Release 2024-04-25 - (expected chart version 4.42.0)

[zebot]

[2024-04-25] (Chart Release 4.42.0)

Release notes

• There is a new optional Boolean in Brig's Helm chart, config.multiSFT.enabled,
  signalling whether calls between federated SFT servers are allowed. (Credential Provisioning for SFT authentication #3915)

  IMPORTANT: The value of this new option needs be set to the value of
  multiSFT.enabled in SFT's Helm chart. Otherwise federated SFT servers won't
  work.

  If provided, the field is_federating in the response of /calls/config/v2
  will reflect multiSFT.enabled's value.

  Example:

  # [brig/values.yaml]
  multiSFT:
    enabled: true
  

  Also, the optional object sftToken with its fields ttl and secret define
  whether an SFT credential would be rendered in the response of
  /calls/config/v2. The field ttl determines the seconds for the credential to
  be valid and secret is the path to the secret shared with SFT to create
  credentials.

  Example:

  # [brig.yaml]
  sft:
    sftBaseDomain: sft.wire.example.com
    sftSRVServiceName: sft
    sftDiscoveryIntervalSeconds: 10
    sftListLength: 20
    sftToken:
      ttl: 120
      secret: /path/to/secret
  

• The "addClient" internal endpoint of galley has been changed. This can cause temporary failures during upgrades if brig attempts to use this endpoint on a different version of galley. (Serialisation of client capabilities #3904)

• Removed the deprecated and unused field geoDb from Brig's config. (remove geoDb option from Brig #3975)

• Added support for 3 more MLS ciphersuites. To enable MLS, all supported signature schemes (ed25519 and the three ecdsa variants) now need to have private keys specified in galley's configuration file. (New MLS ciphersuites #3964)

API changes

• Create version 6 of client-related endpoints, fixing an oddity in the serialisation of capabilities. (Serialisation of client capabilities #3904)

• Add gzip request support to spar and proxy (Add gzip middlewares to spar and proxy #4013)

Features

• Backend validates display name during DPoP challenge (WPB-6190 Backend should validate display name during DPoP challenge #3890)

• Add Helm chart smallstep-accomp that provides a CRL endpoint proxy for federated E2EI (Add helm chart for CRL proxy #3896)

• Support for Elasticsearch password authentication (WPB-6717 brig: Support connecting to Elasticsearch over TLS #3989, WPB-6717 ES Credentials #3959, elasticsearch-ephemeral: Provide password as value #3994, WPB-7283 fix authentication issue of brig index migrate data to elastic search #3984, refactor: Change TSFI's for BSI Testmapping #2093, Cassandra migrations chart configurability #2079)

• Support unblocking a user in an MLS 1-to-1 conversation ([WPB-6783] Support unblocking an MLS 1-to-1 conversation #3940)

• Add E2EI configuration setup to smallstep-accomp chart (Update smallstep-accomp Helm chart (#3932) #3944)

• Remove Helm migrated charts webapp, team-settings, account-pages, sftd (Remove 4 migrated Helm charts #3927)

• charts/nginz: Rate limiting claiming MLS key-pacakges by requesting and target user (charts/nginz: Configure rate limits for claiming MLS key packages and getting one2one conversations #3918)

• Support connecting to Elasticsearch over TLS

  It can be enabled by setting these options on the wire-server helm chart (WPB-6717 brig: Support connecting to Elasticsearch over TLS #3989):

  brig:
    config:
      elasticsearch:
        scheme: https
  
        # When custom CAs are required, one of these must be set:
        tlsCa: <PEM encoded CA certificates>
        tlsCaSecretRef:
          name: <Name of the secret>
          key: <Key in the secret containing pem encoded CA Cert>
  
        # When TLS needs to be used without verification:
        insecureSkipVerifyTls: true
  
  elasticsearch-index:
    elasticsearch:
      scheme: https
  
      # When custom CAs are required, one of these must be set:
      tlsCa: <PEM encoded CA certificates>
      tlsCaSecretRef:
        name: <Name of the secret>
        key: <Key in the secret containing pem encoded CA Cert>
  
      # When TLS needs to be used without verification:
      insecureSkipVerifyTls: true

• Make gundeck's notificationTTL configurable. The value defines how long
  notifications are (at most) stored in the database. Decreasing this value e.g.
  helps to safe database space on test environments. (gundeck: Make notificationTTL configurable #3960)

• charts/nginz: Allow 3000 reqs/min on /conversations/one2one/:user_domain/:user (charts/nginz: Configure rate limits for claiming MLS key packages and getting one2one conversations #3918)

• Support authenticating to redis (gundeck: Support authenticating to redis #3971)

Bug fixes and other updates

• Send connection cancelled event to local pending connection when user gets deleted (WPB-6258 Connection request from deleted user #3861)

• Optional apiProxy attribute added to deeplink.json in nginz chart (WPB-6524 Added optional api proxy attribute to deeplink json in nginz chart #3933)

• coturn cert-reloader sidecar config: process name should not contain the path (helm chart) (coturn cert-reloader sidecar config: process name should not contain the path (helm chart) #3916)

• Prevent conflict on subsequent tries to provision a SCIM user (WPB-6577 Fix user creation conflict in SCIM #3914)

• Avoid IO Exception when querying

  GET /converations/{cnv_domain}/{cnv}/groupinfo

  with public group state not set in galley.converation. (avoid IO Exception when group state not set #3939)

• Return an actual list of other users in a remote MLS 1-to-1 conversation ([WPB-7415] Fix the list of other members in an MLS 1-to-1 conversation (the develop counterpart) #3998)

