on the root `Cargo.lock`, including the S3 storage backend's port from `aws-sdk-s3` 0.19 to 1.x (checksums `WhenRequired`, SDK behaviour version pinned); the `test/m1-realdata-e2e` and `test/w5-policy-runtime-node-e2e` lockfiles are refreshed. `rustls-webpki` 0.101.7 via `rocket_http` and `reqwest` 0.11 remains. +- Pinned per-policy credential issuer set (TC-1452, minor). `share_email.credential_issuers` takes a list of `{issuerDid, kid, alg: "EdDSA", publicKey, vcts, profiles, notBefore, retiredAt?, notAfter?}` entries; the legacy single issuer (`share_email.issuer_*`) joins as one more entry. policy/v3 credential admission looks the issuer up by the exact `(issuerDid, kid)` pair with no network fetch and only for DID methods on the allow-list, applies `notBefore`/`notAfter` to the clock and `notBefore`/`retiredAt` to the signed `iat` after the signature check, and admits only the entry's `vcts` and `profiles`. A policy names the issuer, so another issuer's credential cannot satisfy it; `issuerKid` in a policy's credential requirement is now optional. The node refuses to start on a set-load violation (non-EdDSA entry, duplicate `kid`, `kid` not `issuerDid#fragment`, `retiredAt` after `notAfter`, malformed or non-`Z` time, non-canonical Ed25519 key). Credentials verified through a configured entry must carry the JWT header `typ: "vc+sd-jwt"` and a header `kid`, which selects the entry and must equal the envelope and policy `kid`; the legacy single-issuer entry still accepts a header without `typ` or `kid`. The set also refuses, at start, a fixture or repeated-byte public key (outside the hermetic fixture build), one public key pinned twice, `notBefore` after `notAfter`, `retiredAt` before `notBefore`, and any issuer DID that is not `did:web`. The legacy entry has no validity window: its only compromise lever is removing it from the trust bundle. The issuer pin checks now also run when `issuer_public_key` is set and `share_email.enabled` is off. - Tests and docs (no behaviour change): a Policy/v3 root is revoked by its signer, the owner of a space its abilities touch (including a did:pkh wallet over SIWE), or the holder of a revoke control naming the space's delegations and the root's encryption network, over the generic `POST /revoke`; the JSON `RootRevocation/v1` route stays limited to the root's signer and, for the enforcement root, the enforcer. See `docs/policy-root-revocation.md` (TC-1423). ## [1.21.3] - 2026-10-19 @@ -18,7 +30,6 @@ ### Changes -- Pinned per-policy credential issuer set (TC-1452, minor). `share_email.credential_issuers` takes a list of `{issuerDid, kid, alg: "EdDSA", publicKey, vcts, profiles, notBefore, retiredAt?, notAfter?}` entries; the legacy single issuer (`share_email.issuer_*`) joins as one more entry. policy/v3 credential admission looks the issuer up by the exact `(issuerDid, kid)` pair with no network fetch and only for DID methods on the allow-list, applies `notBefore`/`notAfter` to the clock and `notBefore`/`retiredAt` to the signed `iat` after the signature check, and admits only the entry's `vcts` and `profiles`. A policy names the issuer, so another issuer's credential cannot satisfy it; `issuerKid` in a policy's credential requirement is now optional. The node refuses to start on a set-load violation (non-EdDSA entry, duplicate `kid`, `kid` not `issuerDid#fragment`, `retiredAt` after `notAfter`, malformed or non-`Z` time, non-canonical Ed25519 key). Credentials verified through a configured entry must carry the JWT header `typ: "vc+sd-jwt"` and a header `kid`, which selects the entry and must equal the envelope and policy `kid`; the legacy single-issuer entry still accepts a header without `typ` or `kid`. The set also refuses, at start, a fixture or repeated-byte public key (outside the hermetic fixture build), one public key pinned twice, `notBefore` after `notAfter`, `retiredAt` before `notBefore`, and any issuer DID that is not `did:web`. The legacy entry has no validity window: its only compromise lever is removing it from the trust bundle. The issuer pin checks now also run when `issuer_public_key` is set and `share_email.enabled` is off. - `/admin/stats` is a logged route label (TC-1482). The log shipper and the ingress log it as the route template plus status only, with no query string, `Authorization` header, request or response body, or client address (TC-961). - **N0 compose.** The embedded Vector configuration is regenerated for the new route. Together with the optional `NODE_STATS_READ_TOKEN` env line, the reviewed N0 compose template changes to `79469f97…` (raw `32a002ef…`; `docs/releasing.md`). - **`current_kv` C-index warning codes.** The log sidecar maps the three constant warnings of the TC-1274 `current_kv` C-index migration to `current_kv_c_index_missing`, `current_kv_c_index_invalid` and `current_kv_c_index_wrong_shape` (TC-1274); until then they would ship as `unclassified`. This is part of the same regenerated Vector configuration. diff --git a/Cargo.lock b/Cargo.lock index 57b1ae3b..2168f951 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9931,7 +9931,7 @@ dependencies = [ [[package]] name = "tinycloud-node" -version = "1.21.3" +version = "1.21.4" dependencies = [ "aes-gcm", "anyhow", diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock index 017a3559..69504dcb 100644 --- a/test/m1-realdata-e2e/Cargo.lock +++ b/test/m1-realdata-e2e/Cargo.lock @@ -8017,7 +8017,7 @@ dependencies = [ [[package]] name = "tinycloud-node" -version = "1.21.3" +version = "1.21.4" dependencies = [ "aes-gcm", "anyhow", diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock index dc0cce16..abb46484 100644 --- a/test/w5-policy-runtime-node-e2e/Cargo.lock +++ b/test/w5-policy-runtime-node-e2e/Cargo.lock @@ -8465,7 +8465,7 @@ dependencies = [ [[package]] name = "tinycloud-node" -version = "1.21.3" +version = "1.21.4" dependencies = [ "aes-gcm", "anyhow", diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml index d5f8187b..58aa42b2 100644 --- a/tinycloud-node-server/Cargo.toml +++ b/tinycloud-node-server/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "tinycloud-node" build = "build.rs" -version = "1.21.3" +version = "1.21.4" authors = ["TinyCloud Protocol"] edition = "2021" description = "TinyCloud Protocol Node"