Merge ci/postgres-tests: Postgres-backed DB test job

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -3,6 +3,7 @@ name: ci
 on:
   push:
     branches: [main]
+    tags-ignore: ["**"]
   pull_request:
   workflow_dispatch:
   schedule:
@@ -48,3 +49,63 @@ jobs:
           fi
       - name: osv-scanner
         run: osv-scanner scan source -r .
+
+  # DB-backed Go tests need Postgres 16 with a pre-migrated template database.
+  # The image is built from testing/dbtest/docker (not HashiCorp's Docker Hub
+  # image) and published on 127.0.0.1:55432 because the tests hardcode loopback.
+  # Skipped on pull requests to spare the shared runner pool.
+  db-tests:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      TEST_DB_PORT: "55432"
+      PG_CONTAINER: threshold-sql-tests-${{ github.run_id }}
+    steps:
+      - name: require docker
+        run: |
+          if ! docker info >/dev/null 2>&1; then
+            echo "::error::this runner has no usable docker; db-tests need it"; exit 1
+          fi
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - name: start postgres (pre-migrated template)
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build -q -t threshold-test-pg:16 -f testing/dbtest/docker/Dockerfile.16-alpine testing/dbtest/docker
+          mkdir -p "$RUNNER_TEMP/benchmark_dumps"
+          docker run -d --name "$PG_CONTAINER" -p "$TEST_DB_PORT:5432" \
+            -e POSTGRES_PASSWORD=boundary -e POSTGRES_USER=boundary -e POSTGRES_DB=boundary \
+            -e PGDATA=/pgdata --mount type=tmpfs,destination=/pgdata \
+            -v "$PWD/internal/db/schema/migrations:/migrations" \
+            -v "$RUNNER_TEMP/benchmark_dumps:/benchmark_dumps" \
+            threshold-test-pg:16 -c config_file=/etc/postgresql/postgresql.conf
+          # init scripts run on a temporary server first; wait for the real one
+          for i in $(seq 1 120); do
+            if docker logs "$PG_CONTAINER" 2>&1 | grep -q "init process complete" \
+               && docker exec "$PG_CONTAINER" pg_isready -U boundary -d boundary >/dev/null 2>&1; then
+              echo "postgres ready"; exit 0
+            fi
+            sleep 3
+          done
+          docker logs "$PG_CONTAINER" | tail -30; echo "::error::postgres did not become ready"; exit 1
+      - name: go test (root module, DB-backed)
+        shell: bash
+        run: |
+          # Excluded: tests that start their own dev-DB/Vault containers via
+          # dockertest and then dial the mapped host port, which is unreachable
+          # from inside this job's container (internal/cmd/commands/server also
+          # fails the same way on untouched upstream).
+          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)|/internal/cmd/commands/server$|/internal/credential/vault$|/internal/daemon/controller$|/internal/daemon/controller/handlers/credentialstores$')
+          # *Estimated*Count / ListDeletedStoreIds depend on pg planner stats and
+          # also fail on untouched upstream Boundary (verified); skipped here.
+          go test $pkgs -count=1 -p 2 -timeout 90m \
+            -skip 'EstimatedCount|EstimatedCredentialCount|EstimatedLibraryCount|ListDeletedStoreIds'
+      - name: stop postgres
+        if: always()
+        run: docker rm -f -v "$PG_CONTAINER" || true
+

.github/workflows/build.yml

@@ -282,6 +282,7 @@ jobs:
           rpm_depends: "openssl"
           config_dir: ".release/linux/package/"
           preinstall: ".release/linux/preinst"
+          postinstall: ".release/linux/postinst"
           postremove: ".release/linux/postrm"
       - name: Add Linux Package names to env
         run: |

.release/docker/README_docker_io.md

@@ -25,6 +25,16 @@ and is not suitable for actual deployment.
 Please see the comments within the file for more information;
 full configuration details can be found on Threshold's documentation site.
 
+#### Upgrading from the HashiCorp Boundary image
+
+The configuration directory moved from `/boundary` to `/threshold`. For
+compatibility, `/boundary` is a symlink to `/threshold` inside the image, a
+`-config /boundary/config.hcl` argument (or a config mounted at
+`/boundary/config.hcl`) is still honored with a deprecation warning, `boundary`
+is accepted as a command name, and `BOUNDARY_*` environment variables are
+mirrored to `THRESHOLD_*`. Please migrate your mounts and arguments to the
+`/threshold` and `THRESHOLD_*` names.
+
 ### Postgres
 
 The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.

.release/docker/docker-entrypoint.sh

@@ -22,6 +22,54 @@ for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
     fi
 done
 
+# Backwards compatibility: the legacy HashiCorp Boundary image kept its config
+# in /boundary/config.hcl and ran the "boundary" binary. Accept both.
+# (The *_TEST_* overrides exist only for .release/docker/test-entrypoint.sh.)
+NEW_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_NEW:-/threshold/config.hcl}
+LEGACY_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_LEGACY:-/boundary/config.hcl}
+STOCK_CONFIG_COPY=${THRESHOLD_ENTRYPOINT_TEST_STOCK:-/usr/share/threshold/config.hcl.default}
+
+legacy_warn() {
+    >&2 echo "WARNING: $1 (deprecated Boundary-era path); please move to /threshold/config.hcl"
+}
+
+# Prints the config path that should actually be used for a requested -config
+# path. Prefers /threshold/config.hcl, falling back to /boundary/config.hcl.
+resolve_config_path() {
+    case "$1" in
+    "$NEW_CONFIG_PATH")
+        # The image ships a stock demo config at /threshold/config.hcl. If it is
+        # still the stock one and the user supplied their own legacy config
+        # (for example by mounting it at /boundary/config.hcl on an image
+        # where /boundary is a real directory), use theirs.
+        if [ -f "$LEGACY_CONFIG_PATH" ] && ! [ "$LEGACY_CONFIG_PATH" -ef "$NEW_CONFIG_PATH" ] \
+            && [ -f "$STOCK_CONFIG_COPY" ] && cmp -s "$NEW_CONFIG_PATH" "$STOCK_CONFIG_COPY"; then
+            legacy_warn "using $LEGACY_CONFIG_PATH"
+            echo "$LEGACY_CONFIG_PATH"
+            return
+        fi
+        ;;
+    "$LEGACY_CONFIG_PATH")
+        if [ -f "$LEGACY_CONFIG_PATH" ]; then
+            legacy_warn "using $LEGACY_CONFIG_PATH"
+        elif [ -f "$NEW_CONFIG_PATH" ]; then
+            legacy_warn "$LEGACY_CONFIG_PATH not found, falling back to $NEW_CONFIG_PATH"
+            echo "$NEW_CONFIG_PATH"
+            return
+        fi
+        ;;
+    esac
+    echo "$1"
+}
+
+# Accept the legacy command name: "docker run <image> boundary ..." (or an
+# entrypoint/command override that invokes boundary) runs threshold.
+if [ "$1" = 'boundary' ]; then
+    >&2 echo "WARNING: the 'boundary' command is deprecated; use 'threshold' (running threshold)"
+    shift
+    set -- threshold "$@"
+fi
+
 # If the user is trying to run Threshold directly with some arguments, then
 # pass them to Threshold.
 if [ "${1:0:1}" = '-' ]; then
@@ -38,6 +86,26 @@ elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
     set -- threshold "$@"
 fi
 
+# Rewrite -config arguments (see resolve_config_path).
+if [ "$1" = 'threshold' ]; then
+    _n=$#
+    _prev=""
+    while [ "$_n" -gt 0 ]; do
+        _a=$1
+        shift
+        _n=$((_n - 1))
+        case "$_prev" in
+        -config | --config) _new=$(resolve_config_path "$_a") ;;
+        *) _new=$_a ;;
+        esac
+        case "$_a" in
+        -config=* | --config=*) _new="${_a%%=*}=$(resolve_config_path "${_a#*=}")" ;;
+        esac
+        _prev=$_a
+        set -- "$@" "$_new"
+    done
+fi
+
 # If we are running Threshold, make sure it executes as the proper user.
 if [ "$1" = 'threshold' ]; then
 	is_root=0
@@ -51,6 +119,10 @@ if [ "$1" = 'threshold' ]; then
             if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
                 chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
             fi
+            # Legacy config dir, when it is a real directory (not the symlink to /threshold)
+            if [ -d /boundary ] && [ ! -L /boundary ] && [ "$(stat -c %u /boundary)" != "$(id -u threshold)" ]; then
+                chown -R threshold:threshold /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
+            fi
         else
             >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
         fi

