Release Notes
Changed
- The keyring provider now uses keyring 4's Rust-native Secret Service
transport on Linux, so source builds and binaries no longer require system
libdbus.
secretspec init --from now accepts every provider with declaration
reflection, including age, AWS Parameter Store, and Bitwarden Password
Manager, and accepts --project and --profile as explicit discovery
context for hierarchical stores.- Custom Rust providers now pass discovery context to the
Provider::reflect hook so hierarchical stores can select the project and
profile namespace.
Fixed
- The Bitwarden provider now treats a locked vault or a missing session as a
clear authentication failure on get/set, with the same "run bw login
and bw unlock, then set BW_SESSION" guidance in both cases, instead of
surfacing the underlying CLI error text.
- The Bitwarden provider now reports a missing
bw CLI with install
instructions instead of an authentication error: a machine without the CLI
is not an authentication state, and the install guidance ("…run 'bw login'
and 'bw unlock' to authenticate") used to match the not-authenticated
classifier and mask the real problem.
- Vault and OpenBao JWT authentication now allows the role to be omitted when
the auth mount has a server-configured default_role, while explicit URI or
environment roles continue to take precedence.
- Vault and OpenBao AppRole authentication now supports roles configured with
bind_secret_id=false by omitting secret_id from the login request when no
SecretID credential is configured.
secretspec import --delete-source now compares resolved storage entries
without conflating distinct cache address spaces, preventing equivalent
provider configurations (including dotenv path aliases) from deleting the
destination value. Sources without deletion support are also rejected before
any destination is written.- The AWS Secrets Manager provider now authenticates with shared credentials
file profiles backed by an active AWS login session, which previously failed
because the required AWS SDK feature was not enabled. BatchGetSecretValue
failures also report the full service error instead of a shortened message.
Added
- The dotenv provider accepts a leading
~ in custom paths, such as
dotenv:~/.config/my-project/.env, and resolves it to the user's home
directory.
- Vault and OpenBao AppRole and JWT authentication can target non-default auth
method mounts, including printable Unicode mount names, with the auth_mount
provider URI option.
secretspec add NAME --description "..." (available in 0.18) adds a secret
declaration to the active profile while preserving the manifest's
existing comments, formatting, and unrelated configuration.- AWS Parameter Store convention templates and bounded
GetParametersByPath
discovery can create declarations from the direct children of an existing
hierarchy without decrypting their values.
- Swift SDK (available in 0.18) for resolving SecretSpec manifests from macOS
12+ on Intel and Apple silicon. The SwiftPM package provides fluent and
one-shot resolution, typed failures, scopes, value-free reports, provenance,
environment export, codegen input, and deterministic as_path cleanup. Its
checksummed XCFramework includes the shared Rust resolver, so applications do
not need a Rust toolchain or separately installed native library.
secretspec delete removes one or more stored secret values without changing
their manifest declarations, while --all requires explicit confirmation.
secretspec import --delete-source verifies each destination value before
deleting its source, and retains the source when an existing target differs.- Bitwarden Password Manager provider (
bw://, bw build feature) for reading
and writing secrets in a personal or organization vault through the bw CLI.
Collections and organizations are addressed by name or by id
(bw://myorg@dev-secrets), ?type= and ?field= select an item type and
field, and ?server= asserts which self-hosted server the configuration
expects. Every item type is supported (login, secure note, card, identity, SSH
key), each with a default field shared by reads and writes. Item names are
matched in full and case-insensitively, and an ambiguous name is refused with
the colliding ids rather than resolved to an arbitrary item.
- Dashlane provider (
dashlane://) for reading secrets from a Dashlane vault
through the dcli CLI. Convention secrets read the item titled
secretspec/{project}/{profile}/{key}, and a ref names an existing item by
title or identifier with an optional field. dashlane://note,
dashlane://secret, or dashlane://password restrict the search to one
content type. The provider is read-only, because dcli has no command that
creates or edits a vault item; secretspec set fails with that reason.
Non-interactive use is supported through DASHLANE_SERVICE_DEVICE_KEYS,
which can also be injected as the service_device_keys provider credential.
Injected credentials read through a private, owner-only dcli state
directory of their own, because dcli otherwise prefers a device already
registered on the machine and reads that identity's vault instead.
- Keeper Secrets Manager provider (
keeper://FOLDER_UID, keeper build feature) using
Keeper's official Rust SDK, with convention-based records, references to
existing records and fields, provider credentials, batch reads, writes, and
cache-compatible deletion. SDK calls are safe from async Rust applications,
and updates preserve the JSON types of Keeper fields such as dates,
checkboxes, hosts, and names.
- AWS Systems Manager Parameter Store provider (
awsps://, awsps build
feature) for reading and writing KMS-encrypted
SecureString parameters. It supports AWS profiles and regions, an optional
hierarchy prefix, customer-managed KMS keys, parameter tiers, batched reads,
and references by parameter name, version, label, or ARN. Unversioned
parameter-name references can be written in place; version-, label-, and
ARN-pinned references are read-only. Writes reject unsupported reference
coordinates before requesting a value, and versioned ARN errors point to
writable parameter-name references. AWS service errors include their error
codes and messages instead of only unhandled error.
(#209)
Install secretspec 0.18.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.18.0/secretspec-installer.sh | sh
Download secretspec 0.18.0
