backport of commit c3741b0

.github/ISSUE_TEMPLATE/config.yml

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 contact_links:
   - name: Ask a question
     url: https://discuss.hashicorp.com/c/vault

.github/actionlint.yaml

@@ -7,4 +7,3 @@ self-hosted-runner:
     - small
     - large
     - ondemand
-

.github/enos-run-matrices/ent.json

@@ -0,0 +1,24 @@
+{
+  "include": [
+    {
+      "scenario": "smoke backend:consul consul_version:1.12.3 distro:ubuntu seal:awskms arch:amd64 builder:crt edition:ent",
+      "aws_region": "us-west-1"
+    },
+    {
+      "scenario": "smoke backend:raft consul_version:1.12.3 distro:ubuntu seal:shamir arch:amd64 builder:crt edition:ent",
+      "aws_region": "us-west-2"
+    },
+    {
+      "scenario": "upgrade backend:raft consul_version:1.11.7 distro:rhel seal:shamir arch:amd64 builder:crt edition:ent",
+      "aws_region": "us-west-1"
+    },
+    {
+      "scenario": "upgrade backend:consul consul_version:1.11.7 distro:rhel seal:awskms arch:amd64 builder:crt edition:ent",
+      "aws_region": "us-west-2"
+    },
+    {
+      "scenario": "autopilot distro:ubuntu seal:shamir arch:amd64 builder:crt edition:ent",
+      "aws_region": "us-west-1"
+    }
+  ]
+}

.github/enos-run-matrices/oss.json

@@ -0,0 +1,20 @@
+{
+  "include": [
+    {
+      "scenario": "smoke backend:consul consul_version:1.12.3 distro:ubuntu seal:awskms arch:amd64 builder:crt edition:oss",
+      "aws_region": "us-west-1"
+    },
+    {
+      "scenario": "smoke backend:raft consul_version:1.12.3 distro:ubuntu seal:shamir arch:amd64 builder:crt edition:oss",
+      "aws_region": "us-west-2"
+    },
+    {
+      "scenario": "upgrade backend:raft consul_version:1.11.7 distro:rhel seal:shamir arch:amd64 builder:crt edition:oss",
+      "aws_region": "us-west-1"
+    },
+    {
+      "scenario": "upgrade backend:consul consul_version:1.11.7 distro:rhel seal:awskms arch:amd64 builder:crt edition:oss",
+      "aws_region": "us-west-2"
+    }
+  ]
+}

.github/scripts/generate-test-package-lists.sh

@@ -8,8 +8,6 @@
 # solution. It distributes the entire set of test packages into 16 sublists,
 # which should roughly take an equal amount of time to complete.
 
-set -e
-
 test_packages=()
 
 base="github.com/hashicorp/vault"
@@ -20,14 +18,14 @@ test_packages[1]+=" $base/command"
 test_packages[1]+=" $base/sdk/helper/keysutil"
 
 # Total time: 1160
-test_packages[2]+=" $base/sdk/helper/ocsp"
+test_packages[2]+=" $base/builtin/credential/app-id"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[2]+=" $base/vault/external_tests/replication-perf"
 fi
 