.release/docker/test-entrypoint.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# Self-contained test for the legacy-path handling in docker-entrypoint.sh.
+#
+# Runs the real entrypoint with a fake "threshold" binary and temporary
+# config paths (via the THRESHOLD_ENTRYPOINT_TEST_* overrides). No Docker or
+# root needed. The entrypoint is written for busybox/ash; bash is used here
+# because it accepts the same ${var:off:len} syntax.
+#
+# Usage: .release/docker/test-entrypoint.sh
+
+set -u
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+ENTRY="$HERE/docker-entrypoint.sh"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+FAILS=0
+PASSES=0
+check() { # check DESC EXPECTED ACTUAL
+	if [ "$2" = "$3" ]; then
+		PASSES=$((PASSES + 1))
+	else
+		FAILS=$((FAILS + 1))
+		echo "FAIL: $1" >&2
+		echo "  expected: $2" >&2
+		echo "  actual:   $3" >&2
+	fi
+}
+
+mkdir -p "$WORK/bin" "$WORK/new" "$WORK/legacy"
+# Fake threshold: print the argument vector on one line, "|"-separated.
+cat >"$WORK/bin/threshold" <<'EOF'
+#!/bin/sh
+case "$1" in --help) [ "$2" = threshold ] || echo "threshold $2"; exit 0 ;; esac
+IFS='|'
+echo "ARGS:$*"
+EOF
+cat >"$WORK/bin/su-exec" <<'EOF'
+#!/bin/sh
+shift
+exec "$@"
+EOF
+chmod 755 "$WORK/bin/threshold" "$WORK/bin/su-exec"
+
+NEWCFG="$WORK/new/config.hcl"
+LEGCFG="$WORK/legacy/config.hcl"
+STOCK="$WORK/stock.hcl"
+
+run() { # run ARGS... ; prints "<stdout-args> || <stderr>"
+	PATH="$WORK/bin:$PATH" SKIP_CHOWN=1 SKIP_SETCAP=1 \
+		THRESHOLD_ENTRYPOINT_TEST_NEW="$NEWCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_LEGACY="$LEGCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_STOCK="$STOCK" \
+		bash "$ENTRY" "$@" 2>"$WORK/err" | grep '^ARGS:'
+}
+stderr() { cat "$WORK/err"; }
+
+echo "stock demo config" >"$STOCK"
+cp "$STOCK" "$NEWCFG"
+
+# 1. default invocation, stock config, no legacy file -> unchanged, no warning
+out=$(run server -config "$NEWCFG")
+check "default path kept" "ARGS:server|-config|$NEWCFG" "$out"
+check "no warning by default" "" "$(stderr | grep -c deprecated | grep -v '^0$')"
+
+# 2. user's own /threshold config (differs from stock) wins over a legacy file
+echo "user threshold config" >"$NEWCFG"
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config "$NEWCFG")
+check "custom threshold config preferred" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 3. stock /threshold config + user legacy config -> legacy used with warning
+cp "$STOCK" "$NEWCFG"
+out=$(run server -config "$NEWCFG")
+check "legacy config used when threshold is stock" "ARGS:server|-config|$LEGCFG" "$out"
+check "deprecation warning printed" "1" "$(stderr | grep -c 'WARNING.*Boundary-era')"
+
+# 4. explicit legacy path that exists -> used with warning
+out=$(run server -config "$LEGCFG")
+check "explicit legacy path kept" "ARGS:server|-config|$LEGCFG" "$out"
+check "explicit legacy warns" "1" "$(stderr | grep -c 'WARNING')"
+
+# 5. explicit legacy path that does not exist -> fall back to threshold path
+rm -f "$LEGCFG"
+out=$(run server -config "$LEGCFG")
+check "missing legacy falls back to threshold" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 6. -config=PATH form
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path form" "ARGS:server|-config=$LEGCFG" "$out"
+rm -f "$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path fallback" "ARGS:server|-config=$NEWCFG" "$out"
+
+# 7. legacy command name
+out=$(run boundary version)
+check "boundary command accepted" "ARGS:version" "$out"
+check "boundary command warns" "1" "$(stderr | grep -c "'boundary' command is deprecated")"
+
+# 8. unrelated args untouched
+out=$(run database init -config "$NEWCFG" -skip-auth-method-creation)
+check "other args preserved" "ARGS:database|init|-config|$NEWCFG|-skip-auth-method-creation" "$out"
+
+echo "passed: $PASSES, failed: $FAILS"
+[ "$FAILS" -eq 0 ]

.release/linux/package/usr/lib/systemd/system/threshold.service

@@ -5,6 +5,9 @@ StartLimitIntervalSec=60
 StartLimitBurst=3
 
 [Service]
+# Legacy HashiCorp Boundary environment file (BOUNDARY_* variables are still
+# honored). Read first so that threshold.env takes precedence.
+EnvironmentFile=-/etc/boundary.d/boundary.env
 EnvironmentFile=-/etc/threshold.d/threshold.env
 User=threshold
 Group=threshold

