Retracted: v1.832.18 seals the SECRET MASK as a provider key.
It carries sealPastedKey without the guard that recognises object.SecretMask
("***"), which is what the admin API returns for a stored secret and therefore
what the console posts back when an operator saves a provider form WITHOUT
touching the key field. On that save the literal "***" is sealed into KMS under
the provider's own secret name, and because resolution is KMS-first the store
then answers "***" for every subsequent read — outranking the environment
variable that was serving the real key. The provider stops authenticating
upstream, and the row looks correct while it does.
Fixed in the next release. Nothing shipped this version: cloud was pinned to
v1.832.10 throughout.
Directories
¶
| Path | Synopsis |
|---|---|
|
Command openapi renders the resource surface into the canonical spec.
|
Command openapi renders the resource surface into the canonical spec. |
|
Command pg2sqlite migrates cloud-api's dbx-managed Postgres database to a SQLite file.
|
Command pg2sqlite migrates cloud-api's dbx-managed Postgres database to a SQLite file. |
|
Command routerdoc lifts each hand-written route's sentence out of the Go doc comment on the handler it names, into routers/wired_gen.go.
|
Command routerdoc lifts each hand-written route's sentence out of the Go doc comment on the handler it names, into routers/wired_gen.go. |
Click to show internal directories.
Click to hide internal directories.