mostly done. (#188)

v0lkan · web-flow · commit 20007c299864 · 2025-07-19T17:42:23.000-07:00
Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;
diff --git a/docs-src/content/operations/release.md b/docs-src/content/operations/release.md
@@ -43,9 +43,9 @@ Before every release:
 8. Make sure version numbers in the code are updated to reflect the release:
 
 ```go
-const SpikeNexusVersion = "0.4.1"
-const SpikePilotVersion = "0.4.1"
-const SpikeKeeperVersion = "0.4.1"
+const SpikeNexusVersion = "0.4.2"
+const SpikePilotVersion = "0.4.2"
+const SpikeKeeperVersion = "0.4.2"
 ````
 
 Release process:
diff --git a/docs-src/content/tracking/changelog.md b/docs-src/content/tracking/changelog.md
@@ -12,14 +12,31 @@ sort_by = "weight"
 
 ## Recent
 
+## [0.4.2] - 2025-07-19
+
+### Added
+
 * Ability to configure to not how SPIKE banner on startup.
 * Ability to configure to show a warning if memory locking is not
   available on the system.
 * SPIKE can now be deployed from SPIFFE helm charts. Tested and verified!
-* Moved logging to SPIKE SDK.
+* Documentation updates.
+* SPIKE can be now be installed from [SPIFFE Helm 
+  Charts](https://github.com/spiffe/helm-charts-hardened) and can 
+  [federate secrets across clusters](https://vimeo.com/v0lkan/spike-federation)
+
+### Changed
+
+* Moved logging to SPIKE SDK. VSecM v2 will share the same logging setup.
 * `spike policy` command now accepts file input; you can design your policies
   as `yaml` files and then `spike policy apply -f` them.
 
+### Security
+
+* Fixed [`GHSA-fv92-fjc5-jj9h`: `mapstructure` May Leak Sensitive Information 
+  in Logs When Processing Malformed 
+  Data](https://github.com/spiffe/spike/security/dependabot/6)
+
 ## [0.4.1] - 2025-06-01 (*prerelease*)
 
 ### Added
diff --git a/docs-src/content/tracking/snapshots.md b/docs-src/content/tracking/snapshots.md
@@ -17,6 +17,7 @@ The **GitHub** repository contains the latest documentation of **SPIKE** already
 Here are the links to point-in-time documentation snapshots at each release:
 
 * [current](https://github.com/spiffe/spike/tree/main/docs)
+* [v0.4.2](https://github.com/spiffe/spike/tree/v0.4.2/docs)
 * [v0.4.1](https://github.com/spiffe/spike/tree/v0.4.1/docs)
 * [v0.4.0](https://github.com/spiffe/spike/tree/v0.4.0/docs)
 * [v0.3.1](https://github.com/spiffe/spike/tree/v0.3.1/docs)
diff --git a/docs/architecture/adrs/adr-0017/index.html b/docs/architecture/adrs/adr-0017/index.html
@@ -755,7 +755,7 @@ <h2 id="decision">Decision</h2>
 <p><strong>Synchronous Persistence</strong>: All database persistence operations will now be
 synchronous.</p>
 <ul>
-<li><strong>Justification</strong>: Since SQLite is sufficiently fast, and we are not seeing
+<li><strong>Justification</strong>: Since SQLite is fast enough, and we are not seeing
 performance bottlenecks at the database level, the simplicity of synchronous
 operations outweighs the potential complexity of maintaining asynchronous
 ones.</li>
diff --git a/docs/architecture/adrs/adr-0021/index.html b/docs/architecture/adrs/adr-0021/index.html
@@ -773,7 +773,7 @@ <h2 id="rationale">Rationale</h2>
 <li><strong>Security</strong>: <strong>SPIKE Keeper</strong>s hold only a single shard, which is not
 adequate to regenerate the root key. They are never aware of other
 <strong>SPIKE Keeper</strong>s or the full key. This limits their attack surface.</li>
-<li><strong>Simplicity</strong>: By eliminating configuration and inter-service dependencies,
+<li><strong>Simplicity</strong>: By removing configuration and inter-service dependencies,