.release/linux/postinst

@@ -0,0 +1,163 @@
+#!/bin/sh
+# Threshold package post-install script (deb "postinst" / rpm "%post").
+#
+# Completes an in-place upgrade from a HashiCorp Boundary install. Safe to run
+# repeatedly; never deletes user configuration or data:
+#
+#   1. If the legacy "boundary" user exists and there is no "threshold" user,
+#      run the service as "boundary" through a systemd drop-in, so existing
+#      data/log directory ownership keeps working.
+#   2. Provide a "boundary" command: /usr/bin/boundary -> threshold, only if
+#      /usr/bin/boundary does not exist.
+#   3. If the legacy boundary.service is enabled/active: stop it, carry its
+#      enablement over to threshold.service, and start threshold.service if the
+#      old service was running (rolling back to boundary.service if that fails).
+#   4. Make "systemctl <verb> boundary" address threshold.service by adding a
+#      boundary.service alias symlink, unless something already exists there.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.
+
+set -eu
+
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+NEW_USER="threshold"
+LEGACY_USER="boundary"
+UNIT="threshold.service"
+LEGACY_UNIT="boundary.service"
+SYSTEMD_ETC="$ROOT/etc/systemd/system"
+DROPIN_DIR="$SYSTEMD_ETC/threshold.service.d"
+DROPIN="$DROPIN_DIR/10-legacy-boundary-user.conf"
+DROPIN_MARK="# Managed by the Threshold package (legacy boundary user reuse)"
+
+say() {
+	echo "threshold postinst: $*" >&2
+}
+
+user_exists() {
+	id -u "$1" >/dev/null 2>&1
+}
+
+have_systemd() {
+	command -v systemctl >/dev/null 2>&1 && [ -d "$ROOT/run/systemd/system" ]
+}
+
+# Print the Id= systemd resolves a unit name to (follows aliases).
+unit_id() {
+	systemctl show -p Id "$1" 2>/dev/null | sed -n 's/^Id=//p'
+}
+
+unit_load_state() {
+	systemctl show -p LoadState "$1" 2>/dev/null | sed -n 's/^LoadState=//p'
+}
+
+# Where the packaged threshold.service lives (merged-usr or not).
+packaged_unit_path() {
+	for _p in "$ROOT/usr/lib/systemd/system/$UNIT" "$ROOT/lib/systemd/system/$UNIT"; do
+		if [ -f "$_p" ]; then
+			echo "${_p#"$ROOT"}"
+			return 0
+		fi
+	done
+	return 1
+}
+
+# --- 1. legacy service user -------------------------------------------------
+if user_exists "$LEGACY_USER" && ! user_exists "$NEW_USER"; then
+	_group=$(id -gn "$LEGACY_USER" 2>/dev/null || echo "$LEGACY_USER")
+	_content="$DROPIN_MARK
+[Service]
+User=$LEGACY_USER
+Group=$_group"
+	if [ -e "$DROPIN" ] && ! grep -qF "$DROPIN_MARK" "$DROPIN"; then
+		say "leaving existing $DROPIN untouched (not managed by this package)"
+	else
+		mkdir -p "$DROPIN_DIR"
+		_tmp="$DROPIN.tmp.$$"
+		printf '%s\n' "$_content" >"$_tmp"
+		mv -f "$_tmp" "$DROPIN"
+		say "service will run as existing user '$LEGACY_USER' ($DROPIN)"
+	fi
+fi
+
+# --- 2. "boundary" command ----------------------------------------------------
+_bin="$ROOT/usr/bin/boundary"
+if [ ! -e "$_bin" ] && [ ! -L "$_bin" ]; then
+	if [ -e "$ROOT/usr/bin/threshold" ]; then
+		ln -s threshold "$_bin"
+	fi
+elif [ ! -L "$_bin" ]; then
+	say "/usr/bin/boundary is still the HashiCorp Boundary binary (old package installed); leaving it"
+	say "after removing the old package run: ln -s threshold /usr/bin/boundary"
+fi
+
+# --- 3 + 4. legacy systemd service ----------------------------------------------
+if have_systemd; then
+	_alias="$SYSTEMD_ETC/$LEGACY_UNIT"
+
+	if [ -L "$_alias" ]; then
+		# Already aliased (previous run): nothing to migrate.
+		:
+	elif [ -e "$_alias" ]; then
+		say "$_alias is a custom unit; not touching the legacy service."
+		say "move it away and re-run the package configuration to migrate."
+	else
+		_id=$(unit_id "$LEGACY_UNIT")
+		_load=$(unit_load_state "$LEGACY_UNIT")
+		_legacy_present=0
+		_was_enabled=0
+		_was_active=0
+		if [ "$_id" = "$LEGACY_UNIT" ] && [ "$_load" = "loaded" ]; then
+			_legacy_present=1
+			if systemctl is-enabled --quiet "$LEGACY_UNIT" 2>/dev/null; then
+				_was_enabled=1
+			fi
+			if systemctl is-active --quiet "$LEGACY_UNIT" 2>/dev/null; then
+				_was_active=1
+			fi
+		fi
+
+		# Only act on upgrades: a legacy unit or legacy config is present.
+		if [ "$_legacy_present" = 1 ] || [ -d "$ROOT/etc/boundary.d" ]; then
+			if [ "$_was_active" = 1 ]; then
+				say "stopping $LEGACY_UNIT"
+				systemctl stop "$LEGACY_UNIT" || say "could not stop $LEGACY_UNIT"
+			fi
+			if [ "$_was_enabled" = 1 ]; then
+				systemctl disable "$LEGACY_UNIT" >/dev/null 2>&1 || say "could not disable $LEGACY_UNIT"
+			fi
+
+			# Alias symlink so `systemctl restart boundary` reaches threshold.service.
+			if _unit_path=$(packaged_unit_path); then
+				mkdir -p "$SYSTEMD_ETC"
+				ln -s "$_unit_path" "$_alias"
+			fi
+			systemctl daemon-reload || true
+
+			if [ "$_was_enabled" = 1 ]; then
+				systemctl enable "$UNIT" >/dev/null 2>&1 || say "could not enable $UNIT"
+			fi
+			if [ "$_was_active" = 1 ]; then
+				if systemctl start "$UNIT"; then
+					say "$LEGACY_UNIT migrated to $UNIT (config: /etc/threshold.d)"
+				else
+					say "FAILED to start $UNIT; rolling back to $LEGACY_UNIT"
+					systemctl disable "$UNIT" >/dev/null 2>&1 || true
+					rm -f "$_alias"
+					systemctl daemon-reload || true
+					if [ "$_was_enabled" = 1 ]; then
+						systemctl enable "$LEGACY_UNIT" >/dev/null 2>&1 || true
+					fi
+					systemctl start "$LEGACY_UNIT" || say "could not restart $LEGACY_UNIT"
+				fi
+			elif [ "$_was_enabled" = 1 ]; then
+				say "$LEGACY_UNIT enablement carried over to $UNIT (not started: it was stopped)"
+			fi
+		fi
+	fi
+	# Pick up a new/changed user drop-in even when no migration was needed.
+	systemctl daemon-reload || true
+fi
+
+exit 0

.release/linux/postrm

@@ -1,8 +1,55 @@
-#!/bin/bash
+#!/bin/sh
+# Threshold package post-remove script (deb "postrm" / rpm "%postun").
+#
+# deb: $1 is remove|purge|upgrade|...    rpm: $1 is 0 (erase) or 1+ (upgrade)
+#
+# On final removal this removes only what the Threshold package scripts
+# themselves created: the managed systemd drop-in, the /usr/bin/boundary and
+# /etc/systemd/system/boundary.service symlinks (only if they point at
+# Threshold), and on purge the "threshold" user. User configuration, data and
+# the legacy "boundary" user are never touched.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.
 
-if [ "$1" = "purge" ]
+set -eu
-then
+
-  userdel threshold
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+SYSTEMD_ETC="$ROOT/etc/systemd/system"
+DROPIN_DIR="$SYSTEMD_ETC/threshold.service.d"
+DROPIN="$DROPIN_DIR/10-legacy-boundary-user.conf"
+DROPIN_MARK="# Managed by the Threshold package (legacy boundary user reuse)"
+
+# rm a symlink only if its target's basename matches $2.
+rm_link_if() {
+	if [ -L "$1" ]; then
+		_t=$(readlink "$1" || true)
+		case "${_t##*/}" in
+		"$2") rm -f "$1" ;;
+		esac
+	fi
+}
+
+case "${1:-}" in
+remove | purge | 0)
+	rm_link_if "$ROOT/usr/bin/boundary" threshold
+	rm_link_if "$SYSTEMD_ETC/boundary.service" threshold.service
+	rm_link_if "$SYSTEMD_ETC/multi-user.target.wants/threshold.service" threshold.service
+	if [ -f "$DROPIN" ] && grep -qF "$DROPIN_MARK" "$DROPIN"; then
+		rm -f "$DROPIN"
+		rmdir "$DROPIN_DIR" 2>/dev/null || true
+	fi
+	if command -v systemctl >/dev/null 2>&1 && [ -d "$ROOT/run/systemd/system" ]; then
+		systemctl daemon-reload >/dev/null 2>&1 || true
+	fi
+	;;
+esac
+
+if [ "${1:-}" = "purge" ]; then
+	if id -u threshold >/dev/null 2>&1; then
+		userdel threshold || true
+	fi
 fi
 
-exit 0
+exit 0

.release/linux/preinst

@@ -1,13 +1,98 @@
-#!/bin/bash
+#!/bin/sh
+# Threshold package pre-install script (deb "preinst" / rpm "%pre").
+#
+# Runs before the package files are unpacked. It is safe to run repeatedly and
+# never deletes or overwrites anything:
+#
+#   * Service user: if a HashiCorp Boundary "boundary" user already exists and
+#     there is no "threshold" user yet, no new user is created. The postinst
+#     script makes the service run as the existing "boundary" user so that its
+#     data/log directory ownership keeps working.
+#   * Configuration: files from /etc/boundary.d are COPIED to /etc/threshold.d
+#     (boundary.hcl -> threshold.hcl, boundary.env -> threshold.env, everything
+#     else keeps its name). An existing file in /etc/threshold.d is never
+#     replaced, and the originals in /etc/boundary.d are left untouched.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.
 
 set -eu
 
-USER="threshold"
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+NEW_USER="threshold"
+LEGACY_USER="boundary"
+LEGACY_DIR="$ROOT/etc/boundary.d"
+NEW_DIR="$ROOT/etc/threshold.d"
 
