Skip to content

SourceOrrery 0.1.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 19:46
v0.1.3
f1fd347
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SourceOrrery 0.1.3

The first release: an encrypted local secrets vault with an Azure Key Vault–style lifecycle, a CLI and an interactive vault manager, and read-only SDKs for ten languages over one Rust core. Secrets belong to the runtime, not the repository.

What is in it

  • Encrypted vault. One SQLite file per vault; every value encrypted on its own (XChaCha20-Poly1305, bound to vault, name and version); the vault key protected by the OS credential store or an Argon2id passphrase. Versions, enforced not_before / expires_on, soft delete with recovery and purge.
  • Tamper evidence. Authenticated metadata, a keyed hash-chained audit log of every operation (never a value), row state bound to the chain, and a vault that refuses to work after its audit log was truncated until its owner reviews and acknowledges it.
  • CLI. vault, secret, audit [--verify|--acknowledge], init, check, run -- <command>. Values are never accepted as arguments and are shown only with secret get --reveal; run injects a project's secrets into a child process, so no .env file is needed.
  • sourceorrery ui. A terminal vault manager: overview dashboard, searchable secrets and versions, deleted secrets, the audit log with chain verification, confirmed metadata changes, new values through a hidden prompt, idle lock, and the documentation site's themes. It reads metadata only and never shows a value.
  • SDKs. Read-only clients for Python, JavaScript/TypeScript, Rust, Java, .NET, Go, C, C++ and PHP, with the CLI's unlock order, typed errors with actionable hints, and values that are zeroised and print as [REDACTED]. All of them pass one cross-language conformance suite.

The full list is in CHANGELOG.md; the threat model at sourceorrery.ai says exactly what is and is not protected. SourceOrrery has not been audited; do not treat it as a production secret store yet.

Install

From the package registries
CLI cargo install sourceorrery-cli
Python pip install sourceorrery
JavaScript / TypeScript npm install @sourceorreryai/sdk
Rust cargo add sourceorrery
Java ai.sourceorrery:sourceorrery:0.1.3 on Maven Central
.NET dotnet add package SourceOrrery
Go go get github.com/netizine/sourceorrery/bindings/go@v0.1.3
PHP composer require sourceorrery/sourceorrery

From this release: the CLI (sourceorrery-0.1.3-<target>), the C ABI library with its headers (sourceorrery-ffi-0.1.3-<target>), the Python wheels and sdist, the npm tarballs, the jar and the NuGet package, for Windows, macOS and Linux on x64 and arm64. Verify downloads with sha256sum -c SHA256SUMS.

From source: git clone --branch v0.1.3 https://github.com/Netizine/sourceorrery && cd sourceorrery && cargo build --release (Rust 1.88+ and a C compiler).

Step by step: Getting started.

Assets 31
Loading