openstack/barbican — Week of 2026-09-19

Crypto agility. The headline change extends the SimpleCrypto plugin's asymmetric key generation with crypto-agility support (~300 lines), broadening the algorithms and parameters the built-in plugin can produce rather than hard-coding a single scheme. See 985080.

Security and correctness. A BOLA/IDOR flaw in the consumer GET endpoints was closed, preventing cross-object access through the consumer lookup path. On the operator side, barbican-manage had its logging.setup() call reordered so early log output is captured correctly, and db_manage.py no longer injects the current working directory onto sys.path — a small but real hardening of the management tooling.

Docs. Policy documentation received a broad typo and wording pass, and the KEK rotation guide was corrected to state that new keys must be prepended rather than appended during rotation — a meaningful semantic fix for anyone following the procedure. The mailing list link was also refreshed.

Release plumbing. The stable/2026.2 branch was cut, with .gitreview, tox constraints, and master version markers updated in lockstep.