-if ! id -u $USER > /dev/null 2>&1; then
+say() {
-	useradd \
+	echo "threshold preinst: $*" >&2
-		--system \
+}
-		--user-group \
+
-		--shell /bin/false \
+user_exists() {
-		$USER
+	id -u "$1" >/dev/null 2>&1
-fi
+}
+
+# Map a top-level legacy file name to its Threshold name.
+map_name() {
+	case "$1" in
+	boundary.hcl) echo "threshold.hcl" ;;
+	boundary.env) echo "threshold.env" ;;
+	*) echo "$1" ;;
+	esac
+}
+
+# copy_tree SRC_DIR DST_DIR TOPLEVEL(0/1)
+# Copies entries that do not exist yet in DST_DIR; never overwrites.
+copy_tree() {
+	_src=$1
+	_dst=$2
+	_top=$3
+	for _f in "$_src"/* "$_src"/.[!.]*; do
+		if [ ! -e "$_f" ] && [ ! -L "$_f" ]; then
+			continue
+		fi
+		_name=${_f##*/}
+		if [ "$_top" = 1 ]; then
+			_name=$(map_name "$_name")
+		fi
+		_target="$_dst/$_name"
+		if [ -d "$_f" ] && [ ! -L "$_f" ]; then
+			if [ -d "$_target" ]; then
+				copy_tree "$_f" "$_target" 0
+			elif [ -e "$_target" ] || [ -L "$_target" ]; then
+				say "not replacing existing $_target"
+			else
+				cp -pR "$_f" "$_target"
+				say "copied $_f -> $_target"
+			fi
+		elif [ -e "$_target" ] || [ -L "$_target" ]; then
+			# Already present (user's own file, or a previous run): keep it.
+			:
+		else
+			cp -pP "$_f" "$_target"
+			say "copied $_f -> $_target"
+		fi
+	done
+}
+
+# --- service user -----------------------------------------------------------
+if ! user_exists "$NEW_USER"; then
+	if user_exists "$LEGACY_USER"; then
+		say "existing '$LEGACY_USER' user found; reusing it instead of creating '$NEW_USER'"
+	else
+		useradd \
+			--system \
+			--user-group \
+			--shell /bin/false \
+			"$NEW_USER"
+	fi
+fi
+
+# --- configuration migration ------------------------------------------------
+if [ -d "$LEGACY_DIR" ]; then
+	mkdir -p "$NEW_DIR"
+	copy_tree "$LEGACY_DIR" "$NEW_DIR" 1
+fi
+
+exit 0

.release/linux/test/test-package-scripts.sh

@@ -0,0 +1,267 @@
+#!/bin/sh
+# Self-contained test for the Linux package scripts (preinst/postinst/postrm).
+#
+# Simulates an old HashiCorp Boundary layout in a temporary directory (fake
+# /etc/boundary.d, a "boundary" user, a running boundary.service) using the
+# THRESHOLD_PKG_ROOT prefix and fake id/useradd/userdel/systemctl commands.
+# Needs neither root nor systemd.
+#
+# Usage: .release/linux/test/test-package-scripts.sh
+
+set -eu
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+PKG_DIR=$(cd "$HERE/.." && pwd)
+PREINST="$PKG_DIR/preinst"
+POSTINST="$PKG_DIR/postinst"
+POSTRM="$PKG_DIR/postrm"
+SH=${TEST_SH:-sh}
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+FAILS=0
+PASSES=0
+
+pass() { PASSES=$((PASSES + 1)); }
+fail() {
+	FAILS=$((FAILS + 1))
+	echo "FAIL: $*" >&2
+}
+assert() { # assert DESC cmd...
+	_d=$1
+	shift
+	if "$@"; then pass; else fail "$_d"; fi
+}
+refute() { # refute DESC cmd...
+	_d=$1
+	shift
+	if "$@"; then fail "$_d"; else pass; fi
+}
+file_has() { grep -qF -- "$2" "$1"; }
+file_eq() { [ "$(cat "$1")" = "$2" ]; }
+
+# --- fake commands ------------------------------------------------------------
+BIN="$WORK/bin"
+mkdir -p "$BIN"
+
+cat >"$BIN/id" <<'EOF'
+#!/bin/sh
+# fake id: id -u NAME | id -gn NAME ; users in $FAKE/users as name:group
+mode=$1
+name=$2
+line=$(grep "^$name:" "$FAKE/users" 2>/dev/null) || exit 1
+case "$mode" in
+-u) echo 1000 ;;
+-gn) echo "${line#*:}" ;;
+esac
+EOF
+cat >"$BIN/useradd" <<'EOF'
+#!/bin/sh
+for a in "$@"; do name=$a; done
+echo "$name:$name" >>"$FAKE/users"
+echo "useradd $name" >>"$FAKE/calls"
+EOF
+cat >"$BIN/userdel" <<'EOF'
+#!/bin/sh
+grep -v "^$1:" "$FAKE/users" >"$FAKE/users.new" || true
+mv "$FAKE/users.new" "$FAKE/users"
+echo "userdel $1" >>"$FAKE/calls"
+EOF
+cat >"$BIN/systemctl" <<'EOF'
+#!/bin/sh
+# fake systemctl backed by files in $FAKE (state) and $THRESHOLD_PKG_ROOT
+resolve() {
+	if [ -L "$THRESHOLD_PKG_ROOT/etc/systemd/system/$1" ]; then
+		_t=$(readlink "$THRESHOLD_PKG_ROOT/etc/systemd/system/$1")
+		echo "${_t##*/}"
+	else
+		echo "$1"
+	fi
+}
+echo "systemctl $*" >>"$FAKE/calls"
+case "$1" in
+show)
+	u=$(resolve "$4")
+	case "$3" in
+	Id) echo "Id=$u" ;;
+	LoadState)
+		if [ -f "$THRESHOLD_PKG_ROOT/usr/lib/systemd/system/$u" ]; then
+			echo "LoadState=loaded"
+		else
+			echo "LoadState=not-found"
+		fi
+		;;
+	esac
+	;;
+is-enabled) u=$(resolve "$3"); [ -e "$FAKE/enabled/$u" ] ;;
+is-active) u=$(resolve "$3"); [ -e "$FAKE/active/$u" ] ;;
+enable) u=$(resolve "$2"); : >"$FAKE/enabled/$u" ;;
+disable) u=$(resolve "$2"); rm -f "$FAKE/enabled/$u" ;;
+start)
+	u=$(resolve "$2")
+	[ -e "$FAKE/fail_start/$u" ] && exit 1
+	: >"$FAKE/active/$u"
+	;;
+stop) u=$(resolve "$2"); rm -f "$FAKE/active/$u" ;;
+daemon-reload) : ;;
+esac
+exit $?
+EOF
+chmod 755 "$BIN"/*
+
+# --- scenario helpers -----------------------------------------------------------
+new_root() { # new_root NAME -> sets ROOT and FAKE, creates skeleton
+	ROOT="$WORK/$1/root"
+	FAKE="$WORK/$1/fake"
+	mkdir -p "$ROOT/etc" "$ROOT/usr/bin" "$ROOT/usr/lib/systemd/system" \
+		"$ROOT/etc/systemd/system" "$ROOT/run/systemd/system" \
+		"$FAKE/enabled" "$FAKE/active" "$FAKE/fail_start"
+	: >"$FAKE/users"
+	: >"$FAKE/calls"
+	# What the package itself would have unpacked.
+	: >"$ROOT/usr/bin/threshold"
+	echo "[Service]" >"$ROOT/usr/lib/systemd/system/threshold.service"
+	export THRESHOLD_PKG_ROOT="$ROOT" FAKE
+}
+
+run_script() { # run_script SCRIPT [ARGS...]
+	_s=$1
+	shift
+	PATH="$BIN:$PATH" "$SH" "$_s" "$@" >"$WORK/out.log" 2>&1
+}
+
+add_legacy_layout() {
+	mkdir -p "$ROOT/etc/boundary.d/tls"
+	echo 'controller { name = "mine" }' >"$ROOT/etc/boundary.d/boundary.hcl"
+	echo 'BOUNDARY_POSTGRES_URL=secret' >"$ROOT/etc/boundary.d/boundary.env"
+	echo 'worker { name = "w" }' >"$ROOT/etc/boundary.d/worker.hcl"
+	echo 'KEY' >"$ROOT/etc/boundary.d/tls/server.key"
+	chmod 600 "$ROOT/etc/boundary.d/tls/server.key"
+	echo "boundary:boundary" >>"$FAKE/users"
+	echo "[Service]" >"$ROOT/usr/lib/systemd/system/boundary.service"
+}
+
+# ==============================================================================
+echo "== scenario 1: upgrade from Boundary (running + enabled), existing threshold.hcl"
+new_root s1
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+mkdir -p "$ROOT/etc/threshold.d"
+echo 'USER-OWNED' >"$ROOT/etc/threshold.d/threshold.hcl"
+
+assert "preinst succeeds" run_script "$PREINST" install
+assert "threshold.hcl NOT clobbered" file_eq "$ROOT/etc/threshold.d/threshold.hcl" "USER-OWNED"
