Pular para o conteúdo principal

Lacuna TrustBridge changelog

TrustBridge has two release lines, and they release independently:

  • Server: the container image trustbridge-server:<version>. Entries are headed Server X.Y.Z.
  • Workstation: the Workstation Service and the Tray App in one MSI, TrustBridge-Workstation-<version>-x64.msi. Entries are headed Workstation X.Y.Z.

A Server and its workstations talk over a versioned workstation protocol. A Server accepts its own protocol and the one before it, so the usual order is: upgrade the Server first, then the fleet, at most one protocol behind. Workstation 1.5.0 is the exception: it and Server 1.13.0 go together.

ServerWorkstation protocols accepted
1.13.04–5 (a protocol 4 machine connects and signs for sessions already bound to it, but is never offered a new session)
1.9.0 – 1.12.03–4
1.7.0 – 1.8.02–3
1.3.0 – 1.6.11–2
1.0.1 – 1.2.01 (no Workstation release speaks it)
WorkstationProtocolServer needed
1.5.051.13.0
1.4.0 – 1.4.241.9.0 to 1.12.0 (Server 1.13.0 admits it but sends it no new sessions)
1.1.0 – 1.3.031.7.0 to 1.12.0 (1.8.0 or later recommended from Workstation 1.2.0)
1.0.0 – 1.0.121.3.0 to 1.8.0

A machine with a newer protocol than its Server's window is refused at the handshake, receives no PKI licence, and every certificate on it reads UNTRUSTED until the Server is upgraded. A machine with an older protocol than the window is refused as needing an update.

A Server release that updates the database model applies its migrations at start, and the previous version then refuses to start against that database: rolling back means restoring the database backup taken before the upgrade, not just switching the image tag back.

Workstation 1.5.0 (2026-10-04)​

Package TrustBridge-Workstation-1.5.0-x64.msi, workstation protocol 5.

Upgrade notes: needs Server 1.13.0; upgrade the Server and the fleet together. An older Server refuses this release at the handshake. PINs cached and A1 PINs set under 1.4.x carry over, and no MSI property or setting changed.

New features​

  • e-CNPJ certificates are read, announced with their Company to a Server that accepts them, and used to sign a Company's Signing Sessions.
  • Alphanumeric CNPJs are supported.
  • The Tray App's certificate list and detail name an e-CNPJ's Company, and the PIN prompt for a Company's session names the Company being authorized.
  • Against a Server that does not accept e-CNPJs, the Tray App shows the certificate as not announced, with the reason.

Improvements​

  • The PIN no longer reaches this machine: the Service answers the Server's challenge with a PIN Proof over its cached PIN or A1 PIN, and the Server decides whether it matches.
  • A PIN typed at the Tray prompt is still checked locally against the token or the A1 PIN; the prompt then waits for the Server's verdict and closes when the Server's prompt timeout runs out.
  • A cached PIN's lifetime slides when the Server binds a session to this machine.

Server 1.13.0 (2026-10-04)​

Image trustbridge-server:1.13.0, accepts workstation protocols 4–5.

Updates database model: yes (migrations: RegisterACompanysCnpj, HoldACompanysCnpjInTheVault, KeyASessionByItsCompany, BudgetAMachinesFailedPinProofs, BudgetTheVaultsFailedUnlocks)

Upgrade notes: upgrade the Server and the fleet together, and upload Workstation 1.5.0 with this upgrade. A holder whose machines all still run Workstation 1.4.x is answered 422 WORKSTATION_OFFLINE until one of them updates, and Workstation 1.3.0 or older is refused. No configuration key was added, renamed or removed. Rolling back to 1.12.0 needs the pre-upgrade database backup.

New features​

  • e-CNPJ support: POST /v1/sessions takes an optional cnpj; such a session binds only to that Company's e-CNPJ and signs with it, and responses carry cnpj only when one applies.
  • The Certificate Vault imports e-CNPJ certificates and records their Company.
  • The Certificates, Vault Certificates, Sessions and Audit Log screens show the Company where there is one.
  • New audit event pin.proof-budget-spent.

