From 4cb3bda43ae259ee4a9a2c1d869c62f714370d41 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Mon, 12 Oct 2026 09:53:17 -0700 Subject: [PATCH] Add fork notice, NOTICE file, README/CONTRIBUTING rewrite; drop HashiCorp logo assets Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 14 ++++++++ CONTRIBUTING.md | 47 ++++++++++++--------------- NOTICE | 26 +++++++++++++++ README.md | 85 +++++++++++++++++++++++++++++++++++++++++++++---- 4 files changed, 139 insertions(+), 33 deletions(-) create mode 100644 NOTICE diff --git a/CHANGELOG.md b/CHANGELOG.md index 83ff7606e..6daab31a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,17 @@ +# Threshold CHANGELOG + +> **Note:** Threshold is a community fork of HashiCorp Boundary Community Edition (CE), which was archived upstream on +> 2026-10-09. Entries below this note are the upstream Boundary changelog and are kept unchanged for history. +> Threshold-specific changes are listed under the "Threshold" heading, newest first. + +## Threshold + +### Unreleased + +* Renamed the CLI binary to `threshold` and rebranded user-visible text. `THRESHOLD_*` environment variables are now + preferred, with `BOUNDARY_*` honored as a fallback. The client cache directory is `~/.threshold` (falling back to an + existing `~/.boundary`), and stored tokens are written under new keyring names while old entries are still read. + # Boundary CHANGELOG Canonical reference for changes, improvements, and bugfixes for Boundary. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6176796c6..0898c4e19 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,53 +1,46 @@ -# Contributing to Boundary +# Contributing to Threshold -Thank you for contributing to Boundary! Here you can find common questions around reporting issues and opening -pull requests to our project. +Thank you for contributing to Threshold! Threshold is a community fork of HashiCorp Boundary Community Edition (CE). +It is not affiliated with or endorsed by HashiCorp or IBM. Here you can find common questions around reporting issues +and opening pull requests to the project. The repository lives at +. -When contributing in any way to the Boundary project (new issue, PR, etc), please be aware that our team identifies with many gender pronouns. Please remember to use nonbinary pronouns (they/them) and gender neutral language ("Hello folks") when addressing our team. For more reading on our code of conduct, please see the [HashiCorp community guidelines](https://www.hashicorp.com/community-guidelines). +Please be respectful and inclusive when contributing in any way (new issue, PR, etc). ## Issue Reporting ### Reporting Security Related Vulnerabilities -We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue -in Boundary, please responsibly disclose by contacting us at security@hashicorp.com. Do not open an issue on -our GitHub issue tracker if you believe you've found a security related issue, thank you! +If you believe you have found a security issue in Threshold, please disclose it responsibly by contacting the +maintainers privately rather than opening a public issue. Issues that exist in upstream HashiCorp Boundary CE should +also be treated as security-sensitive. ### Bug Fixes -If you believe you found a bug with Boundary, please: +If you believe you found a bug with Threshold, please: -1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible we've already fixed -the bug, and this is a first good step to ensuring that's not the case. -1. Take a look at the [Boundary Discuss](https://discuss.hashicorp.com/c/boundary/50) to see if other folks have had -similar issues. -1. Ensure a similar ticket is not already opened by searching our opened issues on GitHub. +1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible it has already been fixed. +1. Ensure a similar issue is not already opened by searching the open issues in the repository. - -Once you've verified the above, feel free to open a bug fix issue template type from our [issue selector](https://github.com/hashicorp/boundary/issues/new/choose) -and we'll do our best to triage it as quickly as possible. +Once you've verified the above, open an issue in the repository describing how to reproduce the problem. ## Pull Requests ### New Features & Improvements -Before writing a line of code, please ask us about a potential improvement or feature that you want to write into Boundary. We may already be working on it; even if we aren't, we need to ensure that both the feature and its proposed implementation is aligned with our road map, vision, and standards for the project. We're happy to help walk through that via a [feature request issue](https://github.com/hashicorp/boundary/issues/new/choose). - -You can see a public [road map for Boundary](https://github.com/hashicorp/boundary/issues/new/choose) on our docs site and we encourage -everyone to look this over to understand at a high level what we're working on with Boundary. +Before writing a line of code, please open an issue to discuss a potential improvement or feature. Threshold is +focused on maintaining the Community Edition code base, so changes that stay close to upstream behavior and +compatibility are the easiest to accept. ### Submitting a New Pull Request When submitting a pull request, please ensure: 1. You've added a changelog line clearly describing the new addition under the correct changelog sub-section. -1. You've followed the above guidelines for contributing to Boundary. - -Once you open your PR, our auto-labeling will add labels to help us triage and prioritize your contribution. Please -allow us a couple of days to comment, request changes, or approve your PR. Thank you for your contribution! +1. You've followed the above guidelines for contributing to Threshold. ## Changelog -The changelog is updated by PR contributors. Each contribution to Boundary should include a changelog update at the contributor or reviewer discretion. +The changelog is updated by PR contributors. Each contribution to Threshold should include a changelog update at the contributor or reviewer discretion. The changelog should be updated when the contribution is large enough to warrant it being called out in the larger release cycle. Enhancements, bug fixes, and other contributions that practitioners might want to be aware of should exist in the changelog. @@ -72,7 +65,7 @@ Any bug fixes fall into this section. Most tests require a postgres database instance to successfully run. This is provided via docker -by running a customized postgres image that is optimized for boundary