+assert "boundary.env migrated to threshold.env" file_has "$ROOT/etc/threshold.d/threshold.env" "BOUNDARY_POSTGRES_URL=secret"
+assert "worker.hcl copied under same name" file_has "$ROOT/etc/threshold.d/worker.hcl" 'name = "w"'
+assert "subdirectory copied" file_has "$ROOT/etc/threshold.d/tls/server.key" "KEY"
+assert "originals kept: boundary.hcl" test -f "$ROOT/etc/boundary.d/boundary.hcl"
+assert "originals kept: boundary.env" test -f "$ROOT/etc/boundary.d/boundary.env"
+refute "no duplicate threshold user created" grep -q '^useradd' "$FAKE/calls"
+refute "no boundary.hcl name left in threshold.d" test -e "$ROOT/etc/threshold.d/boundary.hcl"
+
+assert "postinst succeeds" run_script "$POSTINST" configure
+assert "drop-in written" file_has "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf" "User=boundary"
+assert "drop-in group" file_has "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf" "Group=boundary"
+assert "boundary command symlink" test -L "$ROOT/usr/bin/boundary"
+assert "boundary symlink target is threshold" test "$(readlink "$ROOT/usr/bin/boundary")" = "threshold"
+assert "boundary.service alias symlink" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "legacy service stopped" test ! -e "$FAKE/active/boundary.service"
+assert "threshold enabled" test -e "$FAKE/enabled/threshold.service"
+assert "threshold started" test -e "$FAKE/active/threshold.service"
+refute "legacy unit not left enabled as itself" grep -q 'enable boundary.service' "$FAKE/calls"
+
+: >"$FAKE/calls"
+assert "postinst idempotent (2nd run)" run_script "$POSTINST" configure
+refute "2nd run does not stop/start anything" grep -qE 'systemctl (stop|start|enable|disable)' "$FAKE/calls"
+assert "preinst idempotent (2nd run)" run_script "$PREINST" upgrade
+assert "threshold.hcl still not clobbered" file_eq "$ROOT/etc/threshold.d/threshold.hcl" "USER-OWNED"
+
+echo "== scenario 1b: postrm remove/purge cleans only generated pieces"
+assert "postrm remove" run_script "$POSTRM" remove
+refute "boundary command symlink removed" test -L "$ROOT/usr/bin/boundary"
+refute "alias symlink removed" test -L "$ROOT/etc/systemd/system/boundary.service"
+refute "drop-in removed" test -e "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf"
+assert "user config untouched after remove" test -f "$ROOT/etc/boundary.d/boundary.hcl"
+assert "migrated config untouched after remove" test -f "$ROOT/etc/threshold.d/threshold.env"
+assert "postrm purge (no threshold user: no userdel)" run_script "$POSTRM" purge
+refute "boundary user never deleted" grep -q 'userdel boundary' "$FAKE/calls"
+
+# ==============================================================================
+echo "== scenario 2: fresh install, no Boundary"
+new_root s2
+assert "preinst succeeds" run_script "$PREINST" install
+assert "threshold user created" grep -q '^useradd threshold' "$FAKE/calls"
+refute "no /etc/threshold.d created by migration" test -e "$ROOT/etc/threshold.d"
+assert "postinst succeeds" run_script "$POSTINST" configure
+refute "no drop-in" test -e "$ROOT/etc/systemd/system/threshold.service.d"
+refute "no boundary.service alias on fresh install" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "boundary command symlink still provided" test -L "$ROOT/usr/bin/boundary"
+refute "threshold not auto-enabled on fresh install" test -e "$FAKE/enabled/threshold.service"
+assert "postrm purge deletes threshold user" run_script "$POSTRM" purge
+assert "userdel threshold called" grep -q '^userdel threshold' "$FAKE/calls"
+
+# ==============================================================================
+echo "== scenario 3: boundary service enabled but threshold start fails -> rollback"
+new_root s3
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+: >"$FAKE/fail_start/threshold.service"
+assert "preinst succeeds" run_script "$PREINST" install
+assert "postinst still exits 0" run_script "$POSTINST" configure
+assert "legacy service running again" test -e "$FAKE/active/boundary.service"
+assert "legacy service enabled again" test -e "$FAKE/enabled/boundary.service"
+refute "threshold left disabled" test -e "$FAKE/enabled/threshold.service"
+refute "alias removed on rollback" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "rollback explained" file_has "$WORK/out.log" "rolling back"
+
+# ==============================================================================
+echo "== scenario 4: enabled but stopped boundary service is only carried over"
+new_root s4
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+assert "threshold enabled" test -e "$FAKE/enabled/threshold.service"
+refute "threshold not started" test -e "$FAKE/active/threshold.service"
+
+# ==============================================================================
+echo "== scenario 5: custom regular-file /etc/systemd/system/boundary.service is left alone"
+new_root s5
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+echo "CUSTOM" >"$ROOT/etc/systemd/system/boundary.service"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+assert "custom unit untouched" file_eq "$ROOT/etc/systemd/system/boundary.service" "CUSTOM"
+assert "legacy service still running" test -e "$FAKE/active/boundary.service"
+refute "threshold not started" test -e "$FAKE/active/threshold.service"
+
+# ==============================================================================
+echo "== scenario 6: old boundary package binary present is not replaced"
+new_root s6
+add_legacy_layout
+echo "OLDBIN" >"$ROOT/usr/bin/boundary"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+refute "boundary binary not turned into symlink" test -L "$ROOT/usr/bin/boundary"
+assert "boundary binary content kept" file_eq "$ROOT/usr/bin/boundary" "OLDBIN"
+assert "postrm remove does not delete the old binary" run_script "$POSTRM" remove
+assert "old binary still there" test -f "$ROOT/usr/bin/boundary"
+
+# ==============================================================================
+echo "== scenario 7: threshold user already exists alongside boundary -> no drop-in"
+new_root s7
+add_legacy_layout
+echo "threshold:threshold" >>"$FAKE/users"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+refute "no drop-in when threshold user exists" test -e "$ROOT/etc/systemd/system/threshold.service.d"
+
+# ==============================================================================
+echo
+echo "passed: $PASSES, failed: $FAILS"
+[ "$FAILS" -eq 0 ]