Improvements​

  • Workstation protocol 5: PIN Proofs replace sending the PIN to workstations; the Server challenges every candidate machine at once, within Sessions:PinRelayTimeout, and checks each proof itself.
  • Each workstation's failed PIN Proofs for a holder are limited by Sessions:MaxPinFailures within Sessions:PinFailureWindow; past the limit the machine is passed over for that CPF until its failures age out.
  • Certificate Vault passwords that open nothing are limited the same way, and a spent limit answers PIN_NOT_AVAILABLE with a details sentence.
  • A successful session creation no longer clears a CPF's lockout failures; they age out with the window.
  • INVALID_PIN now means every candidate gave a proof and none matched the PIN sent.
  • When Sessions:PinPromptTimeout runs out, the Tray App's PIN prompt is taken down at once.
  • The admin console login page lists only e-CPF certificates.
  • The status strip's chips link to the screens they summarize.

Server 1.12.0 (2026-10-03)​

Image trustbridge-server:1.12.0, accepts workstation protocols 3–4.

Updates database model: yes (migration: RecordWhoSetABoundCpf)

Upgrade notes: a deployment that switches passwords off needs at least two Administrators, because nobody can set their own Bound CPF. Rolling back to 1.11.0 needs the pre-upgrade database backup.

Improvements​

  • An Administrator sets or replaces another account's Bound CPF (Set Bound CPF, or on the new-account form), only while Admin:CertificateSignIn:Enabled is on and never on their own account.
  • Binding one's own certificate from the account screen is removed; passwords no longer need to be turned on for a first binding.
  • The accounts screen shows each account's full Bound CPF to Administrators and Auditors; the owner sees it read-only, with who set it and when.
  • Replacing a Bound CPF ends that person's certificate sessions within five minutes.
  • Audit: new admin.account-bound-cpf-set; admin.account-bound-cpf-cleared now carries the CPF; admin.bound-cpf-enrolled is no longer written.
  • Setting and clearing a Bound CPF are retried on a database deadlock.

Workstation 1.4.2 (2026-10-02)​

Package TrustBridge-Workstation-1.4.2-x64.msi, workstation protocol 4.

Upgrade notes: a machine on 1.4.0 or 1.4.1 can take this release from its Server; a machine on 1.3.0 or older needs a manual or Group Policy install.

Bug fixes​

  • One A3 certificate with an undecodable extension list no longer hides every token's certificates; that certificate alone is skipped, with a Warning naming it.
  • The Service's log names each certificate that leaves the inventory.
  • A pending PIN prompt can no longer print the PIN if it is ever formatted for a log.
  • No trust anchors configured is reported as that, not as a licence problem.

Server 1.11.0 (2026-10-02)​

Image trustbridge-server:1.11.0, accepts workstation protocols 3–4.

Updates database model: yes (migrations: BindCpfToAdminAccounts, RenameEnrolledAtToFirstSeenAt)

Upgrade notes: the column Workstations.EnrolledAt is renamed FirstSeenAt, so a query or report on it has to change. A Docker deployment behind its own reverse proxy should replace ASPNETCORE_FORWARDEDHEADERS_ENABLED=true with ForwardedHeaders:TrustedProxies. Rolling back to 1.10.0 needs the pre-upgrade database backup.

New features​

  • Certificate Sign-In: Administrators and Auditors can sign in to the admin console with an ICP-Brasil e-CPF through Lacuna Web PKI; off by default (Admin:CertificateSignIn:Enabled, which requires Admin:CertificateSignIn:WebPkiLicense).
  • An account is bound by CPF, not by certificate, so a renewed certificate keeps working.
  • Admin:CertificateSignIn:Required switches password sign-in off; an account without a Bound CPF then cannot sign in.
  • Web PKI is served by the Server itself, so an air-gapped deployment works.
  • The Trusted CAs screen counts the administrators who sign in with a certificate from each authority.
  • New setting ForwardedHeaders:TrustedProxies: X-Forwarded-For and X-Forwarded-Proto are honoured only from the listed proxies, and a malformed list refuses the start.
  • POST /v1/signatures answers the fileName of the document it signed, and the batch names every item by the same rule.
  • New audit events admin.certificate-sign-in, admin.certificate-sign-in-refused and admin.account-bound-cpf-cleared.

Improvements​

  • certificate.encoding-dropped and certificate.announcement-refused write one audit row per snapshot, with details { count, entries: [...] }; rows written before keep their flat fields.
  • certificate.inserted records encodingVerified.
  • Admission's per-address limit counts an IPv6 address by its /64.
  • The SignSession Contract has a new normative specification written from this Server, and the list of divergences from the reference implementation is withdrawn.

