Syncing the forked repo with upstream (whilst keeping the v2 commit)

.build/entrypoint.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$GOARCH" ]] && fail "A GOARCH has not been defined"
+[[ -z "$GITHUB_TOKEN" ]] && fail "A GITHUB_TOKEN has not been defined"
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+if [[ "$host_arch" != "$GOARCH" ]]; then
+  # We're building for a different architecture than our target host OS so
+  # we have to tell the Go compiler to use the correct C cross-compiler for
+  # our target instead of relying on the host C compiler.
+  #
+  # https://packages.ubuntu.com/search?suite=noble&section=all&arch=any&keywords=linux-gnu-gcc&searchon=contents
+  case "$GOARCH" in
+    amd64)
+      export CC=x86_64-linux-gnu-gcc
+      ;;
+    arm64)
+      export CC=aarch64-linux-gnu-gcc
+      ;;
+    s390x)
+      export CC=s390x-linux-gnu-gcc
+      ;;
+    *)
+      fail "Building for $GOARCH has not been implemented"
+      ;;
+  esac
+fi
+
+# Install our tools if necessary
+if ! ./tools.sh check-external; then
+  ./tools.sh install-external
+fi
+
+# Assume that /build is where we've mounted the vault repo.
+git config --global --add safe.directory /build
+git config --global url."https://${GITHUB_TOKEN}@github.com".insteadOf "https://github.com"
+
+# Exec our command
+cd build || exit 1
+exec "$@"

.build/go.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+set -e
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+curl -L "https://go.dev/dl/go${GO_VERSION}.linux-${host_arch}.tar.gz" | tar -C /opt -zxv

.build/system.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+export DEBIAN_FRONTEND=noninteractive
+
+install() {
+  apt-get install -y "$@"
+}
+
+# Install our cross building tools
+# https://packages.ubuntu.com/search?suite=noble&section=all&arch=any&keywords=crossbuild-essential&searchon=names
+
+apt-get update
+apt-get install -y --no-install-recommends build-essential \
+  gcc-s390x-linux-gnu \
+  crossbuild-essential-s390x \
+  ca-certificates \
+  curl \
+  git
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+case "$host_arch" in
+  amd64)
+    install crossbuild-essential-arm64 gcc-aarch64-linux-gnu
+    ;;
+  arm64)
+    install gcc-x86-64-linux-gnu
+    ;;
+  *)
+    echo "Building on $host_arch has not been implemented" 1>&2
+    exit 1
+    ;;
+esac
+
+# Clean up after ourselves for a minimal image
+apt-get clean
+rm -rf /var/lib/apt/lists/*

.copywrite.hcl

@@ -1,8 +1,9 @@
 schema_version = 1
 
 project {
-  license        = "BUSL-1.1"
-  copyright_year = 2024
+  license          = "BUSL-1.1"
+  copyright_year   = 2025
+  copyright_holder = "IBM Corp."
 
   # (OPTIONAL) A list of globs that should not have copyright/license headers.
   # Supports doublestar glob patterns for more flexibility in defining which
@@ -12,5 +13,8 @@ project {
     "ui/node_modules/**",
     "enos/modules/k8s_deploy_vault/raft-config.hcl",
     "plugins/database/postgresql/scram/**",
+    "enos/.enos/**",
+    "enos/k8s/.enos/**",
+    "enos/.terraform/**",
   ]
 }

.github/.secret_scanning.yml

@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 paths-ignore:

.github/CODEOWNERS

@@ -0,0 +1,109 @@
+# Each line is a file pattern followed by one or more owners. Being an owner
+# means those groups or individuals will be added as reviewers to PRs affecting
+# those areas of the code.
+#
+# More on CODEOWNERS files: https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Default CODEOWNER primarily for contact purposes
+* @hashicorp/vault
+
+# Select Auth engines are owned by Ecosystem
+/builtin/credential/aws/      @hashicorp/vault-ecosystem
+/builtin/credential/github/   @hashicorp/vault-ecosystem
+/builtin/credential/ldap/     @hashicorp/vault-ecosystem
+/builtin/credential/okta/     @hashicorp/vault-ecosystem
+
+# Secrets engines (pki, ssh, totp and transit omitted)
+/builtin/logical/aws/         @hashicorp/vault-ecosystem
+/builtin/logical/cassandra/   @hashicorp/vault-ecosystem
+/builtin/logical/consul/      @hashicorp/vault-ecosystem
+/builtin/logical/database/    @hashicorp/vault-ecosystem
+/builtin/logical/mongodb/     @hashicorp/vault-ecosystem
+/builtin/logical/mssql/       @hashicorp/vault-ecosystem
+/builtin/logical/mysql/       @hashicorp/vault-ecosystem
+/builtin/logical/nomad/       @hashicorp/vault-ecosystem
+/builtin/logical/postgresql/  @hashicorp/vault-ecosystem
+/builtin/logical/rabbitmq/    @hashicorp/vault-ecosystem
+
+# Identity Integrations (OIDC, tokens)
+/vault/identity_store_oidc*   @hashicorp/vault-ecosystem
+
+/plugins/                     @hashicorp/vault-ecosystem
+/vault/plugin_catalog.go      @hashicorp/vault-ecosystem
+
+# Content on developer.hashicorp.com
+
+# Web presence gets notified of, and can approve changes to web tooling, but not content.
+
+/website/               @hashicorp/web-presence
+/website/data/
+/website/public/
+/website/content/
+
+# Education gets notified of, and can approve changes to web content.
+
+/website/data/          @hashicorp/vault-education-approvers
+/website/public/        @hashicorp/vault-education-approvers
+/website/content/       @hashicorp/vault-education-approvers
+/website/templates/     @hashicorp/vault-education-approvers
+/website/redirects.js   @hashicorp/vault-education-approvers
+
+# Plugin docs
+/website/content/docs/plugins/              @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+/website/content/docs/upgrading/plugins.mdx @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+
+/ui/  @hashicorp/vault-ui
+# UI code related to Vault's JWT/OIDC auth method and OIDC provider.
+# Changes to these files often require coordination with backend code,
+# so stewards of the backend code are added below for notification.
+/ui/app/components/auth/form/oidc-jwt.ts @hashicorp/vault-ui @hashicorp/vault-ecosystem
+/ui/app/components/auth/form/saml.ts     @hashicorp/vault-ui @hashicorp/vault-ecosystem
+/ui/app/routes/vault/cluster/oidc-*.js   @hashicorp/vault-ui @hashicorp/vault-ecosystem
+
+# Release config; service account is required for automation tooling.
+/.release/                     @hashicorp/github-secure-vault-core @hashicorp/team-vault-quality
+/.github/workflows/build.yml   @hashicorp/github-secure-vault-core @hashicorp/team-vault-quality
+
+# Quality engineering
+/.github/  @hashicorp/team-vault-quality
+/enos/     @hashicorp/team-vault-quality
+
+# Cryptosec
+/api/auth/cert/                                      @hashicorp/vault-crypto
+/builtin/logical/pki/                                @hashicorp/vault-crypto
+/builtin/logical/pkiext/                             @hashicorp/vault-crypto
+/website/content/docs/secrets/pki/                   @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/pki/                @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/pki.mdx             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/credential/cert/                            @hashicorp/vault-crypto
+/website/content/docs/auth/cert.mdx                  @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/auth/cert.mdx              @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/logical/ssh/                                @hashicorp/vault-crypto
+/website/content/docs/secrets/ssh/                   @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/ssh.mdx             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/logical/transit/                            @hashicorp/vault-crypto
+/website/content/docs/secrets/transit/               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/transit.mdx         @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/helper/random/                                      @hashicorp/vault-crypto
+/sdk/helper/certutil/                                @hashicorp/vault-crypto
+/sdk/helper/cryptoutil/                              @hashicorp/vault-crypto
+/sdk/helper/kdf/                                     @hashicorp/vault-crypto
+/sdk/helper/keysutil/                                @hashicorp/vault-crypto
+/sdk/helper/ocsp/                                    @hashicorp/vault-crypto
+/sdk/helper/salt/                                    @hashicorp/vault-crypto
+/sdk/helper/tlsutil/                                 @hashicorp/vault-crypto
+/shamir/                                             @hashicorp/vault-crypto
+/vault/barrier*                                      @hashicorp/vault-crypto
+/vault/managed_key*                                  @hashicorp/vault-crypto
+/vault/seal*                                         @hashicorp/vault-crypto
+/vault/seal/                                         @hashicorp/vault-crypto
+/website/content/docs/configuration/seal/            @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/enterprise/sealwrap.mdx        @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/system/sealwrap-rewrap.mdx @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/transform/             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/transform.mdx       @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/kmip-profiles.mdx      @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/kmip.mdx               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/kmip.mdx            @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/enterprise/fips/               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/platform/k8s                   @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+/website/content/                                    @hashicorp/vault-customer-engineering @hashicorp/vault-education-approvers

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 contact_links:

.github/actionlint.yml

@@ -0,0 +1,20 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+self-hosted-runner:
+  # Labels of self-hosted runner in array of string
+  labels:
+    - small
+    - medium
+    - large
+    - xlarge
+    - ondemand
+    - disk_gb=64
+    - os=linux
+    - os=ubuntu-arm
+    - type=m5.2xlarge
+    - type=c6a.xlarge
+    - type=c6g.2xlarge
+    - type=c6a.4xlarge
+    - ubuntu-latest-x64
+    - custom-linux-xl-vault-latest