Dockerfile

@@ -29,6 +29,13 @@ ADD .release/docker/config.hcl /threshold/config.hcl
 RUN chown -R threshold:threshold /threshold/
 RUN chmod -R 640 /threshold/*
 
+# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
+# "boundary" command alias (prints a deprecation notice on stderr).
+RUN mkdir -p /usr/share/threshold && \
+    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
+    ln -s /threshold /boundary && \
+    ln -s threshold /bin/boundary
+
 EXPOSE 9200 9201 9202
 VOLUME /threshold/
 
@@ -80,6 +87,13 @@ RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME
 RUN chown -R ${NAME}:${NAME} /threshold
 RUN chmod -R 640 /threshold/*
 
+# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
+# "boundary" command alias (prints a deprecation notice on stderr).
+RUN mkdir -p /usr/share/threshold && \
+    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
+    ln -s /threshold /boundary && \
+    ln -s ${BIN_NAME} /bin/boundary
+
 EXPOSE 9200 9201 9202
 VOLUME /threshold/
 

README.md

@@ -68,6 +68,117 @@ Other fallbacks:
 
 Tokens are always written using the new names.
 
+## Upgrading from Boundary
+
+Threshold is designed as an in-place replacement for HashiCorp Boundary CE:
+the same database, the same configuration files, and a binary that can still be
+invoked as `boundary`.
+
+### Compatibility guarantees
+
+These are unchanged from upstream Boundary CE, so a mixed fleet of Boundary and
+Threshold controllers and workers interoperates, and you can upgrade (and roll
+back) one node at a time:
+
+- **Database schema**: the schema migrations are untouched and the
+  `boundary_schema_version` table keeps its name. Threshold runs against an
+  existing Boundary database as-is (`threshold database migrate` applies the
+  same migrations Boundary would).
+- **Wire protocol**: protobuf packages, gRPC service names and the `/v1` HTTP
+  API paths are unchanged (only Go import paths were renamed). Versions are
+  still reported to peers with the `Boundary v` prefix.
+- **Plugin protocol**: the plugin magic cookie
+  (`HASHICORP_BOUNDARY_PLUGIN` / `boundary-plugin`) is unchanged, so existing
+  `boundary-plugin-*` binaries keep working.
+- **Configuration file format** (HCL) is unchanged.
+
+Do not run `database migrate` from a newer Threshold than your other nodes
+understand; as with Boundary, upgrade controllers before workers and follow the
+usual rolling-upgrade guidance for schema migrations.
+
+### Linux packages (deb/rpm)
+
+1. Back up `/etc/boundary.d` and take a database backup.
+2. Install the Threshold package. Do not `purge` the old `boundary` package
+   (removal is fine); purging runs its scripts, which may delete the `boundary`
+   user that Threshold will reuse. Installing Threshold while the old package is
+   still installed is supported.
+3. The package scripts then, automatically:
+   - **copy** `/etc/boundary.d` to `/etc/threshold.d` (`boundary.hcl` becomes
+     `threshold.hcl`, `boundary.env` becomes `threshold.env`; subdirectories such
+     as TLS material are copied as-is). Existing files in `/etc/threshold.d` are
+     never overwritten and the originals are never modified or deleted;
+   - keep reading `/etc/boundary.d/boundary.env` as a fallback environment file
+     (`threshold.env` takes precedence), so `BOUNDARY_*` variables keep working;
+   - reuse the existing `boundary` service user and group instead of creating a
+     `threshold` user (through a managed systemd drop-in,
+     `/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf`), so
+     ownership of your data, log and key directories keeps working;
+   - if `boundary.service` was enabled and/or running, stop and disable it,
+     enable `threshold.service`, and start it if the old service was running.
+     If `threshold.service` fails to start, the old service is restored;
+   - make `systemctl restart boundary` (and `status`, `stop`, ...) address
+     `threshold.service` via a `boundary.service` alias symlink in
+     `/etc/systemd/system`, and provide `/usr/bin/boundary` as a symlink to
+     `threshold` if no such file exists. The `boundary` command prints a
+     one-line deprecation notice to **stderr** only (silence it with
+     `THRESHOLD_NO_DEPRECATION_NOTICE=1`); stdout, flags and exit codes are
+     identical to `threshold`.
+4. Verify: `systemctl status threshold`, `threshold version`.
+
+What is **not** migrated automatically:
+
+- Paths *inside* your configuration files are not rewritten. A config that
+  refers to `/etc/boundary.d/...` or `/var/lib/boundary` keeps working because
+  those locations are left in place; update them at your own pace.
+- A custom `/etc/systemd/system/boundary.service` unit (a regular file) is left
+  alone and the legacy service is not touched; migrate it by hand.
+- If `/usr/bin/boundary` is still the old binary from the Boundary package, it is
+  left alone. After removing the old package: `ln -s threshold /usr/bin/boundary`.
+- Distribution-specific package-manager behavior such as `--force-confnew` (dpkg)
+  can replace `/etc/threshold.d` defaults; your originals remain in
+  `/etc/boundary.d`.
+- Data directories, the database, KMS keys and the client cache are not moved
+  (the client cache directory is covered by the table above).
+
+Rollback: stop `threshold.service`, remove the `boundary.service` alias
+symlink (`/etc/systemd/system/boundary.service`) and the drop-in, reinstall the
+old Boundary package, and `systemctl enable --now boundary`. Because the
+database schema is unchanged and `/etc/boundary.d` was never modified, nothing
+else needs to be restored. If you ran a Threshold release that applied schema
+migrations newer than your Boundary version, restore the database backup
+instead.
+
+### Container image
+
+The image's configuration directory moved from `/boundary` to `/threshold`
+(default command: `threshold server -config /threshold/config.hcl`). For
+compatibility the image:
+
+- contains `/boundary` as a symlink to `/threshold`, so existing
+  `-v "$(pwd)":/boundary/` mounts land in the right place;
+- falls back to `/boundary/config.hcl` (printing a deprecation warning) when
+  `-config /boundary/config.hcl` is requested, or when the stock demo config is
+  still in place and a config exists at `/boundary/config.hcl`;
+- accepts `boundary ...` as the command and `BOUNDARY_*` environment variables
+  (mirrored to `THRESHOLD_*`).
+
+Plan to switch your mounts, `-config` arguments and environment variables to
+the `/threshold` and `THRESHOLD_*` names; the compatibility paths print
+warnings and may be removed in a future major release.
+
+### Other installs (binary / zip)
+
+Replace the `boundary` binary with `threshold` (or keep the file name
+`boundary`, which behaves identically). Existing `BOUNDARY_*` variables,
+`~/.boundary` and stored credentials are picked up as described above.
+
+### Development mode
+
+`threshold dev` creates the `ssh.threshold.dev` and `postgres.threshold.dev`
+aliases and, for compatibility, the legacy `ssh.boundary.dev` and
+`postgres.boundary.dev` aliases pointing at the same targets.
+
 ## Building
 
 ```

cmd/threshold/main.go

@@ -10,5 +10,13 @@ import (
 )
 
 func main() {
+	// When invoked through the legacy "boundary" name (a symlink shipped in
+	// packages/images), print a one-line deprecation notice to stderr. Behavior
+	// is otherwise identical and stdout is never touched.
+	if len(os.Args) > 0 {
+		if notice := cmd.LegacyNameNotice(os.Args[0], os.Getenv); notice != "" {
+			_, _ = os.Stderr.WriteString(notice)
+		}
+	}
 	os.Exit(cmd.Run(os.Args[1:]))
 }

go.mod

@@ -176,7 +176,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

go.sum

@@ -398,8 +398,8 @@ github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
 github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
 github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
 github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=

internal/cmd/base/initial_resources.go

@@ -615,9 +615,11 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 }
 
 // Create targets that can be connected to using an alias. The three targets created are:
-//   - "postgres.boundary.dev": the Threshold dev postgres instance. Uses brokered credentials
+//   - "postgres.threshold.dev": the Threshold dev postgres instance. Uses brokered credentials
+//     (the legacy "postgres.boundary.dev" alias is also created)
 //   - "www.hashicorp.com": a web target
-//   - "ssh.boundary.dev": A localhost ssh target
+//   - "ssh.threshold.dev": A localhost ssh target (the legacy "ssh.boundary.dev"
+//     alias is also created)
 func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
 	rw := db.New(b.Database)
 
@@ -679,14 +681,9 @@ func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Re
 		return err
 	}
 
-	sshAlias := "ssh.boundary.dev"
+	sshAlias := "ssh.threshold.dev"
-	a, err := aliastar.NewAlias(ctx, "global", sshAlias, aliastar.WithDestinationId(t.GetPublicId()))
+	if err := createDevAliases(ctx, aliasRepo, t.GetPublicId(), sshAlias, legacySshAlias); err != nil {
-	if err != nil {
+		return err
-		return fmt.Errorf("failed to create alias object %w", err)
-	}
-	_, err = aliasRepo.CreateAlias(ctx, a)
-	if err != nil {
-		return fmt.Errorf("failed to save alias to the db %w", err)
 	}
 
 	b.InfoKeys = append(b.InfoKeys, "generated ssh target with alias")
@@ -694,6 +691,29 @@ func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Re
