Merge pull request #1338 from cyberark/bump-version-1.7.0

Bump version 1.7.0

.gitignore

@@ -1,51 +1,48 @@
+# Miscellaneous files
+.DS_Store
 .env
+.idea
+.jekyll-cache/
+.keep
+.vscode/
+
 bench.*
 debug
 debug.*
-.vscode/
-.idea
-.keep
+dist
+run
+tmp
 vendor
+
 /demo/godoc
 /secretless
 /showpw
-run
-tmp
-dist
+
+*.bak
 *.retry
+*.so
+*.sw[po]
+
+# Demo temp files
 demo/**/proxy_tls
 demo/**/myapp
 !demo/**/src/myapp
+
+# Test temp files
+c.out
+coverage.xml
+results.json
 test/junit.*
 test/**/junit.*
 test/*.xml
 test/plugin/out/
 
-# Remove common editors' swapfiles
-*.sw[po]
-
-# Remove sed tempfiles
-*.bak
-
-# Remove compiled go plugin files
-*.so
-
-# Remove OSX-specific temp files
-.DS_Store
-
 # We don't use dep anymore
 Gopkg.*
 
 # Ignore auto-generated temporary files
 github.com/cyberark/
 
-# Ignore any JSON results files
-results.json
-
-# Ignore test coverage files
-c.out
-coverage.xml
-
 # Image scan files
 scan_results-*.json
 scan_results-*.xml

CHANGELOG.md

@@ -6,21 +6,32 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [1.7.0] - 2020-09-11
+
 ### Added
 - Secretless and secretless-redhat containers now use Alpine 3.12 as their base
-  image. [PR #1296](https://github.com/cyberark/secretless-broker/pull/1296)
+  image. [PR cyberark/secretless-broker#1296](https://github.com/cyberark/secretless-broker/pull/1296)
 - MySQL and PostgreSQL connectors support SSL host name verification with
   `verify-full` SSL mode. Also adds optional `sslhost` configuration parameter
-  that is compared to the server's certificate SAN. [#548](https://github.com/cyberark/secretless-broker/issues/548)
+  that is compared to the server's certificate SAN.
+  [cyberark/secretless-broker#548](https://github.com/cyberark/secretless-broker/issues/548)
 - Generic HTTP connector now supports `queryParam` as a configurable section
-  in the secretless configuration file, under `config`. This allows the
+  in the Secretless configuration file, under `config`. This allows the
   construction of a query string which can have credentials injected
-  as needed. [#1290](https://github.com/cyberark/secretless-broker/issues/1290)
+  as needed.
+  [cyberark/secretless-broker#1290](https://github.com/cyberark/secretless-broker/issues/1290)
 - Generic HTTP connector now supports `oauth1` as a configurable section in the
   secretless configuration file, under `config`. This allows the construction of
   a header for an OAuth 1.0 request. The OAuth 1.0 feature currently only supports
   HMAC-SHA1, but there is an [issue](https://github.com/cyberark/secretless-broker/issues/1324)
-  logged to support other hashing methods. [#1297](https://github.com/cyberark/secretless-broker/issues/1297)
+  logged to support other hashing methods.
+  [cyberark/secretless-broker#1297](https://github.com/cyberark/secretless-broker/issues/1297)
+- Many (20+) example generic connector configurations were added to the project,
+  to demonstrate support for a broad set of popular APIs and to serve as an
+  example for other APIs users may need to use Secretless with their apps.
+  See [here](https://github.com/cyberark/secretless-broker/tree/master/examples/generic_connector_configs)
+  for the full list of examples.
+  [cyberark/secretless-broker#1248](https://github.com/cyberark/secretless-broker/issues/1248)
 
 ## [1.6.0] - 2020-05-04
 
@@ -502,7 +513,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 - The first tagged version.
 
-[Unreleased]: https://github.com/cyberark/secretless-broker/compare/v1.6.0...HEAD
+[Unreleased]: https://github.com/cyberark/secretless-broker/compare/v1.7.0...HEAD
 [0.2.0]: https://github.com/cyberark/secretless-broker/compare/v0.1.0...v0.2.0
 [0.3.0]: https://github.com/cyberark/secretless-broker/compare/v0.2.0...v0.3.0
 [0.4.0]: https://github.com/cyberark/secretless-broker/compare/v0.3.0...v0.4.0
@@ -528,3 +539,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 [1.5.1]: https://github.com/cyberark/secretless-broker/compare/v1.5.0...v1.5.1
 [1.5.2]: https://github.com/cyberark/secretless-broker/compare/v1.5.1...v1.5.2
 [1.6.0]: https://github.com/cyberark/secretless-broker/compare/v1.5.2...v1.6.0
+[1.7.0]: https://github.com/cyberark/secretless-broker/compare/v1.6.0...v1.7.0

CONTRIBUTING.md

@@ -415,35 +415,36 @@ than master. Make sure your change to secretless considers this.
 ## Releasing
 
