Release Notes
Added
- Composed secrets derive read-only values such as connection strings from
other declared secrets using strict {SECRET_NAME} templates. Dependencies
are order-independent, may include other compositions, and are validated for
unknown references and cycles before provider access; unlike dotenv
expansion, values are substituted once without ambient environment lookup,
fallback operators, recursive expansion, or silent empty replacements.
- C# SDK (
Cachix.SecretSpec, available in 0.16): resolve secrets from .NET
through the shared native resolver, with fluent builder and one-shot APIs,
typed failure exceptions, value-free preflight reports, provenance,
environment export, typed-codegen input, and deterministic cleanup of
as_path files. The trimming-safe, NativeAOT-compatible NuGet package
includes native resolver builds for glibc and musl Linux x64/Arm64, macOS
x64/Arm64, and Windows x64/Arm64; Windows applications do not need a separate
Visual C++ Redistributable.
- Infisical provider (
infisical://), for Infisical Cloud and self-hosted
instances. Authenticates as a machine identity via Universal Auth, whose
client_id and client_secret can be sourced as provider credentials (with
INFISICAL_CLIENT_ID/INFISICAL_CLIENT_SECRET fallbacks), or with a
ready-made token/INFISICAL_TOKEN. A profile names the Infisical
environment, so a production profile reads the production environment;
projects whose environments do not correspond to profiles pin one with
?env=, and profiles stay separate either way. Secrets live at
/secretspec/{project}/{profile} (?path= overrides the prefix), with keys
stored verbatim, and secrets sharing a folder are fetched in one request. A
folder's imported secrets resolve too, with Infisical's own precedence. A
secret's ref can name an Infisical secret by folder, key and version.
Self-hosted and EU instances are named by the URI host, INFISICAL_DOMAIN, or
Infisical's legacy INFISICAL_API_URL. Provider selection and Rust API
documentation identify Infisical as available from SecretSpec 0.16.
Install secretspec 0.16.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.16.0/secretspec-installer.sh | sh
Download secretspec 0.16.0