 <strong>SPIKE Keeper</strong>s become easy to deploy, replace, and scale.</li>
 <li><strong>Availability</strong>: The polling and rehydration mechanism ensures that
 <em>SPIKE Nexus</em>* can automatically recover lost shards without manual
diff --git a/docs/community/hello/index.html b/docs/community/hello/index.html
@@ -748,7 +748,7 @@ <h2 id="empower-our-journey-fist">Empower Our Journey ✊</h2>
 <p><a href="https://github.com/spiffe/spike">⭐️ Star <strong>SPIKE</strong> to show your support</a>.</p>
 <p>Your support enables us to connect with even more individuals through this
 incredible technology.</p>
-<h2 id="thank-you-heart">Thank You ❤️</h2>
+<h2 id="thank-you-red-heart">Thank You ❤️</h2>
 <p>Thanks so much for your interest: It means a lot 🙏</p>
 <hr />
 <ul>
diff --git a/docs/community/presentations/index.html b/docs/community/presentations/index.html
@@ -751,8 +751,13 @@ <h1 id="presentations-and-demos">Presentations and Demos</h1>
 enhanced starter script, policy-based access control, and metadata support.</li>
 <li><a href="https://vimeo.com/v0lkan/spike-doomsday">Secrets Resiliency with SPIKE: Self-Healing and Doomsday Recovery</a>:<br>
 Secrets management is critical, but what happens when everything fails? In
-this video, we explore SPIKE’s disaster recovery mechanisms, covering both
+this video, we explore <strong>SPIKE</strong>’s disaster recovery mechanisms, covering both
 self-healing capabilities and the manual break-the-glass recovery process.</li>
+<li><a href="https://vimeo.com/v0lkan/spike-federation">Federating Secrets with SPIFFE and SPIKE</a><br>
+In this demo, we show how you can deploy <strong>SPIRE</strong> and <strong>SPIKE</strong> from SPIFFE
+Helm charts. We then establish a multi-cluster secret federation where
+the workload clusters can securely access secrets stored in the management
+cluster.</li>
 </ul>
 <hr />
 <ul>
diff --git a/docs/getting-started/bare-metal/index.html b/docs/getting-started/bare-metal/index.html
@@ -932,7 +932,7 @@ <h2 id="configure-local-dns">Configure Local DNS</h2>
 </span><span style="color:#bf616a;">127.0.0.1</span><span> spire.spike.ist
 </span></code></pre>
 <h2 id="starting-spike">Starting SPIKE</h2>
-<p>There is a starter script that combines and automates some of the steps in the
+<p>There is a starter script that combines and automates some steps in the
 following sections. It configures and runs SPIRE Server, SPIRE Agent,
 SPIKE Nexus, and SPIKE Keeper.</p>
 <p>You can run this to start all the required components:</p>
@@ -1068,7 +1068,7 @@ <h2 id="uninstalling-spike">Uninstalling SPIKE</h2>
 are compact, consuming minimal disk space and no resources when inactive. As
 simple executable files, they have no impact on your system’s performance when
 not in use. Therefore, keeping them installed is completely harmless.</p>
-<p>However, if you want to wipe everything out, you can just remove the binaries
+<p>However, if you want to wipe everything out, you can remove the binaries
 and <strong>SPIKE</strong>’s data folder, and that would be it:</p>
 <pre data-lang="bash" style="background-color:#2b303b;color:#c0c5ce;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="color:#bf616a;">rm -rf ~</span><span>/.spike
 </span><span style="color:#bf616a;">rm</span><span> spike
diff --git a/docs/getting-started/local-deployment/index.html b/docs/getting-started/local-deployment/index.html
@@ -814,7 +814,7 @@ <h2 id="forwarding-the-local-registry">Forwarding the Local Registry</h2>
 </span><span style="color:#65737e;"># Forwarding from 127.0.0.1:5000 -&gt; 5000