 	return nil
 }
 
+// Legacy dev-mode alias names used by upstream HashiCorp Boundary. They are
+// still created, pointing at the same targets, so existing scripts and muscle
+// memory keep working.
+const (
+	legacySshAlias      = "ssh.boundary.dev"
+	legacyPostgresAlias = "postgres.boundary.dev"
+)
+
+// createDevAliases creates one alias per value, all pointing at the given
+// destination target.
+func createDevAliases(ctx context.Context, aliasRepo *aliastar.Repository, destinationId string, values ...string) error {
+	for _, v := range values {
+		a, err := aliastar.NewAlias(ctx, "global", v, aliastar.WithDestinationId(destinationId))
+		if err != nil {
+			return fmt.Errorf("failed to create alias object %w", err)
+		}
+		if _, err = aliasRepo.CreateAlias(ctx, a); err != nil {
+			return fmt.Errorf("failed to save alias to the db %w", err)
+		}
+	}
+	return nil
+}
+
 func (b *Server) createPostgresAliasTarget(ctx context.Context,
 	targetRepo *target.Repository,
 	aliasRepo *aliastar.Repository,
@@ -757,14 +777,9 @@ func (b *Server) createPostgresAliasTarget(ctx context.Context,
 		return fmt.Errorf("failed to associate cred to target: %w", err)
 	}
 
-	postgresAlias := "postgres.boundary.dev"
+	postgresAlias := "postgres.threshold.dev"
-	a, err := aliastar.NewAlias(ctx, "global", postgresAlias, aliastar.WithDestinationId(t.GetPublicId()))
+	if err := createDevAliases(ctx, aliasRepo, t.GetPublicId(), postgresAlias, legacyPostgresAlias); err != nil {
-	if err != nil {
+		return err
-		return fmt.Errorf("failed to create alias object %w", err)
-	}
-	_, err = aliasRepo.CreateAlias(ctx, a)
-	if err != nil {
-		return fmt.Errorf("failed to save alias to the db %w", err)
 	}
 
 	b.InfoKeys = append(b.InfoKeys, "generated postgres target with alias")

internal/cmd/legacy_alias.go

@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// legacyBinaryName is the name of the upstream HashiCorp Boundary binary. A
+// "boundary" symlink to the threshold binary is shipped in packages and
+// container images so existing scripts keep working.
+const legacyBinaryName = "boundary"
+
+// envNoLegacyNameNotice, when set to a non-empty value, silences the
+// deprecation notice printed when the binary is invoked as "boundary".
+const envNoLegacyNameNotice = "THRESHOLD_NO_DEPRECATION_NOTICE"
+
+// invokedAsLegacyName reports whether argv0 refers to the legacy "boundary"
+// binary name. Directory components and a Windows ".exe" suffix are ignored.
+func invokedAsLegacyName(argv0 string) bool {
+	// Normalize Windows separators too, since filepath.Base on unix does not
+	// treat backslash as a separator.
+	argv0 = strings.ReplaceAll(argv0, `\`, "/")
+	base := strings.ToLower(filepath.Base(argv0))
+	base = strings.TrimSuffix(base, ".exe")
+	return base == legacyBinaryName
+}
+
+// LegacyNameNotice returns the one-line deprecation notice (including a
+// trailing newline) to write to stderr when the binary was invoked as
+// "boundary", or an empty string when no notice should be shown. No notice is
+// shown for any other invocation name, when shell completion is running
+// (COMP_LINE is set, so that a notice never corrupts the user's prompt), or
+// when THRESHOLD_NO_DEPRECATION_NOTICE is set. The notice is only ever written
+// to stderr so that machine-readable stdout output is unaffected.
+//
+// getenv is typically os.Getenv.
+func LegacyNameNotice(argv0 string, getenv func(string) string) string {
+	if !invokedAsLegacyName(argv0) {
+		return ""
+	}
+	if getenv("COMP_LINE") != "" || getenv(envNoLegacyNameNotice) != "" {
+		return ""
+	}
+	return "Note: the 'boundary' command name is deprecated; use 'threshold' instead. " +
+		"(Set " + envNoLegacyNameNotice + "=1 to silence this notice.)\n"
+}

internal/cmd/legacy_alias_test.go

@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInvokedAsLegacyName(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		argv0 string
+		want  bool
+	}{
+		{"boundary", true},
+		{"/usr/bin/boundary", true},
+		{"./boundary", true},
+		{`C:\bin\boundary.exe`, true},
+		{"Boundary.EXE", true},
+		{"threshold", false},
+		{"/usr/bin/threshold", false},
+		{"boundary-worker", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.argv0, func(t *testing.T) {
+			assert.Equal(t, tt.want, invokedAsLegacyName(tt.argv0))
+		})
+	}
+}
+
+func TestLegacyNameNotice(t *testing.T) {
+	t.Parallel()
+	env := func(m map[string]string) func(string) string {
+		return func(k string) string { return m[k] }
+	}
+	n := LegacyNameNotice("/usr/bin/boundary", env(nil))
+	assert.True(t, strings.HasSuffix(n, "\n"))
+	assert.Equal(t, 1, strings.Count(n, "\n"), "notice must be a single line")
+	assert.Contains(t, n, "threshold")
+
+	assert.Empty(t, LegacyNameNotice("/usr/bin/threshold", env(nil)))
+	assert.Empty(t, LegacyNameNotice("boundary", env(map[string]string{"COMP_LINE": "boundary auth"})))
+	assert.Empty(t, LegacyNameNotice("boundary", env(map[string]string{envNoLegacyNameNotice: "1"})))
+}

osv-scanner.toml

@@ -0,0 +1,19 @@
+# Known, accepted findings. Revisit before ignoreUntil or when upstream publishes a fix.
+
+# github.com/docker/docker 28.5.2: no fixed version published yet. Test-only
+# transitive dependency (golang-migrate -> dktest, used by DB tests); no
+# non-test package imports it and govulncheck reports it as not reachable.
+[[IgnoredVulns]]
+id = "GO-2026-4883"
+ignoreUntil = 2026-12-31
+reason = "docker/docker has no fix; test-only transitive dep, not reachable"
+
+[[IgnoredVulns]]
+id = "GHSA-pxq6-2prw-chj9"
+ignoreUntil = 2026-12-31
+reason = "alias of GO-2026-4883; test-only, not reachable"
+
+[[IgnoredVulns]]
+id = "GO-2026-4887"
+ignoreUntil = 2026-12-31
+reason = "docker/docker has no fix; test-only transitive dep, not reachable"

plugins/boundary/mains/aws/go.mod

@@ -1,34 +1,34 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/aws
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/aws
 
 go 1.26.9
 
 require (
-	github.com/hashicorp/boundary-plugin-aws v0.5.2
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.2 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.2 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.52.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.2 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -41,7 +41,7 @@ require (
 	github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.7.0 // indirect
-	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8 // indirect

plugins/boundary/mains/aws/go.sum

@@ -6,38 +6,38 @@ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
 github.com/aws/aws-sdk-go-v2/config v1.32.2 h1:4liUsdEpUUPZs5WVapsJLx5NPmQhQdez7nYFcovrytk=
 github.com/aws/aws-sdk-go-v2/config v1.32.2/go.mod h1:l0hs06IFz1eCT+jTacU/qZtC33nvcnLADAPL/XyrkZI=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2 h1:qZry8VUyTK4VIo5aEdUcBjPZHL2v4FyQ3QEOaWcFLu4=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2/go.mod h1:YUqm5a1/kBnoK+/NY5WEiMocZihKSo15/tJdmdXnM5g=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 h1:WZVR5DbDgxzA0BJeudId89Kmgy6DIU4ORpxwsVHz0qA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14/go.mod h1:Dadl9QO0kHgbrH1GRqGiZdYtW5w+IXXaBNCHTIaheM4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 h1:RhSoBFT5/8tTmIseJUXM6INTXTQDF8+0oyxWBnozIms=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 h1:fTLR6dLDTGChAjecRPlVrKeznT0rVdzR4yn9Z68MTGk=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0/go.mod h1:mzj8EEjIHSN2oZRXiw1Dd+uB4HZTl7hC8nBzX9IZMWw=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0/go.mod h1:V0jbRy1/IPapnkqgXSwVOFB+u5pnCwd9S+R3pKWULC4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.52.2 h1:li0ooCUfHIivHn8nB3LstP6HgdNefwu5gnXE4MLVz/U=
 github.com/aws/aws-sdk-go-v2/service/iam v1.52.2/go.mod h1:PuHz5kGh1jtsNpjezdYhRp7xgn6DzCNJJfQt7O7U9Aw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 h1:MxMBdKTYBjPQChlJhi4qlEueqB1p1KcbTEa7tD5aqPs=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2/go.mod h1:iS6EPmNeqCsGo+xQmXv0jIMjyYtQfnwg36zl2FwEouk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 h1:ksUT5KtgpZd3SAiFJNJ0AFEJVva3gjBmN7eXUZjzUwQ=
@@ -46,8 +46,8 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 h1:GtsxyiF3Nd3JahRBJbxLCCd
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10/go.mod h1:/j67Z5XBVDx8nZVp9EuFM9/BS5dvBznbqILGuu73hug=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2 h1:a5UTtD4mHBU3t0o6aHQZFJTNKVfxFWfPX7J0Lr7G+uY=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2/go.mod h1:6TxbXoDSgBQ225Qd8Q+MbxUxUh6TtNKwbRt/EPS9xso=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
@@ -67,10 +67,6 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary-plugin-aws v0.5.2 h1:vt0e/dLNTSPE3fnCoRMN6BeYQd+2ByQ0RnxKcRsmi9w=
-github.com/hashicorp/boundary-plugin-aws v0.5.2/go.mod h1:hGiUb1Ktaqt1w8rLfd2VRh5R0uMIDE6e5DldPf9L0aw=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -92,8 +88,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
 github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 h1:KlDrZWx/wYpnUcFPB0s9uhPjyNZoeIfhrV2MN/Ly76s=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3 h1:mLe7IMysLSedhuu00W7AXsbfb90AA7UKfZmw3OkJ8n4=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
@@ -202,3 +198,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0 h1:2QhSdC9IEmjGoVwKUA3BpXdNAhRyuibDLysT48qdX5Q=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0/go.mod h1:yVcnlD/mAQT7VuMmFPUG7uwFNyeH5th7rmShsORY3vs=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=

