Skip to content

v0.46.4

Choose a tag to compare

View all tags
@rustyconover rustyconover released this 08 Nov 18:34
v0.46.4
a305dcc

Secret ATTACH options now follow the cross-SDK spec (docs).

  • The AEAD key is HKDF-SHA256(root, info "vgi.attach_secret_options.v1"); the configured signing key, HTTP sealing key or host-local key is never used directly.
  • Encrypted blob is version(0x01) || nonce || ciphertext || tag, AAD-bound to the attach uuid.
  • A blob that does not open (another deployment, deleted/rotated host key file, moved blob) is refused with the uniform attach_opaque_data not recognized error (INVALID_ARGUMENT / opaque_data_not_recognized) instead of secrets silently reading as absent.
  • Host-local key file path matches every SDK: $VGI_ATTACH_SECRET_KEY_FILE, else $XDG_RUNTIME_DIR/vgi/attach-secret-options.key, else <$TMPDIR or java.io.tmpdir>/vgi-<user>/attach-secret-options.key.
  • New AttachOptions.open(attachId): producers and exchanges keep only the attach id in their state and re-open the options (secret ones included) while producing.
  • txfix fixture: whoami().token_in_attach_data; CI runs vgi v2.0 22140b0.

Attaches made by a 0.46.3 worker that carried secret options must be re-attached after upgrading.

Assets 2
Loading