 </span><span style="color:#65737e;"># Forwarding from [::1]:5000 -&gt; 5000
 </span></code></pre>
-<p>Leave this terminal open. We will execute the rest of the commands on
+<p>Leave this terminal open. We will execute the rest of the commands in<br />
 a separate terminal window.</p>
 <h2 id="build-container-images-locally">Build Container Images Locally</h2>
 <p>We have a <code>make</code> target to build the container images locally.</p>
@@ -877,7 +877,7 @@ <h2 id="you-are-all-set">You Are All Set</h2>
 about <strong>SPIKE</strong>’s internals, or <a href="https://spike.ist/architecture/" title="SPIKE Architecture">learn more about <strong>SPIKE</strong>’s
 architecture</a> or <a href="https://spike.ist/architecture/security-model/" title="SPIKE Security Model">security model</a>.</p>
 <p>You might also want to try <a href="https://spike.ist/getting-started/bare-metal/" title="SPIKE on Linux">building <strong>SPIKE</strong> on a bare metal
-Linux</a>, if you want to see how <strong>SPIKE</strong> can be used on a bare
+Linux</a> if you want to see how <strong>SPIKE</strong> can be used on a bare
 metal Linux machine without using container orchestration such as <em>Kubernetes</em></p>
 <hr />
 <ul>
diff --git a/docs/operations/production/index.html b/docs/operations/production/index.html
@@ -946,7 +946,7 @@ <h3 id="single-tenancy">Single Tenancy</h3>
 <p><strong>SPIKE Nexus</strong> is recommended to be the only main process running on a machine.
 This reduces the risk that another process running on the same
 machine is compromised and can interact with <strong>SPIKE Nexus</strong>.</p>
-<p>In a Kubernetes deployment, you can achieve this with setting up appropriate
+<p>In a Kubernetes deployment, you can achieve this by setting up appropriate
 Node affinity rules.</p>
 <h3 id="user-privileges">User Privileges</h3>
 <ul>
@@ -1250,7 +1250,7 @@ <h3 id="container-specific-hardening">Container-Specific Hardening</h3>
 threats and security best practices. Security configuration should be treated
 as a continuous process rather than a one-time setup.</p>
 <h2 id="conclusion">Conclusion</h2>
-<p>Although <strong>SPIKE</strong> is designed with security best-practices in mind, a
+<p>Although <strong>SPIKE</strong> is designed with security best practices in mind, a
 multi-layer approach focusing on system, process, and network security is
 important when configuring <strong>SPIKE</strong> for production.</p>
 <p>The combination of <strong>mTLS API protection</strong>, <strong>SPIFFE attestation</strong>, and proper
diff --git a/docs/operations/release/index.html b/docs/operations/release/index.html
@@ -759,9 +759,9 @@ <h2 id="before-every-release">Before Every Release</h2>
 docs.</li>
 <li>Make sure version numbers in the code are updated to reflect the release:</li>
 </ol>
-<pre data-lang="go" style="background-color:#2b303b;color:#c0c5ce;" class="language-go "><code class="language-go" data-lang="go"><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikeNexusVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.1</span><span>&quot;
-</span><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikePilotVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.1</span><span>&quot;
-</span><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikeKeeperVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.1</span><span>&quot;
+<pre data-lang="go" style="background-color:#2b303b;color:#c0c5ce;" class="language-go "><code class="language-go" data-lang="go"><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikeNexusVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.2</span><span>&quot;
