HHostingByteSoftware
Ctrl K
ComunidadGuías…

CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
<!-- markdownlint-disable MD013 -- one line per entry, however long -->
# Changelog

All notable changes to this project are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [1.0.2] - 2026-10-24

### Changed

- Refresh the route catalogues embedded for every region.

### Security

- Build with Go 1.27.3, whose `crypto/x509` refuses the intermediate certificates known to be compromised (GO-2026-6809, CVE-2026-111943).

## [1.0.1] - 2026-10-08

### Added

- Attach the signed provenance of the image to each GitHub release, as `keymaker-X.Y.Z.intoto.jsonl`.

### Changed

- Refresh the route catalogues embedded for every region.

### Fixed

- Wait the longest allowed when the API asks for a `Retry-After` of billions of seconds, rather than not at all: the delay overflowed.

### Security

- Build with Go 1.27.2, which fixes vulnerabilities in `crypto/tls`, `net/http`, `net/textproto` and `os`.

## [1.0.0] - 2026-10-04

The first stable release. From here on, every 1.x release keeps what the Compatibility section of the README lists as it is, and the image gains the major tag `1`, which follows them.

### Added

- State in both READMEs what every 1.x release keeps stable, and how to check that an image was built by this repository.
- Add a `keymaker healthcheck` command, and declare it as the `HEALTHCHECK` of the image, so that Docker and Compose report the container as healthy without a shell or a client in it.

### Changed

- Draw the inventory forty keys at a time as it is scrolled: with five hundred keys, a change of filter or view took most of a second and now takes a tenth of one.

### Fixed

- Count the routes of each branch in the explorer with the method and deprecation filters applied, as the list it opens does.
- Hand the focus to the outcome after a revocation or a deletion removes the button that opened it, and keep it inside the address dialog between its two steps.
- Fall back on the route catalogue of the configured region, rather than on the ovh-eu one for every region: ovh-ca publishes 3556 routes and ovh-us 1990, against 4656 for ovh-eu.
- Wait out a `429 Too Many Requests` from the API, as long as `Retry-After` asks within ten seconds, and send the call again, rather than failing the listing of a large account.

## [0.5.1] - 2026-10-03

### Added

- Show the inventory in both READMEs, on invented data, in the reader's theme.

### Changed

- Refresh the route catalogue embedded in the binary: 4656 routes, read on 2026-10-03.

### Fixed

- Say in SECURITY.md that the key in use can be ended on purpose through "Revoke and leave", and only there.
- Try a read of the API once more when its connection drops before any answer, and say on the inventory when the key in use could not be identified.
- Filter a key whose application was deleted as inoperative rather than as active.
- Stop reporting a rule that ends in a slash without a wildcard, such as `PUT /me/api/credential/`, as able to change account access: it names no route.

## [0.5.0] - 2026-10-03

### Added

- Add two shortcuts to the inventory: `/` to search, and Escape to clear the filters.
- Add a control that unfolds the access rules of every key at once, for an audit pass.

### Changed

- Open the explorer on the branches of the API, each with its number of routes, rather than on four thousand routes in alphabetical order.
- Take the palette from the mascot, its navy for the ink and its cyan for the accent, on a slightly warm background.
- Set the screen titles and the small labels in the monospace face, and widen the type scale so that titles, text and labels stand apart.
- Replace the four metric tiles with one line: a bar split by band, then the counts as filters. The first keys now show without scrolling.
- Lay the filters and the list view on the page itself, with hairlines, instead of a panel around each part.
- Drop the icons from the screen navigation.

## [0.4.0] - 2026-10-03

### Added

- Add a way out on the card of the key Keymaker uses: revoke it and leave. It is deleted when it holds the delete rule and expired otherwise.
- Add a report of the whole inventory, downloadable as JSON or CSV, built in the browser and holding no key value.
- Add an editor for the allowed addresses of a key, behind the optional rule `PUT /me/api/credential/*`. The key Keymaker uses is only restricted to a list covering the address it is seen from.

### Changed

- Offer to revoke inactive keys only when the management key may, and say why otherwise.
- Show "Revoke" as a greyed button that explains why when the management key cannot revoke a key, instead of "revocation unavailable".

### Fixed

- Flag a key allowed from `0.0.0.0/0` or `::/0` as accepting any address: those blocks restrict nothing.
- Show a key whose application was deleted as inoperative, out of the audit, instead of as a live key: OVHcloud keeps listing it with its old status.

## [0.3.1] - 2026-09-30

### Fixed

- Encode the path of the redirect that removes the access token from the URL only once.

### Security

- Refuse a path starting with `/\` as the target of the access token redirect.
- Mark the session cookie `Secure` when `KEYMAKER_PUBLIC_URL` is an `https` address.

## [0.3.0] - 2026-09-28

### Added

- Flag narrow rules changing account access in the audit: IAM, OAuth2 clients, allowed addresses, 2FA, password, email, SSH keys. API key rules are not flagged.
- Flag narrow rules reaching billing, orders or payment means in the audit.
- Flag the same sensitive rules in the route explorer.
- Flag management key rules beyond what Keymaker needs on its card, with a link issuing a key holding only the needed rules.
- Flag keys created by OVHcloud support rather than the account holder.
- Flag keys of one application with identical access rules and allowed addresses.
- Flag keys expiring within 7 days, the management key included.
- Link the keyless applications banner and the key replacement notice to the relevant paragraph of the Understand screen.