Bug fixes​

  • POST /v1/signatures/batch without a sessionId answers 400 INVALID_REQUEST instead of 401 SESSION_EXPIRED.
  • ClockOffset on a clock refusal now always reads now − IssuedAt (positive when the machine is behind); re-check a ClockSkewTolerance tuned from older log values.
  • A certificate whose holder fields cannot be read is refused (422 CERT_INCOMPLETE_IDENTITY when signing) instead of passing the holder check.
  • An announcement without the certificate's encoding can no longer rewrite a verified certificate's holder.
  • Behind a TLS proxy, the login redirect no longer points at http://.
  • Signing out checks its antiforgery token.
  • The admin cookie is evaluated only on admin paths.
  • A half-finished certificate sign-in is dropped once its account enrolls a Second Factor elsewhere, and the code steps refuse an account with no factor.
  • A clock refusal on the admission path is recorded against its machine.
  • A start refused for an unreachable database reports how long it actually waited.
  • No trust anchors configured is reported as that, not as a licence problem.
  • An admin account change that hits a database deadlock is retried instead of showing an error screen.
  • Commands and responses carrying a secret are redacted when printed.

Server 1.10.0 (2026-09-29)​

Image trustbridge-server:1.10.0, accepts workstation protocols 3–4.

Updates database model: yes (migration: RecordValidatedChain)

Upgrade notes: rolling back to 1.9.0 needs the pre-upgrade database backup: 1.9.0 refuses the migrated database and cannot redeem a Recovery Code this release has hashed.

Improvements​

  • Recovery Codes are hashed at rest; existing codes are hashed in the background at start and keep working.
  • Each Vault Certificate records the chain its last validation built, so an intermediate Trusted CA's removal count is exact for the vault after the first hourly revalidation.
  • The Certificate Vault screen shows the import-password warning on request (About the import password).

Bug fixes​

  • A structured refusal from Signer is reported as a refusal: a structured 400 or 403 answers 422 SIGNER_REJECTED and a structured 404 on the document download answers 404 DOCUMENT_NOT_FOUND, instead of 502 SIGNER_ERROR.
  • One failing admin screen no longer breaks the rest of the console until the page is reloaded.

Workstation 1.4.1 (2026-09-28)​

Package TrustBridge-Workstation-1.4.1-x64.msi, workstation protocol 4.

Improvements​

  • Same code as 1.4.0, released so that a machine on 1.4.0 has a newer release to take from its Server.

Workstation 1.4.0 (2026-09-28)​

Package TrustBridge-Workstation-1.4.0-x64.msi, workstation protocol 4.

Upgrade notes: needs Server 1.9.0; upgrade the Server first. This release itself is installed manually or by Group Policy. Its updated Group Policy templates add Take updates from the TrustBridge Server (ServerUpdates), on unless disabled.

New features​

  • Server-delivered updates: the Service downloads a release its Server offers, verifies it (hash, Authenticode signature and timestamp, Publisher Pin, revocation, product and version), installs it at an idle moment and reports the outcome.
  • The ServerUpdates Group Policy turns Server-delivered updates off for a machine.

Bug fixes​

  • The Log tab stops receiving the service log in a session that leaves the console.
  • The Log tab follows the service log again after the Service restarts.
  • Refresh and status reads with the Service stopped give up after ten seconds instead of waiting forever.
  • The Tokens tab marks its list when it may be out of date.

Server 1.9.0 (2026-09-27)​

Image trustbridge-server:1.9.0, accepts workstation protocols 3–4.

Updates database model: yes (migrations: WorkstationReleases, WorkstationReleaseOffers)

Upgrade notes: Workstation 1.0.x machines (protocol 2) are refused after this upgrade, so update them first; the Workstations screen shows each machine's version. Uploading a Workstation Release needs the writable scratch directory /tmp/trustbridge-releases.

New features​

  • Workstation Releases screen: an Administrator uploads a signed Workstation MSI of up to 256 MB, and the Server reads its version, protocol and signer from the file.
  • Releases are offered to and withdrawn from machines on the Workstations screen, which shows Updates disabled by policy, Needs a manual update and failed installs.
  • Machines download an offered release from GET /workstations/releases/{version}, resumable, with its own cap WorkstationReleases:MaxConcurrentDownloads (default 20).
  • Uploads, offers, withdrawals and each machine's update outcome are audited.

Workstation 1.3.0 (2026-09-26)​

Package TrustBridge-Workstation-1.3.0-x64.msi, workstation protocol 3.