+</span><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikePilotVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.2</span><span>&quot;
+</span><span style="color:#b48ead;">const </span><span style="color:#bf616a;">SpikeKeeperVersion </span><span>= &quot;</span><span style="color:#a3be8c;">0.4.2</span><span>&quot;
 </span></code></pre>
 <p>Release process:</p>
 <ul>
@@ -791,7 +791,7 @@ <h2 id="spike-smoke-tests">SPIKE Smoke Tests</h2>
 </blockquote>
 <p>Note that these are instructions for a manual smoke test, and it’s not a
 replacement for a full integration test. We may add more steps, but we’ll
-keep it lightweight. — Passing the smoke test means that the core components
+keep it lightweight—Passing the smoke test means that the core components
 and the features of the system are reliably functional.</p>
 <p>Here is a list of manual tests that can be done before every release:</p>
 <ol>
diff --git a/docs/search_index.en.js b/docs/search_index.en.js
diff --git a/docs/tracking/changelog/index.html b/docs/tracking/changelog/index.html
@@ -199,6 +199,9 @@
                                                 <li>
                                                         <a href="https://spike.ist/tracking/changelog/#recent">Recent</a>
                                                     </li>
+                                                <li>
+                                                        <a href="https://spike.ist/tracking/changelog/#0-4-2-2025-07-19">[0.4.2] - 2025-07-19</a>
+                                                    </li>
                                                 <li>
                                                         <a href="https://spike.ist/tracking/changelog/#0-4-1-2025-06-01-prerelease">[0.4.1] - 2025-06-01 (prerelease)</a>
                                                     </li>
@@ -750,14 +753,32 @@
             
         <h1 id="spike-changelog">SPIKE Changelog</h1>
 <h2 id="recent">Recent</h2>
+<h2 id="0-4-2-2025-07-19">[0.4.2] - 2025-07-19</h2>
+<h3 id="added">Added</h3>
 <ul>
 <li>Ability to configure to not how SPIKE banner on startup.</li>
 <li>Ability to configure to show a warning if memory locking is not
 available on the system.</li>
 <li>SPIKE can now be deployed from SPIFFE helm charts. Tested and verified!</li>
+<li>Documentation updates.</li>
+<li>SPIKE can be now be installed from <a href="https://github.com/spiffe/helm-charts-hardened">SPIFFE Helm
+Charts</a> and can
+<a href="https://vimeo.com/v0lkan/spike-federation">federate secrets across clusters</a></li>
+</ul>
+<h3 id="changed">Changed</h3>
+<ul>
+<li>Moved logging to SPIKE SDK. VSecM v2 will share the same logging setup.</li>
+<li><code>spike policy</code> command now accepts file input; you can design your policies
+as <code>yaml</code> files and then <code>spike policy apply -f</code> them.</li>
+</ul>
+<h3 id="security">Security</h3>
+<ul>
+<li>Fixed <a href="https://github.com/spiffe/spike/security/dependabot/6"><code>GHSA-fv92-fjc5-jj9h</code>: <code>mapstructure</code> May Leak Sensitive Information
+in Logs When Processing Malformed
+Data</a></li>
 </ul>
 <h2 id="0-4-1-2025-06-01-prerelease">[0.4.1] - 2025-06-01 (<em>prerelease</em>)</h2>
-<h3 id="added">Added</h3>
+<h3 id="added-1">Added</h3>
 <ul>
 <li>Initial support for Kubernetes deployments.</li>
 <li>Better shard sanitization during recovery procedures.</li>
@@ -766,7 +787,7 @@ <h3 id="added">Added</h3>