 # Total time: 1009
 test_packages[3]+=" $base/builtin/credential/approle"
-test_packages[3]+=" $base/command/agentproxyshared/sink/file"
+test_packages[3]+=" $base/command/agent/sink/file"
 test_packages[3]+=" $base/command/agent/template"
 test_packages[3]+=" $base/helper/random"
 test_packages[3]+=" $base/helper/storagepacker"
@@ -45,8 +43,6 @@ fi
 test_packages[4]+=" $base/http"
 test_packages[4]+=" $base/sdk/helper/pluginutil"
 test_packages[4]+=" $base/serviceregistration/kubernetes"
-test_packages[4]+=" $base/tools/godoctests/pkg/analyzer"
-test_packages[4]+=" $base/tools/gonilnilfunctions/pkg/analyzer"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[4]+=" $base/vault/external_tests/apilock"
     test_packages[4]+=" $base/vault/external_tests/filteredpaths"
@@ -88,19 +84,15 @@ test_packages[6]+=" $base/builtin/audit/file"
 test_packages[6]+=" $base/builtin/credential/github"
 test_packages[6]+=" $base/builtin/credential/okta"
 test_packages[6]+=" $base/builtin/logical/database/dbplugin"
-test_packages[6]+=" $base/command/agentproxyshared/auth/cert"
-test_packages[6]+=" $base/command/agentproxyshared/auth/jwt"
-test_packages[6]+=" $base/command/agentproxyshared/auth/kerberos"
-test_packages[6]+=" $base/command/agentproxyshared/auth/kubernetes"
-test_packages[6]+=" $base/command/agentproxyshared/auth/token-file"
-test_packages[6]+=" $base/command/agentproxyshared"
-test_packages[6]+=" $base/command/agentproxyshared/cache"
-test_packages[6]+=" $base/command/agentproxyshared/cache/cacheboltdb"
-test_packages[6]+=" $base/command/agentproxyshared/cache/cachememdb"
-test_packages[6]+=" $base/command/agentproxyshared/cache/keymanager"
+test_packages[6]+=" $base/command/agent/auth/cert"
+test_packages[6]+=" $base/command/agent/auth/jwt"
+test_packages[6]+=" $base/command/agent/auth/kerberos"
+test_packages[6]+=" $base/command/agent/auth/kubernetes"
+test_packages[6]+=" $base/command/agent/cache"
+test_packages[6]+=" $base/command/agent/cache/cacheboltdb"
+test_packages[6]+=" $base/command/agent/cache/cachememdb"
+test_packages[6]+=" $base/command/agent/cache/keymanager"
 test_packages[6]+=" $base/command/agent/config"
-test_packages[6]+=" $base/command/agent/exec"
-test_packages[6]+=" $base/command/proxy/config"
 test_packages[6]+=" $base/command/config"
 test_packages[6]+=" $base/command/token"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
@@ -114,16 +106,13 @@ test_packages[6]+=" $base/helper/fairshare"
 test_packages[6]+=" $base/helper/flag-kv"
 test_packages[6]+=" $base/helper/flag-slice"
 test_packages[6]+=" $base/helper/forwarding"
-test_packages[6]+=" $base/helper/logging"
 test_packages[6]+=" $base/helper/metricsutil"
 test_packages[6]+=" $base/helper/namespace"
 test_packages[6]+=" $base/helper/osutil"
 test_packages[6]+=" $base/helper/parseip"
 test_packages[6]+=" $base/helper/policies"
-test_packages[6]+=" $base/helper/syncmap"
 test_packages[6]+=" $base/helper/testhelpers/logical"
 test_packages[6]+=" $base/helper/timeutil"
-test_packages[6]+=" $base/helper/useragent"
 test_packages[6]+=" $base/helper/versions"
 test_packages[6]+=" $base/internalshared/configutil"
 test_packages[6]+=" $base/internalshared/listenerutil"
@@ -149,20 +138,17 @@ test_packages[6]+=" $base/sdk/helper/locksutil"
 test_packages[6]+=" $base/sdk/helper/pathmanager"
 test_packages[6]+=" $base/sdk/helper/roottoken"
 test_packages[6]+=" $base/sdk/helper/testhelpers"
-test_packages[6]+=" $base/sdk/helper/testhelpers/schema"
 test_packages[6]+=" $base/sdk/helper/xor"
 test_packages[6]+=" $base/sdk/physical/file"
 test_packages[6]+=" $base/sdk/plugin/pb"
 test_packages[6]+=" $base/serviceregistration/kubernetes/client"
 test_packages[6]+=" $base/shamir"
 test_packages[6]+=" $base/vault/cluster"
-test_packages[6]+=" $base/vault/eventbus"
 test_packages[6]+=" $base/vault/external_tests/api"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[6]+=" $base/vault/external_tests/consistencyheaders"
 fi
 test_packages[6]+=" $base/vault/external_tests/expiration"
-test_packages[6]+=" $base/vault/external_tests/hcp_link"
 test_packages[6]+=" $base/vault/external_tests/kv"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[6]+=" $base/vault/external_tests/plugins"
@@ -205,7 +191,7 @@ test_packages[7]+=" $base/vault/quotas"
 # Total time: 779
 test_packages[8]+=" $base/builtin/credential/aws/pkcs7"
 test_packages[8]+=" $base/builtin/logical/totp"
-test_packages[8]+=" $base/command/agentproxyshared/auth"
+test_packages[8]+=" $base/command/agent/auth"
 test_packages[8]+=" $base/physical/raft"
 test_packages[8]+=" $base/sdk/framework"
 test_packages[8]+=" $base/sdk/plugin"
@@ -225,8 +211,8 @@ if [ "${ENTERPRISE:+x}" == "x" ] ; then
 fi
 
 # Total time: 310
-test_packages[9]+=" $base/vault/hcp_link/capabilities/api_capability"
 test_packages[9]+=" $base/vault/external_tests/plugin"
+test_packages[9]+=" $base/builtin/logical/cassandra"
 
 # Total time: 925
 test_packages[10]+=" $base/builtin/credential/ldap"
@@ -249,12 +235,10 @@ test_packages[12]+=" $base/plugins/database/mssql"
 test_packages[12]+=" $base/plugins/database/mysql"
 