New features​

  • A Tokens tab in the Tray App shows each token the Service sees: its middleware, state, whether a PIN is stored, and its certificates.
  • The Tokens tab names a smart-card reader holding a card no installed middleware reads, or a card that does not respond.
  • After an install or upgrade, the Service starts the Tray App in every signed-in Windows session.
  • The package carries the Publisher Pin and declares the protocol it speaks, for Server-delivered updates.

Bug fixes​

  • The Tray App's own warnings appear in the Log tab beside the Service's.
  • A PKCS#11 module that will not load is reported as failed, with the reason.

Workstation 1.2.2 (2026-09-25)​

Package TrustBridge-Workstation-1.2.2-x64.msi, workstation protocol 3.

Bug fixes​

  • Upgrades 1.2.0 in place: the same signed product as 1.2.1, carrying a .NET runtime no older than 1.2.0's.

Workstation 1.2.1 (2026-09-25)​

Withdrawn: its package carried an older .NET runtime than 1.2.0's, and an upgrade from 1.2.0 left the Service unable to start. Use 1.2.2.

Improvements​

  • The MSI and every TrustBridge executable and library in it are signed by LACUNA SOFTWARE LTDA, with a timestamp.

Workstation 1.2.0 (2026-09-24)​

Package TrustBridge-Workstation-1.2.0-x64.msi, workstation protocol 3. Server 1.8.0 is recommended.

New features​

  • An A1 Certificate can sign: the holder sets an A1 PIN for it in the Tray App, and a client's PIN is checked against it; the Service stores only a verifier.

Improvements​

  • The Service pings its Server every 5 seconds, so against Server 1.8.0 a lost connection is noticed within 15 seconds.
  • The Tray App's PIN column says "Stored" instead of "Cached".

Bug fixes​

  • PIN entry follows the console session when the machine is reached over Remote Desktop.
  • An A1 Certificate is no longer offered a token PIN prompt.

Server 1.8.0 (2026-09-24)​

Image trustbridge-server:1.8.0, accepts workstation protocols 2–3.

Updates database model: no

Upgrade notes: the new Workstations:ClientTimeout defaults to 30 seconds; leave it there until every machine runs Workstation 1.2.0 or later.

New features​

  • A workstation that drops off without closing its connection reads offline sooner, and an online row shows when the machine connected.
  • workstation.disconnect audit rows carry the reason the connection ended.
  • The failures chip on the status strip opens the Audit Log filtered to those failures.

Bug fixes​

  • Revoking a machine or returning it to the queue also closes its older, displaced connections.
  • A handshake re-reads the machine's admission, so a machine revoked mid-handshake is disconnected.
  • Overlapping Audit Log searches no longer mix their results.
  • The app bar's deployment chip is readable.

Workstation 1.1.0 (2026-09-23)​

Package TrustBridge-Workstation-1.1.0-x64.msi, workstation protocol 3.

Upgrade notes: needs Server 1.7.0; upgrade the Server first. The PKI licence now comes from the Server: the MSI property PKI_LICENSE and the PkiLicense Group Policy are removed, and a PKI_LICENSE on the msiexec line is ignored.

New features​

  • The machine receives its PKI licence from the Server at every connection.
  • The Tray App says why a machine is unlicensed and what fixes it.

Improvements​

  • The stored-PIN note says the machine keeps the PIN encrypted to protect the token from being blocked.

Bug fixes​

  • The MSI no longer installs the Service's development settings file, and an upgrade removes it.

Server 1.7.0 (2026-09-23)​

Image trustbridge-server:1.7.0, accepts workstation protocols 2–3.

Updates database model: no

Upgrade notes: Certificates:Validation:License is now required on every deployment, with or without the Certificate Vault; set it before upgrading, or the Server refuses to start.

New features​

  • The Server hands its PKI licence to every admitted machine at the handshake; renewing it means replacing the value and restarting the Server.
  • A PKI licence the SDK refuses is logged as Critical and shown in a banner on every admin page.

Bug fixes​

  • Concurrent session creations for the same CPF take turns instead of failing with a 500.

Workstation 1.0.1 (2026-09-21)​

Package TrustBridge-Workstation-1.0.1-x64.msi, workstation protocol 2.

Bug fixes​

  • The Tray App attaches to the installed Workstation Service, which under 1.0.0 it refused as not genuine.