• charts/background-worker: Fix name of the service monitor ( charts/background-worker: Fix name of the service monitor  #3913)

• Fix crash when enqueing an empty list of notifications and federation is disabled (#PR_NOT_FOUND)

• Add the request ID to the request's execution environment in gundeck, such that it can be logged. (gundeck: set request id in request env #3903)

• The AWS SNS ARN was parsed by accumulating the environment name up to the first
  dash ('-') such that parts of this name spilled over into the app name. Now, we
  accumulate up to the last dash. (gundeck: Fix SNS endpoint parser #3894)

• Fix bug where welcome notifications were generated for each client instead of for each user (Welcome notification bug #3907)

• Do not deliver MLS one-to-one conversation messages to a user that blocked the sender ([WPB-6144] Prevent MLS one-to-one messaging for a blocking user #3889, [WPB-6144] Don't remove MLS clients from a 1-1 conversation #3906)

• Optimize getting all feature configs (Optimize getting all feature configs #4002)

Documentation

• adds new coding-conventions.md and talks about the decision we made for cs ([WPB-7222] (part 2) add coding-conventions.md to developer docs #4006)

• Distinguish UTCTime and UTCTimeMillis in swagger (Fix openapi docs of UTCTime and UTCTimeMillis #3899)

• Patch hole in scim docs regarding wire team role manipulation. (Patch hole in scim docs regarding wire team role manipulation. #3897)

Internal changes

• Create a new script (Sbom.hs) to generate the wire-server sbom (bill of material) file. ([feat] use new script for sbom generation #3942)

• port flaking LH tests to new integration and improve the ergonomics of our testing library ([WPB-5687] port flaking LH tests to new integration #3876)

• some small refactorings to make it more clear in code what is happening when registering a scim token and an IdP ([WPB-5687] more legalhold tests #3966)

• In order for the CRL-proxy to function correctly, it needs to have CORS headers set.
  We are now setting the CORS headers on the ingress level. (WPB 7155 smallstep-accomp CRL-Proxy CORS #3956)

• drop cs in all production code and from Imports ([WPB-7222] Drop depencency on convertible-strings in production code #4001)

• Galley's internal DELETE /i/client/:clientID now early-exits before visiting all conversations if the client is already gone.
  Galley now reports debug logs for every call to Cassandra. (early exit when deleting already gone client #3985)

• move formatting and linting of haskell files to treefmt, remove some of the now unneeded rules ([WPB-8712] use treefmt for everything #4000)

• Integration test cases for strangely behaving feature config settings. (WPB-8713 Optimize feature configs tests #4007)

• Add ldap-scim-bridge chart to the wire-server release (add ldap-scim-bridge chart in wire release #3999)

• Disable integration subchart of wire-server by default (wire-server chart: Disable integration chart by default #3682)

• Provide password as value in elasticsearch-ephemeral. This way we can use
  different passwords on our test systems. Ensuring that the password is really
  configurable (and not accidentally hardcoded somewhere.) (elasticsearch-ephemeral: Provide password as value #3994)

• Upgraded fluent-bit chart to version 0.46.2
  Added example values for fluent-bit helm chart for output to syslog server (Bump fluent-bit chart version and add example values for syslog #4012)

• Ported 2FA tests to the new integration test suite ([chore] Port 2FA tests #3986)

• To ensure certificate revocations get active in a short time frame, disable
  caching of proxy results on client side by setting respective HTTP headers. (smallstep-accomp: Prevent smallstep proxy caching #3952)

• Ensure that targets of the smallstep nginx proxy are resolved at runtime via the
  configured DNS server. This has two benefits: The target gets adjusted when it's
  changed at the DNS server. And, nginx doesn't fail to start when the target
  doesn't exist yet. (smallstep-accomp: Resolve proxy target on request (#3946) #3947)

• Use schema-profunctor for user event serialisation and introduce golden tests (Refactor and test user event serialisation #3912)

• Setup federation-v0 environment for use in integration tests:

  • add federation-v0 domain to test environment
  • provision integration certificates with cert-manager (Federation-v0 setup in integration tests #3849, WPB-6309 deploy the released mandarin version in kind dev environment #3898)

• Add assets to output of ejpd-info end-point in stern; also:

  • [brig] now talks to carghold for profile picture extraction;
  • [integration] migrate ejpd tests;
  • [integration] enhanced shouldMatch shows a diff on failure now;
  • [integration] added shouldMatchLeniently for rule-based canonicalization of arguments (Make ejpd data model exhaustive #3875)

• Bump hsaml2, saml2-web-sso dependencies. (Bump hsaml2, saml2-web-sso dependencies. #3995)

• Remove support for push token transport types APNSVoIP, APNSVoIPSandbox from gundeck. (Recover "WPB-5204 Remove unused APNS_VOIP code (#3695)" #3967)

• Include remote domain in federator error logs (Make federator error logs more informative. #3919)

• Remove remaining splinters of wai-routing, wai-predicate from brig. (Finish servantifying brig #3996)

Federation changes

• The on-conversation-updated notification is now queued instead of being sent directly. A new version of the notification has been introduced with a different JSON format for the body, mostly for testing purposes of the versioning system.

  Since the notification is now sent asynchronously, some error conditions in case of unreachable backends cannot be triggered anymore. ([WPB-183] Version federation API queue notifications #3831)

• Versioning of backend to backend notifications. Notifications are now stored in "bundles" containing a serialised payload for each supported version. The background worker then dynamically selects the best version to use and sends only the notification corresponding to that version.
  ([WPB-183] Version federation API queue notifications #3831)