Revision history for Google-Auth

0.12    Wed Aug 12 2026
    - Expanded Workload Identity Federation (WIF) support with AWS ECS Container Task Roles and EC2 IMDSv2.
    - Security hardening for AWS Container Credentials Full URI (Protocol Scheme enforcement).
    - Fixed IPv6 loopback validation bug in AWS credentials.
    - Improved stability with case-insensitivity and strict boolean evaluation in token retrieval.

0.11    Thu Aug 6 2026
    - Implemented UserAuthorizer, WebUserAuthorizer, and FileTokenStore for full parity with standard OAuth2 flows.
    - Added the `gcloud-auth` CLI dispatcher (mirroring standard `gcloud auth` hierarchy).
    - Hardened filesystem I/O operations by enforcing strict checked `close()` calls to prevent silent descriptor leaks.
    - Enabled advanced security policies for enhanced randomness verification and regex safety.
    - Aligned Dockerfile testing pipelines to enforce stricter auditing policies.

    - Eliminated OpenSSL 3.0 deprecation warnings in XS by separating conditioned implementations of load_rsa_pubkey and load_ec_pubkey.
    - Fixed xsubpp parsing issues on older toolchains by ensuring proper spacing around preprocessor directives.

0.10    Tue Aug 4 2026
    - Call env_proxy by default on internal LWP::UserAgent instances to respect standard proxy environment variables (HTTPS_PROXY, NO_PROXY, etc.).
    - Hardened Pluggable credential execution against command injection and untrusted search paths by using Text::ParseWords and indirect system execution.
    - Removed insecure blind de-tainting in Pluggable credentials.

0.09    Mon Aug 3 2026
    - Hardened ServiceAccountCredentials against SSRF by validating token_uri domain.
    - Added regression test for ServiceAccountCredentials token_uri SSRF.
    - Corrected typo in .perlcriticrc policy name (ProhibitStringEval -> ProhibitStringyEval).

0.08    Sun Aug 2 2026
    - Improve safety and validation for external credentials.
    - Added regression tests for universe domain bypass and sibling class validation gaps.

0.07    Fri Jul 31 2026
    - Hardened credential validation and handling (Custom Universe opt-in safeguards).
    - Added untainting and validation for pluggable credentials commands.
    - Centralized version management (removed redundant submodule $VERSIONs).
    - Normalized Copyright headers to "Google LLC and contributors" with first contribution year.
    - Applied uniform code formatting via .perltidyrc.
    - Restored MANIFEST hygiene and aligned contributing guidelines.

0.06    Tue Jul 28 2026
    - Added SECURITY.md
    - Pluggable credentials "executable" now require explicit opt-in via GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1.
    - Added URL Domain Validation (`ExternalAccountCredentials::_validate_url`) to reject any `credential_source.url`, `token_url`, or `service_account_impersonation_url` whose host is not `googleapis.com`, `*.googleapis.com`, `$universe_domain`, or `*.$universe_domain`.

0.05    Wed Jul 22 2026
        - Fixed POD test failures.
        - Resolved author testing failures (Kwalitee, PerlTidy).
        [Version Alignment & Submodule Synchronization]
        - Synchronized $VERSION = '0.05' across all Google::Auth submodules.
        - Hardened release_lint.pl distcheck verification.

0.04    Mon Jul 20 2026
        [CPAN RT #180157 Fix]
        - Replaced system free() with Perl's Safefree() for memory allocated via Newx() in XS.xs generate_self_signed_cert() and verify_signature().
        - Fixes "invalid pointer" and "double free or corruption" test failures on Perls compiled with -DDEBUGGING and MULTIPLICITY.

0.03    Fri Jul 17 2026
        [OpenSSL 3.0 & Cryptographic Modernization]
        - Modernized XS.xs C bindings to use OpenSSL 3.0 high-level EVP_PKEY_fromdata and OSSL_PARAM_BLD APIs in load_rsa_pubkey and load_ec_pubkey, eliminating all OpenSSL 3.0 deprecation warnings.
        - Retained backward-compatible fallback paths for OpenSSL 1.1.1 installations.
        - Properly indented C preprocessor directives inside XS CODE: blocks for xsubpp parser compatibility.

        [Authentication & Workload Identity Federation]
        - Expanded Workload Identity Federation (WIF) support with Pluggable credentials (Google::Auth::ExternalAccountCredentials::Pluggable) and AWS IAM authentication (Google::Auth::ExternalAccountCredentials::Aws).
        - Hardened Service Account, Impersonated Credentials, and Compute Engine metadata server token refresh loops.

        [Architecture & Versioning]
        - Upgraded distribution version to 0.03 (lib/Google/Auth.pm).
        - Streamlined package versioning to single entrypoint $VERSION.

0.02    2022-03-16
        - Release approved by Google OSPO

0.01    2022-03-02
        - First version, including translation from Ruby into lib/Google/Auth/IDTokens/KeySources.pm
        - Included tests translated from Ruby into t/key_sources_test.t and expanded upon