fabriziosalmi/certmate v2.55.2

v2.55.2 (four fixes to what CertMate writes: its logs, a restore, a certificate's record and the audit chain)

on GitHub

v2.55.2 (four fixes to what CertMate writes: its logs, a restore, a certificate's record and the audit chain)

A patch release. It adds no feature and the API contract stays at 2.61. Four of the fixes are about what CertMate writes to disk or to its log when something goes wrong halfway; each was reproduced before it was changed.

• Fix: the EAB key of a CA account no longer reaches the log (#1400). certbot takes the HMAC key of an account bound to a CA (ZeroSSL, Google, SSL.com, Actalis, Sectigo, a private CA that binds accounts) only as --eab-hmac-key <value>, so it is in the command CertMate runs. The executor logged that command at DEBUG before every run and, at ERROR, when a run timed out; a renewal waits up to 30 minutes, and the ERROR line is on at the default log level. The values after --eab-kid, --eab-hmac-key and --email are now *** in every log line that prints a command. If one of these accounts has had a renewal time out, the key may be in your logs: rotate it with the CA.
• Fix: a restore writes at most a bounded total (#1401). Each member of a backup was bounded and the upload was capped at 40 MB, but nothing bounded the sum, and deflate packs zeros about a thousand to one: an archive of 0.56 MB wrote 540 MiB and the restore reported success. One restore now writes at most 2 GiB in all, set by CERTMATE_RESTORE_MAX_BYTES; a restore that goes over stops and says it did not complete. What it had already restored stays (take the pre-restore backup if you may need to undo it). See Backup.
• Fix: a client certificate's record is replaced whole or not at all (#1402). Creation, revocation and the marker a renewal writes on the old certificate truncated metadata.json before writing it, so a full disk or a killed process left a file the listing skips: the certificate vanished from the inventory and could not be revoked through the API, while it stayed valid. The record is now written to a sibling file and renamed, and it is 0600 (it holds a name and an email).
• Fix: a record cut short by a crash no longer breaks the audit chain (#1403). A process killed in the middle of an audit append left the start of a record with no newline; the next append wrote straight after it, one event was lost, and the verifier reported the chain broken from then on. The cut-short bytes are now moved to <chain>.torn beside the chain, and the chain continues from its last whole record. A record that only lacked its newline is kept.
• Fix: a value the environment supplies is not written to settings.json (#1398). LETSENCRYPT_EMAIL and CLOUDFLARE_TOKEN are applied when the settings are read, and the next save from the interface wrote them to the file: the address saved through the interface was lost, and a token delivered through a Secret ended up on the data volume and in its backups. They are no longer saved, and the backup taken before a save holds what the file held. What changes for you: if you set one of these variables, saved from the interface, and later unset it, the value saved through the interface now comes back (before, the environment's value stayed in the file). A file that cannot be read is not overwritten while one of these variables is set.
• Groundwork, off unless you set it (#1399). CERTMATE_CONFIG_FILE names a JSON file that declares DNS and CA accounts, applied on every read and never saved. It is not documented yet on purpose: the interface does not yet refuse a change to a declared account, which comes next (#1317).
• What 2.55.1 changed and did not say (#1391). A certificate renewed without a recorded CA now gets the CA read from its renewal configuration. That also means that Edit & Reissue of such a certificate stays on that CA and no longer moves to the default CA, that its renewal information and CAA hints ask the right CA, and that the delete protection of a CA account sees it.
• Dependencies: @hono/node-server 2.1.6 in the MCP lock (Dependabot alert 107, not reachable: the MCP server uses only stdio), and the image's azure-identity 1.27.0, boto3 1.43.123 and dnspython 2.9.1 (#1393, #1396).