Files
galaxy/lib
mvdbeek df2be47bb1 Fix Hashicorp Vault 2.0 non-canonical path rejection
Vault 2.0 rejects KV paths with leading or double slashes that Vault 1.x
silently normalized. VaultKeyPrefixWrapper emitted `/{prefix}/{key}`,
producing `//galaxy/...` on the wire. Strip outer slashes from the
configured prefix and validate it at construction, and fall back to the
legacy double-slash key once on read so pre-upgrade secrets survive,
rewriting under the canonical path.

Integration test pins hashicorp/vault:2.0, passes dev-mode settings via
env vars (the entrypoint duplicates CLI flags), and sets SKIP_SETCAP=1
so the non-root image doesn't abort on cap_ipc_lock.
2026-04-20 20:16:34 +02:00
..