Skip to content

Releases: lrstanley/vault-unseal

v1.0.0

12 Apr 01:26
@github-actions github-actions
v1.0.0
This tag was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.
d8a86b3
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.0.0 Latest
Latest

Changelog

Security

  • Dependency updates address GHSA-78h2-9frx-2jm8.
  • Container image now runs the process as a non-root user (app) instead of root.
  • Github Actions workflow now produces provenance attestations and SBOMs for the container image.

What's new

  • Notifications use Shoutrrr (maintained fork). Configure one or more notify.urls with Shoutrrr service URLs — for example chat (Slack, Discord, Mattermost, Telegram, Microsoft Teams), push (Gotify, ntfy, Pushover), incidents (PagerDuty, OpsGenie), SMTP (smtp://…), generic webhooks, and others.
  • --version-json prints version metadata as JSON (for scripts and automation).
  • Published CLI reference in-repo (USAGE.md), kept in sync with the binary.
  • Help and flags reorganized (context-sensitive --help, clearer groups). --allow-single-node is now unhidden; it was previously hidden.
  • Logging now uses structured logs. Log output can still go to stderr and/or a file; see --help and USAGE.md for current flags.
  • TLS for Vault is configurable beyond skip-verify: server name, CA certificate (file, inline PEM, or directory), and optional client certificate and key for mTLS. Flags live under --tls.* (see USAGE.md, TLS Options).
  • Workers recreate the Vault API client on each check loop, so TLS settings and certificates are reapplied periodically (for example after rotation). Before, it required a restart.
  • Docker image now supports linux/arm64 platform, in addition to linux/amd64.

Breaking changes

  • Some logging options are removed (--log.quiet, --log.pretty). Use --log.level (including none to turn logging off) and JSON logging as documented.
    • JSON logging will have a different format.
    • Pretty logging (textual based, with ANSI colors) is now the default. JSON logging is still available with --log.json.
  • TLS flags: the global --tls-skip-verify flag is deprecated and will be removed in a future release. Use --tls.skip-verify (environment variable remains TLS_SKIP_VERIFY). Other TLS options use the --tls.-prefixed flags and TLS_-prefixed env vars documented in USAGE.md.
    • YAML: top-level tls_skip_verify is deprecated in favor of tls.skip_verify (and the rest of the tls map), and will be removed in a future release. The old key is still read for compatibility; prefer migrating to tls in config.
  • Container: the process no longer runs as root. Confirm writable paths for logs or other files you mount in.
  • Email-style configuration is deprecated (CLI --email.*, environment EMAIL_*, YAML email). Switch to using notify.urls with Shoutrrr URLs. Existing email settings will eventually be removed: they are converted to an smtp:// Shoutrrr URL during validation (same behavior, different wiring).
  • Notification timing flags renamed: --notify-max-elapsed and --notify-queue-delay are deprecated in favor of --notify.max-elapsed and --notify.queue-delay. In YAML, prefer the notify map keys max_elapsed and queue_delay instead of top-level notify_max_elapsed and notify_queue_delay. Same environment variable names (see USAGE.md).

🧹 Misc

Dependency updates

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:1.0.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:1.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:1

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Assets 16

v1.0.0-rc.0

04 Apr 02:47
@github-actions github-actions
v1.0.0-rc.0
This tag was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.
f6bd279
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.0.0-rc.0 Pre-release
Pre-release

📣 Release Candidate 📣

WARNING: This is a release candidate, and thus not subject to support or security guarantees. You may find issues with this release (please submit an issue if you do!), and as such, this version should not be used in a stable and/or production environment. You've been warned!

Changelog

Security

  • Dependency updates address GHSA-78h2-9frx-2jm8.
  • Container image now runs the process as a non-root user (app) instead of root.
  • Github Actions workflow now produces provenance attestations and SBOMs for the container image.

What's new

  • Notifications use Shoutrrr (maintained fork). Configure one or more notify.urls with Shoutrrr service URLs — for example chat (Slack, Discord, Mattermost, Telegram, Microsoft Teams), push (Gotify, ntfy, Pushover), incidents (PagerDuty, OpsGenie), SMTP (smtp://…), generic webhooks, and others.
  • --version-json prints version metadata as JSON (for scripts and automation).
  • Published CLI reference in-repo (USAGE.md), kept in sync with the binary.
  • Help and flags reorganized (context-sensitive --help, clearer groups). --allow-single-node is now unhidden; it was previously hidden.
  • Logging now uses structured logs. Log output can still go to stderr and/or a file; see --help and USAGE.md for current flags.
  • TLS for Vault is configurable beyond skip-verify: server name, CA certificate (file, inline PEM, or directory), and optional client certificate and key for mTLS. Flags live under --tls.* (see USAGE.md, TLS Options).
  • Workers recreate the Vault API client on each check loop, so TLS settings and certificates are reapplied periodically (for example after rotation). Before, it required a restart.
  • Docker image now supports linux/arm64 platform, in addition to linux/amd64.