 ### Verify and update dependencies
-1. Check whether any dependencies have been changed since the last release by running
-   `./bin/check_dependencies`. The script will tell you what has changed. Beware - the script at current DOES NOT appropriately handle `replace` directives - you will need to process these manually.
-
-1. If any dependencies have changed, for each changed dependency in assets/license_finder.txt you'll need to do the following:
-
-   - Update the [dependency spreadsheet](https://cyberark365.sharepoint.com/:x:/s/Conjur/Edko_eT7CfpEuPxnnbIEfmAB4j2ybNozY9B8QAIDOxKynQ?e=CfP6ym).
-     Copy the most recent release's tab to a new tab for this new version. Use
-     the diff of `assets/license_finder.txt` to update the spreadsheet:
-     - For new dependencies, add a row to the spreadsheet. Make sure
-       a corresponding update is made to NOTICES.txt to add the dependency
-       and copyright.
-     - For dependencies whose version has changed, update the version and
-       license link in the spreadsheet. Be sure to also update the version and
-       copyright in NOTICES.txt.
-     - For dependencies that have been removed, delete the row from the
-       spreadsheet and remove the dependency / copyright from NOTICES.txt.
+1. Review the changes to `go.mod` since the last release and make any needed
+   updates to [NOTICES.txt](./NOTICES.txt):
+   - Add any dependencies that have been added since the last tag, including
+     an entry for them alphabetically under the license type (make sure you
+     check the license type for the version of the project we use) and a copy
+     of the copyright later in the same file.
+   - Update any dependencies whose versions have changed - there are usually at
+     least two version entries that need to be modified, but if the license type
+     of the dependency has also changed, then you will need to remove the old
+     entries and add it as if it were a new dependency.
+   - Remove any dependencies we no longer include.
 
    If no dependencies have changed, you can move on to the next step.
 
 ### Update the version and changelog
 1. Create a new branch for the version bump.
 1. Based on the unreleased content, determine the new version number and update
    the [version.go](pkg/secretless/version.go) file.
-1. Run `./bin/prefill_changelog` to populate the [changelog](CHANGELOG.md) with
-   the changes included in the release.
+1. Review the [changelog](CHANGELOG.md) to make sure all relevant changes since
+   the last release have been captured. You may find it helpful to look at the
+   list of commits since the last release - you can find this by visiting the
+   [releases page](https://github.com/cyberark/secretless-broker/releases) and
+   clicking the "`N commits` to master since this release" link for the latest
+   release.
+
+   This is also a good time to make sure all entries conform to our
+   [changelog guidelines](https://github.com/cyberark/community/blob/master/Conjur/CONTRIBUTING.md#changelog-guidelines).
 1. Commit these changes - `Bump version to x.y.z` is an acceptable commit message - and open a PR
    for review. Your PR should include updates to `pkg/secretless/version.go`,
-   `CHANGELOG.md`, and if there are any license updates, to `NOTICES.txt` and
-   `assets/license_finder.txt`.
+   `CHANGELOG.md`, and if there are any license updates, to `NOTICES.txt`.
 
 ### Add a git tag
 1. Once your changes have been reviewed and merged into master, tag the version
@@ -453,11 +454,12 @@ than master. Make sure your change to secretless considers this.
 1. Push the tag: `git push vx.y.z` (or `git push origin vx.y.z` if you are working
    from your local machine).
 
-### Build a release
+### Create a GitHub pre-release
 **Note:** Until the stable quality exercises have completed, the GitHub release
 should be officially marked as a `pre-release` (eg "non-production ready")
-1. From a **clean checkout of master** run `./bin/build_release` to generate
-   the release artifacts.
+
+1. From the Jenkins pipeline for the tag, retrieve the archived `dist/goreleaser`
+   directory.
 1. Create a GitHub release from the tag, add a description by copying the CHANGELOG entries
    from the version, and upload the release artifacts from `dist/goreleaser`
    to the GitHub release. The following artifacts should be uploaded to the release:

NOTICES.txt

@@ -21,9 +21,11 @@ SECTION 1: Apache License 2.0
 >>> github.com/google/btree-1.0.0
 >>> github.com/googleapis/gnostic-0.3.1
 >>> github.com/heptiolabs/healthcheck-0.0.0-20180807145615-6ff867650f40
+>>> github.com/modern-go/reflect2-1.0.1
 >>> github.com/opencontainers/go-digest-1.0.0-rc1
 >>> github.com/opencontainers/image-spec-1.0.1
 >>> github.com/prometheus/client_golang-1.2.1
+>>> google.golang.org/appengine-1.4.0
 >>> gopkg.in/yaml.v2-2.2.2
 >>> k8s.io/api-0.0.0-20180712090710-2d6f90ab1293
 >>> k8s.io/apiextensions-apiserver-0.0.0-20180808065829-408db4a50408
@@ -298,6 +300,23 @@ See the License for the specific language governing permissions and
 limitations under the License.
 
 
+>>> github.com/modern-go/reflect2-1.0.1
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 >>> github.com/opencontainers/go-digest-1.0.0-rc1
 
 Copyright 2016 Docker, Inc.
@@ -349,6 +368,23 @@ See the License for the specific language governing permissions and
 limitations under the License.
 
 
+>>> google.golang.org/appengine-1.4.0
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 >>> gopkg.in/yaml.v2-2.2.2
 
 Copyright {yyyy} {name of copyright owner}

SECURITY.md

@@ -14,7 +14,7 @@ Thank you for improving the security of the Conjur suite. We appreciate your eff
 responsible disclosure and will make every effort to acknowledge your
 contributions.
 
-Report security bugs by emailing the lead maintainers at security@secretless.io.
+Report security bugs by emailing the lead maintainers at security@conjur.org.
 
 The maintainers will acknowledge your email within 2 business days. Subsequently, we will 
 send a more detailed response within 2 business days of our acknowledgement indicating