plugins/boundary/mains/aws/main.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"
 
-	aws "github.com/hashicorp/boundary-plugin-aws/plugin"
+	aws "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )
 
 func main() {

plugins/boundary/mains/azure/go.mod

@@ -1,10 +1,10 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/azure
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/azure
 
 go 1.26.9
 
 require (
-	github.com/hashicorp/boundary-plugin-azure v0.2.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )
 
 require (

plugins/boundary/mains/azure/go.sum

@@ -153,10 +153,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/hashicorp/boundary-plugin-azure v0.2.0 h1:JmsJamOb6IEWodQ7CJW9wJz09o+Q2fk1Cm0GnNruQuQ=
-github.com/hashicorp/boundary-plugin-azure v0.2.0/go.mod h1:V0zTGIqZQNYl9fl7q+NX13F4AyJ3pMGVlfopFfZr9O0=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -569,6 +565,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0 h1:RTy3GlI9GFlJygIbCaLqBYNK8JofVddGK/AMQM+p7aA=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0/go.mod h1:ztBEnNknX6KvYBD7aKV0u46xWTRooegNP227RsPl3Gc=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

plugins/boundary/mains/azure/main.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"
 
-	az "github.com/hashicorp/boundary-plugin-azure/plugin"
+	az "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )
 
 func main() {

plugins/boundary/mains/gcp/go.mod

@@ -1,10 +1,10 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/gcp
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/gcp
 
 go 1.26.9
 
 require (
-	github.com/hashicorp/boundary-plugin-gcp v0.1.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )
 
 require (

plugins/boundary/mains/gcp/go.sum

@@ -63,10 +63,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedu
 github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
 github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
 github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
-github.com/hashicorp/boundary-plugin-gcp v0.1.0 h1:fIq07J0byp3qJ7aCC+oN+hLt11V5kjgzj3HpOa6r32o=
-github.com/hashicorp/boundary-plugin-gcp v0.1.0/go.mod h1:l15UQaKEEcppwrFGGVNBBVmAZqN5HaOk29dh5uVVztQ=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -218,3 +214,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0 h1:rw4bCBHxBDFPX/Blmqo1+gik+04sXdKHISMjYHM1zW4=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0/go.mod h1:rKjdEXM59o6Uhq62wsD4UBaLs7PTZl2PScqZ5Abe19w=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=

plugins/boundary/mains/gcp/main.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"
 
-	gcp "github.com/hashicorp/boundary-plugin-gcp/plugin"
+	gcp "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )
 
 func main() {

plugins/boundary/mains/minio/go.mod

@@ -1,21 +1,19 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/minio
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/minio
 
 go 1.26.9
 
 require (
-	github.com/hashicorp/boundary-plugin-minio v0.1.7
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )
 
 require (
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/color v1.19.0 // indirect
-	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/goccy/go-json v0.10.4 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/eventlogger v0.2.11 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
@@ -30,24 +28,29 @@ require (
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.0.83 // indirect
+	github.com/minio/minio-go/v7 v7.2.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.1.0 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/secure-io/sio-go v0.3.1 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/tinylib/msgp v1.6.1 // indirect
+	github.com/zeebo/xxh3 v1.1.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
@@ -56,5 +59,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
 	google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
+	gopkg.in/ini.v1 v1.67.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0 // indirect
 )

plugins/boundary/mains/minio/go.sum

@@ -1,11 +1,11 @@
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -20,33 +20,41 @@ github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
 github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/cli v26.1.4+incompatible h1:I8PHdc0MtxEADqYJZvhBrW9bo8gawKwwenxRM7/rLu8=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
-github.com/docker/cli v26.1.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v27.5.0+incompatible h1:um++2NcQtGRTz5eEgO6aJimo6/JxrTXC941hd05JO6U=
+github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
-github.com/docker/docker v27.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
-github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -55,12 +63,6 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary-plugin-minio v0.1.7 h1:s6VVeYor6jm6+RtEjAgRahrsi6HW5NMOoY9RhjVXBwo=
-github.com/hashicorp/boundary-plugin-minio v0.1.7/go.mod h1:x7qnQE0bGwsRCiBXMMad1u+nhsLAa2Jpbpu9P3ysNQ0=
-github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0 h1:VH/D4t0L3wmVPn7a1DDqF4nSOTGuWktXLnDny98y63Y=
-github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0/go.mod h1:y0Q45edl67+Q8CVtnMpDeneusJv8ypMXWrKDyTA82qI=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -113,11 +115,13 @@ github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
 github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
 github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
+github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
-github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
+github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
+github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -130,10 +134,12 @@ github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
+github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.83 h1:W4Kokksvlz3OKf3OqIlzDNKd4MERlC2oN8YptwJ0+GA=
+github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
-github.com/minio/minio-go/v7 v7.0.83/go.mod h1:57YXpvc5l3rjPdhqNrDsvVlY0qPI6UTk1bflAe+9doY=
+github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -145,21 +151,27 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
+github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
+github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opencontainers/runc v1.1.14 h1:rgSuzbmgz5DUJjeSnw337TxDbRuqjs6iqQck/2weR6w=
+github.com/opencontainers/runc v1.3.6 h1:SLGIymCtsk80iNPWgbc8dtjI30r+5mTVV+4dN8/17Sk=
-github.com/opencontainers/runc v1.1.14/go.mod h1:E4C2z+7BxR7GHXp0hAY53mek+x49X1LjPNeMTfRGvOA=
+github.com/opencontainers/runc v1.3.6/go.mod h1:o1wyv76EDlTkcf0KTFgN8bMWLPvgF/HfX709lDv+rr4=
 github.com/ory/dockertest/v3 v3.11.0 h1:OiHcxKAvSDUwsEVh2BjxQQc/5EHz9n0va9awCtNGuyA=
 github.com/ory/dockertest/v3 v3.11.0/go.mod h1:VIPxS1gwT9NpPOrfD3rACs8Y9Z7yhzO4SB194iUDnUI=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -176,22 +188,46 @@ github.com/secure-io/sio-go v0.3.1 h1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rR
 github.com/secure-io/sio-go v0.3.1/go.mod h1:+xbkjDzPjwh4Axd07pRKSNriS9SCiYksWnZqdnfpQxs=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
+github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
@@ -224,9 +260,16 @@ google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e/go.mod h1:7aY/K
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/ini.v1 v1.67.2 h1:JtOSMb9OuaCZKr7h5D/h6iii14sK0hLbplTc6frx4Ss=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/ini.v1 v1.67.2/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0 h1:ezLFD2ryLMUDPg1PFzXTgR4xz/v/4P7rT68y1pOUeow=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0/go.mod h1:0jQJKoqKB4AoW57TYHaFg+/Tyux4gxDg1zchqOlbWwA=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0 h1:1pNNc5lPXYWeLNn6KRzKydHEvyKMeLIs3ZauC9h+/1M=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0/go.mod h1:RwjAcIDH2aYt3lVdIEv/3XdB5Z2VaTWRhv9EJDFBgW0=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=

plugins/boundary/mains/minio/serve.go

@@ -7,8 +7,8 @@
 package main
 
 import (
-	minio "github.com/hashicorp/boundary-plugin-minio/plugin"
+	minio "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )
 
 func serve() error {

plugins/kms/mains/alicloudkms/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/alicloudkms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/alicloudkms
 
 go 1.26.9
 

plugins/kms/mains/awskms/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/awskms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/awskms
 
 go 1.26.9
 

plugins/kms/mains/azurekeyvault/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/azurekeyvault
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/azurekeyvault
 
 go 1.26.9
 

plugins/kms/mains/gcpckms/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/gcpckms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/gcpckms
 
 go 1.26.9
 

plugins/kms/mains/ibmkp/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/ibmkp
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/ibmkp
 
 go 1.26.9
 

plugins/kms/mains/ocikms/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/ocikms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/ocikms
 
 go 1.26.9
 

plugins/kms/mains/transit/go.mod

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/transit
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/transit
 
 go 1.26.9