Workstation 1.0.0 (2026-09-21)​

Package TrustBridge-Workstation-1.0.0-x64.msi, workstation protocol 2.

New features​

  • First release of the Workstation line: the Workstation Service and the Tray App in one MSI, with Group Policy templates. The package is not signed, so Windows warns on install.

Server 1.6.1 (2026-09-16)​

Updates database model: no

Bug fixes​

  • The log file and Application Insights obey Logging:LogLevel.

Server 1.6.0 (2026-09-16)​

Updates database model: no

New features​

  • The Server log also goes to a daily rolling file (Logging:File:Directory, Logging:File:RetainedDays) and, optionally, to Application Insights (Logging:ApplicationInsights:ConnectionString).
  • A Server log screen in the admin console.

Server 1.5.0 (2026-09-11)​

Updates database model: yes (migration: KeepBagChainCertificates)

New features​

  • The Server can fetch a missing issuer over AIA; nothing is stored until an Administrator confirms.
  • An UNTRUSTED Vault Certificate offers to trust its issuer.
  • A vault import keeps the CA certificates its PKCS#12 file carried.
  • The Trusted CAs upload accepts PKCS#7 bundles (.p7b).

Bug fixes​

  • A certificate with a corrupt Basic Constraints extension is treated as not a CA, and the upload logs a Warning for each certificate it passes over.
  • The removal confirmation says its counts are approximate.

Server 1.4.0 (2026-08-31)​

Updates database model: yes (migration: WorkstationTrustedCaReport)

New features​

  • The fleet page shows whether each machine has the Server's current Trusted CAs, and why not.
  • Removing a Trusted CA counts the Workstation Certificates it affects as well as the Vault Certificates.

Server 1.3.0 (2026-08-28)​

Updates database model: yes (migration history replaced by a single InitialCreate)

Upgrade notes: a database created by 1.2.0 or earlier is refused; drop it and let the Server create a new one. Audit:FallbackLogPath is removed: an audit entry the database refuses goes to the Server log as Critical.

New features​

  • Workstation admission: a machine creates a non-exportable key and waits in the admission queue until an Administrator admits it; the Enrollment Token is gone.
  • A Trusted CA added on the Server reaches every admitted machine within seconds.
  • A global throttle answers 429 SERVER_BUSY (Throttle:ConcurrencyLimit, Throttle:QueueLimit).
  • GET /healthz reports whether the Server and its database are working.
  • A Signing Operation left Pending by a stopped process is ended by a sweep (RUN_STRANDED).
  • Signing Sessions and API Keys open their own Audit Log trail, and a session shows how much of its Signature Allowance it has spent.

Improvements​

  • POST /v1/signatures accepts any file part as the document, and a request naming no session answers 400 INVALID_REQUEST.
  • A Signer that is throttling (429 or 408) answers 502 SIGNER_ERROR instead of a refusal.

Server 1.2.0 (2026-08-24)​

Updates database model: yes (migration: SessionSignatureAllowance)

Upgrade notes: the Server applies its own migrations at start (Database:MigrateOnStart, default true), so dotnet ef database update is no longer part of an upgrade.

New features​

  • Signature Allowance: Sessions:SignatureAllowance limits how many signing calls a session may make.
  • Uploading a holder's certificate on the Trusted CAs screen resolves its issuing chain and offers it for confirmation.

Server 1.1.0 (2026-08-23)​

Updates database model: no

Upgrade notes: the image ships with the Certificate Vault off; set Vault:Enabled if you use it.

New features​

  • The Trusted CAs screen: upload, list and remove the certification authorities the Server trusts.

Bug fixes​

  • A bundle of concatenated DER certificates is read in full instead of keeping only the first.
  • Certificates stored by an upload that failed part-way take effect at once instead of after a restart.
  • Text before the first BEGIN marker, such as a comment or an openssl dump, is no longer counted as an unreadable block.

Server 1.0.1 (2026-08-23)​

Updates database model: yes (migration: TrustedCas)

Upgrade notes: Certificates:Validation:TrustedRootPaths is no longer honoured on the Server; it still is on the Workstation Service.

New features​

  • The certification authorities the Server trusts are stored in the database and applied without a restart.
  • Certificates:Validation:UseLacunaTestPki trusts the Lacuna test PKI.

Improvements​

  • The PKI SDK's disk caches are kept under /tmp/trustbridge-pki.
View as Markdown