 <li>Added the ability to optionally skip database schema creation during SPIKE
 initialization.</li>
 </ul>
-<h3 id="changed">Changed</h3>
+<h3 id="changed-1">Changed</h3>
 <ul>
 <li><strong>BREAKING</strong>: SDK validation methods now take trust root as an argument.</li>
 <li><strong>BREAKING</strong>: <code>SPIKE_NEXUS_KEEPER_URL</code> is now a comma-delimited list of URLs
@@ -783,7 +804,7 @@ <h3 id="fixed">Fixed</h3>
 restoring the data.</li>
 </ul>
 <h2 id="0-4-0-2025-04-16">[0.4.0] - 2025-04-16</h2>
-<h3 id="added-1">Added</h3>
+<h3 id="added-2">Added</h3>
 <ul>
 <li>Added more configuration options to SPIKE Nexus.</li>
 <li>Updated documentation around security and production hardening.</li>
@@ -803,7 +824,7 @@ <h3 id="fixed-1">Fixed</h3>
 up when no longer needed (but not before).</li>
 <li>Various bug fixes and improvements.</li>
 </ul>
-<h3 id="changed-1">Changed</h3>
+<h3 id="changed-2">Changed</h3>
 <ul>
 <li>Moved some common reusable code to <code>spike-sdk-go</code>.</li>
 <li>Various changes and improvements in SPIKE Go SDK.</li>
@@ -814,7 +835,7 @@ <h3 id="changed-1">Changed</h3>
 the start of an audit trail).</li>
 <li>Improved <code>spike policy</code> commands with better UX and error handling.</li>
 </ul>
-<h3 id="security">Security</h3>
+<h3 id="security-1">Security</h3>
 <ul>
 <li>Added cache invalidation headers to all API responses.</li>
 <li>For added security, we strip symbols during the build process now.</li>
@@ -824,7 +845,7 @@ <h3 id="security">Security</h3>
 <li><a href="https://github.com/spiffe/spike/security/dependabot/4">Fixed <code>CVE-2025-22870</code>: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net</a></li>
 </ul>
 <h2 id="0-3-1-2025-03-04">[0.3.1] - 2025-03-04</h2>
-<h3 id="added-2">Added</h3>
+<h3 id="added-3">Added</h3>
 <ul>
 <li>SPIKE Nexus now accepts a dynamic number of SPIKE Keepers and Shamir share
 threshold (defaults to 3 keepers, and minimum 2 shares (out of 3) to
@@ -834,7 +855,7 @@ <h3 id="added-2">Added</h3>
 <li>Various documentation updates.</li>
 <li>Minor bug fixes in initialization scripts.</li>
 </ul>
-<h3 id="changed-2">Changed</h3>
+<h3 id="changed-3">Changed</h3>
 <ul>
 <li>Secrets now rehydrate from the backing store immediately after SPIKE
 Nexus crashes. Former implementation was using an optimistic algorithm
@@ -843,7 +864,7 @@ <h3 id="changed-2">Changed</h3>
 fixes that issue and also ensures that SPIKE Nexus’ memory continues to
 be the primary source of truth (by design).</li>
 </ul>
-<h3 id="security-1">Security</h3>
+<h3 id="security-2">Security</h3>
 <ul>
 <li>SPIKE Nexus now securely erases the old root key and shards from memory after
 it is no longer necessary. Before, it was left to the garbage collector to
@@ -854,7 +875,7 @@ <h3 id="security-1">Security</h3>
 <h2 id="0-3-0-2025-02-20">[0.3.0] - 2025-02-20</h2>
 <p>This release was focused around bugfixes, stability, documentation, and
 disaster recovery.</p>
-<h3 id="added-3">Added</h3>
+<h3 id="added-4">Added</h3>
 <ul>
 <li>Documentation: SPIKE Production Hardening Guide is complete and ready for
 consumption (<em>it was in draft mode before</em>).</li>
@@ -869,7 +890,7 @@ <h3 id="added-3">Added</h3>
 and design decisions transparently.</li>
 <li>Started working on containerization (<em>though it’s still a work in progress</em>).</li>
 </ul>
-<h3 id="changed-3">Changed</h3>
+<h3 id="changed-4">Changed</h3>
 <ul>
 <li>SPIKE Website has undergone a major overhaul.</li>
 <li>Documentation updates, especially around security and disaster recovery.</li>
@@ -880,7 +901,7 @@ <h3 id="changed-3">Changed</h3>
