Version 2.2.0 adds important CSRF protection to the forms in the web UI. This is in order to mitigate CSRF vulnerability in Collins that could let an attacker modify or create assets by getting an authenticated user to visit an external page and guessing or bruteforcing the asset tags.

Some other highlights are:

• Pool-based IPMI address allocation
• Support for GPUs and NVMe cards
• Flashy favicon

The release notes contains a complete list of changes.

Collins 2.1.0 has a very important security patch.

Collins has a feature that allows you to encrypt certain attributes on every asset. It also had a permission that restricted which users could read those encrypted tags. It did NOT have a permission that restricted which users could modify encrypted tags.

This changelog contains a longer description of the problem.

Major highlights:

• Event firehose
• Refactor of collins' caching logic, to safely support HA
• Improved LDAP authentication configuration
• Python collins client
• Consolr gem, for executing IPMI commands on collins assets
• Upgraded to play 2.3.9

Moved to Play 2.0.8
Tumblr supported Docker image
Reworked and greatly improved init script
Monitoring plugin
Open sourced collins-auth ruby gem
Unit test improvements
Customizable intake page fields
Provisioning profile contact and contact_notes fields, and ability to set or remove arbitrary attributes based on provisioning profile
IP allocation improvements
Removed IP allocation caching layer
Mixed authentication modes
Added new API for asset type
Improved solr integration for external solr instances
Restrict provisioning based on hardware configuration

Special thanks to @discordianfish @matthiasr @dallasmarlow @rednuopxivrec @skottler and @asheepapart for their contributions!

And here are all the pull requests in this release, in no particular order

• Gabe dockerfile #208 @byxorna
• Gabe portable init #209 @byxorna
• remove daemonize from build, isnt necessary #210 @byxorna
• Remove logging if the config is missing #218 @Primer42
• document docker usage #211 @byxorna
• fix race when service doesnt open application.log fast enough #212 @byxorna
• Update quickstart ids #213 @Primer42
• allow multiple product strings to be matched for flash disk detection #132 @byxorna
• add documentation for lshw.flashProducts #133 @byxorna
• Upstart scripts for collins #125 @funzoneq
• populate changelog with 1.2.4 release #137 @byxorna
• Provisioning profiles support for contact and contact_notes fields #134 @byxorna
• Open sourcing collins_auth #141 @funzoneq
• Fix Dockerfile #139 @discordianfish
• fix collins-auth prompt #143 @dallasmarlow
• fix reprovision action to not fail if contact is empty #140 @byxorna
• optional user submitted config file #142 @byxorna
• Will update gems #163 @byxorna
• Support play 2.0onfiguration tunables">#165 @byxorna
• add documentation for new solr tunables #168 @byxorna
• Bump collins-shell version @matthiasrtps://github.com/byxorna" class="user-mention">@byxorna
• Add tests for PowerManagementConfig @byxorna
• fix incorrect curl #192find ... #180 @byxorna
• Gabe more collinsauth fixing #177 @byxorna
• Added note about problems with net-ssh versions > 2.8.0 #171 @Primer42
• fix for collins user with nologin #219 @byxorna

• Various documentation/labeling fixes ( #95, #94, #99, #103, #104)
• vlan names can be optional (Chris Burroughs #93)
• squeryl session cleanup and updated deployment automation (Dallas Marlow #109)
• Upgraded to play 2.0.4, to handle a UTF8 issue (Dallas Marlow #108)
• Upgraded bonecp (Dallas Marlow #110)
• Added Metrics support (Chris Burroughs #86)
• Added dockerfiles, so users can build and run Collins with Docker, if they choose to (Johannes 'fish' Ziemke #111)
• Minor script fixes (Will Richard and Brent Langston #97 and #113)
• Trim whitespace from strings before sending them to solr, to get more accurate results (Will Richard #115)
• Update Bootstrap link in docs footer (Chris Rebert #119)
• Don't parse config yml files if plugins are disabled (Gabe Conradi #122)
• Allow LSHW and LLDP updates in more states (Gabe Conradi #123)
• Accept collins asset state when doing a state update or state delete (Dallas Marlow #124)
• Created a 'contrib' directory for helpful script for running and maintaining collins (Will Richard & Gabe Conradi #126)
• Ensured that variables provided when using text/x-shellscript API endpoint are valid POSIX (Will Richard & Gab Conradi #129)

• LSHW: Allow a default speed to be specified via defaultNicCapacity (Benjamin VanEvery #91)
• Bug: Evolution 11 autoinc should work with MySQL and H2 (Benjamin VanEvery #90)
• Bug: Exact match search when dropdown used in UI (Chris Burroughs #88)
• UI: Bookmarkable tabs and working logs refresh button in asset view (Chris Burroughs #87)
• Docs: Document ganglia graphing config (Chris Burroughs #84 and #85)
• UI: Display dimension of attribute in asset view (Chris Burroughs, Blake Matheny #83 and #79)
• Logging: Better LDAP failure messages (Chris Burroughs #79)
• LSHW: Include server description, vendor, etc during intake (Chris Burroughs #77)
• Graph: Ganglia GraphView support (Chris Burroughs #76)
• Shell: Support for size and threads parameter for batch operations (Blake Matheny #72)
• LSHW: Handle ghost CPUs in LSHW output (Chris Burroughs #70)

• Search: Refactored solr code, added log search API endpoint
• LDAP: Config now supports a 'schema' of rfc2307 or rfc2307bis (default)
• Search: Index decommissioned assets
• Bug: CQL parser should properly handle all quotes
• LSHW: Support for B.02.16 (thanks Johannes Ziemke)
• Bug: IP Address now retrieved for config assets (#47)
• Bug: Don't purge intake data on LSHW update (#55)
• Client: set_multi_attribute allows multiple updates, file upload support via @

• Build: Created install tool (scripts/setup) for initial setup
• Build: Made package.sh script a bit more correct
• Build: Starter config for use when packaging a release
• Deps: Remove snakeyaml-SNAPSHOT, code was integrated upstream
• Docs: Added ChangeLog
• Config: Fixed default ipmi configuration. Thanks Chris Graf