This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.
On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that
| #!/usr/bin/env fish | |
| ykman piv reset | |
| ykman piv access change-management-key -m 010203040506070801020304050607080102030405060708 -P 123456 -p | |
| ykman piv keys generate -P 123456 --touch-policy=always 9a - | |
| ykman piv keys attest 9a /tmp/9acert.pem | |
| ykman piv certificates import -P 123456 9a /tmp/9acert.pem | |
| ykman piv objects generate chuid -P 123456 | |
| ykman piv objects generate ccc -P 123456 | |
| ykman piv access change-puk -p 12345678 -n (openssl rand -base64 6) |
| # Please see the following blog post for more information: | |
| # | |
| # https://www.hashicorp.com/blog/using-hashicorp-vault-with-chef.html | |
| # | |
| resource_name :vault_secret | |
| property :path, String, name_property: true | |
| property :destination, String |