 <li>Significant updates in <a href="https://github.com/spiffe/spike-sdk-go">SPIKE go SDK</a>.</li>
 </ul>
 <h2 id="0-2-1-2025-01-23">[0.2.1] - 2025-01-23</h2>
-<h3 id="added-4">Added</h3>
+<h3 id="added-5">Added</h3>
 <ul>
 <li>Enabled policy-based access control.</li>
 <li>The root key that SPIKE Nexus generates is now split into several Shamir
@@ -898,21 +919,21 @@ <h3 id="added-4">Added</h3>
 <li>Implemented a Secret Metadata API.</li>
 <li>Implemented exponential retries across several API-consuming methods.</li>
 </ul>
-<h3 id="changed-4">Changed</h3>
+<h3 id="changed-5">Changed</h3>
 <ul>
 <li><strong>BREAKING</strong>: changed the CLI usage. Instead of <code>spike get</code>, for example, we
 now use <code>spike secret get</code>. The reason for this change is that we introduced
 a <code>policy</code> command (i.e. <code>spike policy get</code>).</li>
 </ul>
-<h3 id="security-2">Security</h3>
+<h3 id="security-3">Security</h3>
 <ul>
 <li><a href="https://github.com/spiffe/spike/security/dependabot/1">Fixed <code>CVE-2024-45337</code>: Misuse of ServerConfig.PublicKeyCallback may cause
 authorization bypass in golang.org/x/crypto</a></li>
 <li><a href="https://github.com/spiffe/spike/security/dependabot/2">Fixed <code>CVE-2024-45338</code>: Non-linear parsing of case-insensitive content in
 <code>golang.org/x/net/htm</code></a></li>
 </ul>
 <h2 id="0-2-0-2024-11-22">[0.2.0] - 2024-11-22</h2>
-<h3 id="added-5">Added</h3>
+<h3 id="added-6">Added</h3>
 <ul>
 <li>Added configuration options for SPIKE Nexus and SPIKE Keeper.</li>
 <li>Documentation updates.</li>
@@ -924,15 +945,15 @@ <h3 id="added-5">Added</h3>
 <li>Created initial smoke/integration tests.</li>
 <li>Stability improvements.</li>
 </ul>
-<h3 id="changed-5">Changed</h3>
+<h3 id="changed-6">Changed</h3>
 <ul>
 <li>Removed password authentication for admin users. Admin users’ SVIDs
 are good enough to authenticate them.</li>
 <li>Implemented passwordless admin login flow
 (<em>the neat thing about passwords is: you don’t need them</em>).</li>
 </ul>
 <h2 id="0-1-0-2024-11-06">[0.1.0] - 2024-11-06</h2>
-<h3 id="added-6">Added</h3>
+<h3 id="added-7">Added</h3>
 <ul>
 <li>Implemented <code>put</code>, <code>read</code>, <code>delete</code>, <code>undelete</code>, and <code>list</code> functionalities.</li>
 <li>Created initial documentation, README, and related files.</li>
diff --git a/docs/tracking/snapshots/index.html b/docs/tracking/snapshots/index.html
@@ -723,6 +723,7 @@ <h2 id="snapshots">Snapshots</h2>
 <p>Here are the links to point-in-time documentation snapshots at each release:</p>
 <ul>
 <li><a href="https://github.com/spiffe/spike/tree/main/docs">current</a></li>
+<li><a href="https://github.com/spiffe/spike/tree/v0.4.2/docs">v0.4.2</a></li>
 <li><a href="https://github.com/spiffe/spike/tree/v0.4.1/docs">v0.4.1</a></li>
 <li><a href="https://github.com/spiffe/spike/tree/v0.4.0/docs">v0.4.0</a></li>
 <li><a href="https://github.com/spiffe/spike/tree/v0.3.1/docs">v0.3.1</a></li>
diff --git a/hack/scm/tag.sh b/hack/scm/tag.sh
@@ -4,4 +4,4 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-git tag -s v0.4.1
+git tag -s v0.4.2
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -18,9 +18,9 @@ import (
 // These constants are automatically updated during the release process.
 // Please do not modify them manually.
 
-const SpikeNexusVersion = "0.4.1"
-const SpikePilotVersion = "0.4.1"
-const SpikeKeeperVersion = "0.4.1"
+const SpikeNexusVersion = "0.4.2"
+const SpikePilotVersion = "0.4.2"
+const SpikeKeeperVersion = "0.4.2"
 
 // #endregion
 
