SKFS 4.20.1

Changes in SKFS 4.20.1

#	Explanation
BUG-133	Fix Android Digital Asset Links replication error Previously, DAL records failed to replicate correctly when new fingerprints were added. This prevented the DAL fingerprint map from remaining accurate across the cluster, causing registration failures on nodes other than the one where the fingerprint was added. This issue is now fixed; DAL records now replicate accurately, ensuring successful registrations across all nodes. This fix introduces a database change to include the parent Digital Asset Links (DAL) SID in each digital_asset_link_x509_fingerprint entry. This resolves an error that occurred when a node could not determine the correct DAL parent for a fingerprint during replication. NOTE: Because this change adds a new column to the database, existing table signatures will no longer verify after the upgrade. To address this, a new tool has been provided to re-sign the database records using the signing keystore located in the appliance’s file system.
RFE-320	Create Table Signer CLI Tool This CLI tool signs rows for specific SKFS database tables, primarily to repair signatures invalidated by database changes in current and future updates. Currently, the tool supports re-signing the `digital_asset_link_x509_fingerprints` table only.

Explanation

BUG-133

Fix Android Digital Asset Links replication error

Previously, DAL records failed to replicate correctly when new fingerprints were added. This prevented the DAL fingerprint map from remaining accurate across the cluster, causing registration failures on nodes other than the one where the fingerprint was added. This issue is now fixed; DAL records now replicate accurately, ensuring successful registrations across all nodes.

This fix introduces a database change to include the parent Digital Asset Links (DAL) SID in each digital_asset_link_x509_fingerprint entry. This resolves an error that occurred when a node could not determine the correct DAL parent for a fingerprint during replication.

NOTE: Because this change adds a new column to the database, existing table signatures will no longer verify after the upgrade. To address this, a new tool has been provided to re-sign the database records using the signing keystore located in the appliance’s file system.

RFE-320

Create Table Signer CLI Tool

This CLI tool signs rows for specific SKFS database tables, primarily to repair signatures invalidated by database changes in current and future updates. Currently, the tool supports re-signing the `digital_asset_link_x509_fingerprints` table only.

ATTENTION:

Upgrading your SKFS cluster to v4.20.1 requires specific manual steps. View the instructions here.
NOTE: These steps are not required if your cluster meets specific criteria (e.g., single-node or no Digital Asset Links usage). See the linked instructions for details on when you can skip this process.
StrongKey strongly recommends that SKFS administrators using the Digital Asset Links feature in standalone environments upgrade to v4.20.1.
StrongKey also strongly recommends that StrongAuth KeyAppliance customers planning to use the Digital Asset Links feature in their bundled SKFS environment upgrade to v4.20.1 first.