Breaking changes

  • Some logging options are removed (--log.quiet, --log.pretty). Use --log.level (including none to turn logging off) and JSON logging as documented.
    • JSON logging will have a different format.
    • Pretty logging (textual based, with ANSI colors) is now the default. JSON logging is still available with --log.json.
  • TLS flags: the global --tls-skip-verify flag is deprecated and will be removed in a future release. Use --tls.skip-verify (environment variable remains TLS_SKIP_VERIFY). Other TLS options use the --tls.-prefixed flags and TLS_-prefixed env vars documented in USAGE.md.
    • YAML: top-level tls_skip_verify is deprecated in favor of tls.skip_verify (and the rest of the tls map), and will be removed in a future release. The old key is still read for compatibility; prefer migrating to tls in config.
  • Container: the process no longer runs as root. Confirm writable paths for logs or other files you mount in.
  • Email-style configuration is deprecated (CLI --email.*, environment EMAIL_*, YAML email). Switch to using notify.urls with Shoutrrr URLs. Existing email settings will eventually be removed: they are converted to an smtp:// Shoutrrr URL during validation (same behavior, different wiring).
  • Notification timing flags renamed: --notify-max-elapsed and --notify-queue-delay are deprecated in favor of --notify.max-elapsed and --notify.queue-delay. In YAML, prefer the notify map keys max_elapsed and queue_delay instead of top-level notify_max_elapsed and notify_queue_delay. Same environment variable names (see USAGE.md).

🧹 Misc

Dependency updates

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:1.0.0-rc.0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.7.2

23 Jun 22:09
@github-actions github-actions
v0.7.2
This tag was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.
e62eb62
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.7.2

Changelog

🧹 Misc

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7.2
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.7.1

23 Jun 02:52
@github-actions github-actions
v0.7.1
This tag was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.
64c89a0
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.7.1

Changelog

🧹 Misc

Dependency updates

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7.1
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.7.0

17 Dec 19:11
@github-actions github-actions
v0.7.0
This tag was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.
c2f08ac
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.7.0

Changelog

🧹 Misc

Dependency updates

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.7
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.6.0

08 Aug 03:32
@github-actions github-actions
v0.6.0
7eb8b18
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 3611FE4AE533E445
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.6.0

Changelog

🧹 Misc

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.6.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.6
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.5.1

30 Dec 03:16
@github-actions github-actions
v0.5.1
8b91c0a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.5.1

Changelog

🧹 Misc

  • 9c23c0c: build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 (@dependabot[bot])
  • 74fe78f: build(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 (@dependabot[bot])
  • 0f6d3f3: Merge pull request #39 from lrstanley/dependabot/go_modules/golang.org/x/crypto-0.17.0 (@lrstanley)
  • 8b91c0a: Merge pull request #36 from lrstanley/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.1 (@lrstanley)

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.5.1
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.5
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley and dependabot
Loading

v0.5.0

13 Oct 04:54
@github-actions github-actions
v0.5.0
b153d6e
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 16DB886FBE5ABAC2
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.5.0

Changelog

🧹 Misc

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.5.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.5
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley and heurtematte
Loading

v0.4.1

13 Sep 01:46
@github-actions github-actions
v0.4.1
d0e7c05
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 16DB886FBE5ABAC2
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.4.1

Changelog

🧹 Misc

  • d0e7c05: fix: version, commit, date not being updated in release binaries (@lrstanley)

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.4.1
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.4
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley
Loading

v0.4.0

11 Sep 17:11
@github-actions github-actions
v0.4.0
10b96b9
This commit was signed with the committer’s verified signature.
lrstanley Liam Stanley
GPG key ID: 16DB886FBE5ABAC2
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.4.0

Changelog

🧹 Misc

🐳 Container Images (ghcr)

$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.4.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.4
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0

🧪 Build info

💬 What to do next?

Contributors

lrstanley and dependabot
Loading