 # Total time: 704
-test_packages[13]+=" $base/builtin/logical/pkiext"
 test_packages[13]+=" $base/command/server"
 test_packages[13]+=" $base/physical/aerospike"
 test_packages[13]+=" $base/physical/cockroachdb"
 test_packages[13]+=" $base/plugins/database/postgresql"
-test_packages[13]+=" $base/plugins/database/postgresql/scram"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[13]+=" $base/vault/external_tests/filteredpathsext"
 fi
@@ -263,6 +247,10 @@ test_packages[13]+=" $base/vault/external_tests/policy"
 # Total time: 374
 test_packages[14]+=" $base/builtin/credential/radius"
 test_packages[14]+=" $base/builtin/logical/ssh"
+test_packages[14]+=" $base/builtin/logical/mongodb"
+test_packages[14]+=" $base/builtin/logical/mssql"
+test_packages[14]+=" $base/builtin/logical/mysql"
+test_packages[14]+=" $base/builtin/logical/postgresql"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[14]+=" $base/enthelpers/wal"
 fi
@@ -290,10 +278,4 @@ if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[16]+=" $base/vault/external_tests/autosnapshots"
     test_packages[16]+=" $base/vault/external_tests/replicationext"
     test_packages[16]+=" $base/vault/external_tests/sealext"
-fi
-
-for i in $(cd $(git rev-parse --show-toplevel) && go list -test -json ./... |
-  jq -r '.ForTest | select(.!=null) | select(.|test("_binary$"))');
-do
-  test_packages[17]+=" $i"
-done
+fi

.github/scripts/verify_changes.sh

@@ -3,13 +3,15 @@
 
 event_type=$1 # GH event type (pull_request)
 ref_name=$2 # branch reference that triggered the workflow
-base_ref=$3 # PR branch base ref
+head_ref=$3 # PR branch head ref
+base_ref=$4 # PR branch base ref
 
 changed_dir=""
 
 if [[ "$event_type" == "pull_request" ]]; then
+  git fetch --no-tags --prune origin $head_ref
   git fetch --no-tags --prune origin $base_ref
-  head_commit="HEAD"
+  head_commit="origin/$head_ref"
   base_commit="origin/$base_ref"
 else
   git fetch --no-tags --prune origin $ref_name

.github/workflows/actionlint.yml

@@ -10,6 +10,6 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
       - name: "Check workflow files"
         uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:93834930f56ca380be3e9a3377670d7aa5921be251b9c774891a39b3629b83b8

.github/workflows/backport.yml

@@ -11,11 +11,11 @@ jobs:
   backport-targeted-release-branch:
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
-    container: hashicorpdev/backport-assistant:0.3.3
+    container: hashicorpdev/backport-assistant:0.2.5
     steps:
       - name: Backport changes to targeted release branch
         run: |
-          backport-assistant backport -merge-method=squash -gh-automerge 
+          backport-assistant backport
         env:
           BACKPORT_LABEL_REGEXP: "backport/(?P<target>\\d+\\.\\d+\\.[+\\w]+)"
           BACKPORT_TARGET_TEMPLATE: "release/{{.target}}"

.github/workflows/build-vault-oss.yml

@@ -40,14 +40,14 @@ jobs:
     runs-on: ubuntu-latest
     name: Vault ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.vault-version }}
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
         with:
           go-version: ${{ inputs.go-version }}
       - name: Set up node and yarn
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        uses: actions/setup-node@v3
         with:
-          node-version-file: './ui/package.json'
+          node-version: 14
           cache: yarn
           cache-dependency-path: ui/yarn.lock
       - name: Build UI
@@ -58,6 +58,8 @@ jobs:
           GOARCH: ${{ inputs.goarch }}
           GOOS: ${{ inputs.goos }}
           GO_TAGS: ${{ inputs.go-tags }}
+          # We started stripping symbol tables in 1.13.x
+          KEEP_SYMBOLS: true
         run: make ci-build
       - name: Determine artifact basename
         env:
@@ -68,7 +70,7 @@ jobs:
         env:
           BUNDLE_PATH: out/${{ env.ARTIFACT_BASENAME }}.zip
         run: make ci-bundle
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@v3
         with:
           name: ${{ env.ARTIFACT_BASENAME }}.zip
           path: out/${{ env.ARTIFACT_BASENAME }}.zip
@@ -96,13 +98,13 @@ jobs:
           echo "RPM_PACKAGE=$(basename out/*.rpm)" >> "$GITHUB_ENV"
           echo "DEB_PACKAGE=$(basename out/*.deb)" >> "$GITHUB_ENV"
       - if: ${{ inputs.create-packages }}
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.RPM_PACKAGE }}
           path: out/${{ env.RPM_PACKAGE }}
           if-no-files-found: error
       - if: ${{ inputs.create-packages }}
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.DEB_PACKAGE }}
           path: out/${{ env.DEB_PACKAGE }}