tests. +by running a customized postgres image that is optimized for Threshold tests. Before running the test suite, this docker container must be started: @@ -109,7 +102,7 @@ once the test database is ready: $ make test ``` -Before running any test please ensure that Docker is started. Boundary uses a Docker container to initiate a database for testing. +Before running any test please ensure that Docker is started. Threshold uses a Docker container to initiate a database for testing. If a test is interrupted check to make certain that all Docker containers have been properly destroyed. ### Running individual tests diff --git a/NOTICE b/NOTICE new file mode 100644 index 000000000..3b7f8d3e9 --- /dev/null +++ b/NOTICE @@ -0,0 +1,26 @@ +Threshold +========= + +Threshold is a community fork of HashiCorp Boundary Community Edition (CE), +originally developed by HashiCorp, Inc. (an IBM company): + + https://github.com/hashicorp/boundary + +The upstream repository was archived on 2026-10-09. Threshold continues +maintenance of that code base. + +Original work: + Copyright (c) HashiCorp, Inc. + Copyright IBM Corp. 2020, 2026 + Licensed under the Business Source License 1.1 (see LICENSE). + +All existing copyright headers and the LICENSE file are preserved unchanged. +Threshold is distributed under the same license terms as the upstream project. + +Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp, +Inc. or IBM. "Boundary", "HashiCorp", "HCP Boundary" and related marks are +the property of their respective owners and are referenced here solely to +identify the origin of this software. + +Portions of this repository (for example the api and sdk modules) carry their +own license files, which apply to those portions. diff --git a/README.md b/README.md index 71edb5413..1a6157410 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,83 @@ -Boundary +# Threshold -Boundary Community Edition (CE) is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities. +Threshold provides simple and secure access to hosts and services. It is a +community-maintained fork of HashiCorp Boundary Community Edition (CE). -This repository is now read-only and no longer accepts new issues, pull requests, or community contributions. Existing source code and previously released binaries remain available for reference and existing self-managed use. +## About this fork -No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned. +Threshold is a community fork of [HashiCorp Boundary Community Edition](https://github.com/hashicorp/boundary). +HashiCorp (an IBM company) archived the upstream Boundary CE repository on +2026-10-09 and announced that no further CE releases, maintenance updates, bug +fixes or security patches are planned. Threshold continues maintenance of the +Community Edition code base so that existing self-managed deployments can keep +receiving fixes. -Teams continuing to use Boundary CE should evaluate whether it meets their operational, security, and compliance requirements. -For supported Boundary capabilities, including production-scale governance, compliance, session recording, enterprise support, and future Boundary development, please evaluate HCP Boundary or Boundary Enterprise. +- Threshold is licensed under the [Business Source License 1.1](LICENSE), the + same license as the upstream code. The original license text and all + copyright headers are preserved. See [NOTICE](NOTICE) for attribution. +- **Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or + IBM.** "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their + respective owners and are used here only to describe the origin of this + project. +- Upstream project: +- This repository: + +### Compatibility with Boundary CE + +This is the first phase of the rebrand and is designed to keep existing +Boundary CE deployments working: + +- The command-line binary is now `threshold` (built from `cmd/threshold`). +- The wire protocol, HTTP API paths (`/v1`), database schema, plugin protocol + and configuration file format are unchanged. +- The Go module path is still `github.com/hashicorp/boundary` for now; it will + change in a later phase together with regenerated protobuf code. +- Release versions are still reported on the wire with the upstream + `Boundary v` prefix so mixed clusters keep working. `Threshold v` is also + accepted when parsing. + +### Environment variable and path fallbacks + +Threshold prefers `THRESHOLD_*` environment variables, and transparently falls +back to the legacy `BOUNDARY_*` name when the `THRESHOLD_*` variable is not set. +For example `THRESHOLD_ADDR`, `THRESHOLD_TOKEN`, `THRESHOLD_SCOPE_ID`, +`THRESHOLD_KEYRING_TYPE`, `THRESHOLD_TOKEN_NAME`, `THRESHOLD_CONNECT_*`, +`THRESHOLD_SKIP_CACHE_DAEMON` and the other CLI and server variables are read +first, then `BOUNDARY_ADDR`, `BOUNDARY_TOKEN`, and so on. A `THRESHOLD_*` variable that is +set to a non-empty value always wins. Existing scripts and deployments that +only set `BOUNDARY_*` variables do not need to change. + +Notes: + +- `env://VAR` references inside configuration files and flags (for example + `url = "env://BOUNDARY_POSTGRES_URL"` or `url = "env://THRESHOLD_POSTGRES_URL"` + as used by the bundled container config) name an environment variable + literally and are not rewritten; keep using whichever variable name you export. +- `threshold connect -exec` exports both `THRESHOLD_PROXIED_{PORT,IP,ADDR}` and + the legacy `BOUNDARY_PROXIED_{PORT,IP,ADDR}` variables to the child process. +- The container image entrypoint mirrors any `BOUNDARY_*` variables to the + matching `THRESHOLD_*` variable when it is unset. + +Other fallbacks: + +| Item | New | Legacy fallback | +|------|-----|-----------------| +| Client cache directory | `~/.threshold` | `~/.boundary` is used if it exists and `~/.threshold` does not | +| Keyring entry (macOS Keychain / Windows Credential Manager) | `Threshold Auth Token` | `HashiCorp Boundary Auth Token` is read if the new entry is not found, and removed on `threshold logout` | +| Keyring prefix (`pass`, libsecret) | `Threshold` | `HashiCorp_Boundary` is read if the new entry is not found, and removed on `threshold logout` | + +Tokens are always written using the new names. + +## Building + +``` +make build # builds bin/threshold (requires the embedded UI, see Makefile) +make build-no-ui # builds bin/threshold without the embedded admin UI +``` + +The embedded admin UI is built from the upstream `boundary-ui` project and is +not part of this repository. + +## Contributing + +See [CONTRIBUTING.md](CONTRIBUTING.md).