Release Notes
Fixed
- Vault and OpenBao AppRole and JWT authentication methods now reuse login
tokens within each provider operation up to each token's reported use and
lease limits, including time spent completing authentication, avoiding
repeated logins without exhausting or outliving tokens during batches,
writes, or deletes. Invalid batch addresses are rejected before login, and
concurrent requests remain safe across Tokio runtime flavors while keeping
pooled HTTP connections alive for the full operation.
- Cached provider routes now recognize Vault and OpenBao configurations that
address the same endpoint, namespace, and mount as one store, even when they
use different provider names or authentication methods, so a cache cannot
target its own authoritative source.
- Provider and SDK errors now retain underlying causes such as authentication,
timeout, DNS, TLS, connection, and response-parsing failures. AWS Secrets
Manager errors also report AWS error codes and messages instead of only
unhandled error.
- Prebuilt Linux Go SDK and
secretspec-ffi libraries now include libdbus
instead of requiring the build host's libdbus-1.so.3, so they load on
NixOS and other systems without a matching system library.
(#214)
- The dotenv provider's "cannot store" error now tells you to rename the secret
in secretspec.toml when the name came from a manifest declaration, instead
of always pointing at a ref item the config may not contain.
- Typed loaders generated by
secretspec-derive now keep temporary files for
as_path secrets alive until the returned resolved secrets are dropped.
Install secretspec 0.17.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.17.1/secretspec-installer.sh | sh
Download secretspec 0.17.1
