This release has some significant changes in it,
JWKS cache.
This should significantly improve performance. Currently it is opt-in and not on by default. Later releases will likely move to opt-in, we want to get more data and catch any issues before having on out of the box. It is curently Linux/macOS only.
To enable it during install: OPKSSH_INSTALL_CACHE_DIR=/var/cache/opkssh ./install-linux.sh
It can also be turned on in the config /etc/opk/config.yml
We also added a provider request times out of 10s. A hung provider used to stall verify ~2 minutes (past sshd’s LoginGraceTime); now a login falls back or fails in ~20s.
Audit JSON format
We changed the JSON format slightly. If you have scripts that expect a particular json format, test and update them before switching to this release
Changes
- feat: add safe persistent JWKS cache @gflex (#628)
- Make permissions --json emit only JSON and still fail @arpitjain099 (#646)
- feat(inspect): discover opkssh certificates when no path is given @choksi2212 (#635)
- Speed up openssh version integration tests @EthanHeilman (#644)
🐛 Bug Fixes
- fix: Enable sshd_session_t when loading local SELinux policy files @EthanHeilman (#642)
- Fix log and installer bug before release v0.19.0 @EthanHeilman (#648)
Dependencies
- fix(deps): Update go toolchain directive to v1.27.2 @renovate[bot] (#609)
- fix(deps): Update opensuse/tumbleweed:latest Docker digest to 8732062 @renovate[bot] (#639)