### Changed

- Audit keys awaiting validation instead of skipping them, and flag them as pending. Usage-based checks are skipped for these keys.

### Fixed

- Stop showing a red message on the New key screen before anything is wrong. An empty selection is explained once, in the first step.
- Keep a readable line length in New key and Understand panel paragraphs on wide screens.
- Move focus to the new screen's title on every screen change.
- Close the keyless applications panel when its last application is deleted.
- Fix the mascot's overlapping right ears. Both ears are now symmetric, in the interface and the READMEs.

## [0.2.0] - 2026-09-18

### Added

- List applications left without a key under the inventory, with what they still allow.
- Add deletion of an application holding no key, behind a confirmation. Applications still holding keys are never offered, since deleting them revokes their keys.
- Add deletion of every keyless application in one pass, with a confirmation listing them and a report of deleted and refused ones.
- Allow optional `GET /me/api/application` and `DELETE /me/api/application/*` rules on the management key. The section names any missing rule; older keys keep working.
- Add an Understand screen, in English and French, explaining applications, keys and access rules on an invented example. It reads nothing from the account.

### Changed

- Give the ready-made management key link for each of `ovh-eu`, `ovh-ca` and `ovh-us` in the quick start, instead of `ovh-eu` alone.

## [0.1.0] - 2026-09-13

First public release.

### Added

- Add an inventory of every classic API key of the configured account, with access rules, allowed addresses, creation, expiry and last use.
- Filter the inventory by status, application, finding and free text.
- Sort the inventory by alerts or by last use.
- Show the inventory as a list or as cards.
- Resolve the application of each key, marking applications the account does not own, such as the OVHcloud API console, as external.
- Mark the key Keymaker authenticates with.
- Audit keys for broad access, no address restriction, no expiry, never used after 30 days, dormant after 180 days and no description.
- Explain each audit finding in the interface, count it across the account and make it usable as a filter.
- Group keys into "at risk", "to watch" and "nothing flagged". Expired, refused and pending keys are not audited.
- Add key revocation behind typing its identifier, refused for Keymaker's own key and disabled with the reason when no delete rule allows it.
- Revoke every expired or refused key in one pass, with a report of what became of each key.
- Add a route explorer over the whole published OVHcloud API, searchable by route or purpose and narrowable by branch and method.
- Build a set of access rules in the route explorer, with a warning on rules reaching the whole account.
- Read the route catalogue from the API at startup, retrying in the background after a failure.
- Embed a dated route catalogue snapshot, shown until a refresh succeeds.
- Create keys through the OVHcloud `createToken` page, opened with the chosen access rules filled in. The new key's values never pass through Keymaker.
- Replace a key from its access rules, listing its allowed addresses to re-enter; revocation comes last, once the OVHcloud page is opened.
- Show the public address the instance is seen from, optionally, to restrict a new key to it.
- Add `KEYMAKER_IP_LOOKUP=off` to disable the public address lookup.
- Offer a link issuing a new management key with the right rules for the configured endpoint when the API refuses the configured key.
- Tell a refused management key apart from one missing a rule.
- Read configuration from an `ovh.conf` file, never written back, with `ovh.conf.example` describing every value.
- Report an unreadable configuration file with the identity it was refused under.
- Add `KEYMAKER_ADDR`, `KEYMAKER_CONFIG`, `KEYMAKER_PUBLIC_URL`, `KEYMAKER_IP_LOOKUP` and `KEYMAKER_LOG_LEVEL` environment variables.
- Add a `--version` flag.
- Provide the interface in English and French, with light and dark themes.
- Make dialogs and explanations accessible.
- Fit the layout to a phone screen.
- Show a footer with the version and a statement that the project is not affiliated with OVHcloud.
- Publish a distroless, non-root container image for `linux/amd64` and `linux/arm64` to `ghcr.io/kentrow/keymaker`, with provenance and SBOM attestations.

### Security

- Require an access token, generated at every start, on every route except `GET /healthz`.
- Require a second token on every change.
- Set a content security policy that allows nothing the binary does not serve.
- Harden response headers.
- Redact the application secret and the consumer key from every log record.

[Unreleased]: https://github.com/kentrow/keymaker/compare/v1.0.2...HEAD
[1.0.2]: https://github.com/kentrow/keymaker/compare/v1.0.1...v1.0.2
[1.0.1]: https://github.com/kentrow/keymaker/compare/v1.0.0...v1.0.1
[1.0.0]: https://github.com/kentrow/keymaker/compare/v0.5.1...v1.0.0
[0.5.1]: https://github.com/kentrow/keymaker/compare/v0.5.0...v0.5.1
[0.5.0]: https://github.com/kentrow/keymaker/compare/v0.4.0...v0.5.0
[0.4.0]: https://github.com/kentrow/keymaker/compare/v0.3.1...v0.4.0
[0.3.1]: https://github.com/kentrow/keymaker/compare/v0.3.0...v0.3.1
[0.3.0]: https://github.com/kentrow/keymaker/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/kentrow/keymaker/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/kentrow/keymaker/releases/tag/v0.1.0