EnvSeal v6.1.0

EnvSeal v6.1.0 is a focused quality-of-life release that adds interactive editing of vault secrets via your preferred editor.

---

Highlights

New envseal edit command
Open the secrets for a group (and optional tag) in your default editor ($EDITOR / $VISUAL, falling back to nano on Unix or notepad on Windows).

• Decrypts the selected secrets into a temporary file
• Lets you add, change, or delete keys using familiar .env syntax
• Securely overwrites (zeroes) the temp file on exit
• Writes only the net changes back into the encrypted vault

# Edit base secrets for the current/linked group
envseal edit

# Edit a specific tag
envseal edit --tag staging

# Edit a specific group
envseal edit --group myapp

This is especially useful for bulk updates or when you prefer a GUI/native editor over repeated set / rm commands.

---

Other Changes

• Version bump to 6.1.0
• Minor documentation improvements for the new edit workflow
• Integration test updates

---

This is a non-breaking, additive release. Existing vaults and workflows continue to work unchanged.

Full Changelog: v6.0.0...v6.1.0

EnvSeal v6.0.0

EnvSeal v6.0.0 replaces the shared-password encryption architecture with an asymmetric, zero-trust model powered by Age and SSH keys, adds native Git branch binding, and integrates a pre-commit defense shield.

---

Breaking Changes: No Backward Compatibility

Manual Migration Required
v6.0.0 introduces a redesigned cryptographic container format that cannot parse or decrypt legacy .envseal files created with v5.x or earlier. In-place upgrades are not supported.

To migrate an existing project:

1. Export secrets using your existing v5.x binary:

# Run with your previous EnvSeal version:
envseal export -o ./legacy_secrets.env

2. Install EnvSeal v6.0.0.
3. Re-initialize the project and re-import:

rm .envseal
envseal init --local
envseal git-setup
envseal import ./legacy_secrets.env
rm ./legacy_secrets.env

---

Highlights

• Asymmetric Age & SSH Key Encryption: Vault access is now authorized per collaborator using standard Age identities (age1...) or SSH public keys (~/.ssh/id_ed25519.pub). Shared team passwords and secondary tag passwords (protag) are eliminated.

• Direct GitHub Recipient Onboarding: Authorize teammates without manual public-key copy-pasting by pulling their public keys directly from GitHub via envseal recipient add @username.

• Git-Native Branch Binding: envseal run automatically checks the current active branch (git rev-parse --abbrev-ref HEAD) and injects matching tagged secrets, falling back cleanly to base variables.

• Pre-Commit Shield: envseal git-setup installs an automated pre-commit hook that stops staged .env, .env.local, and .env.staging files from being committed to version control.

---

Architectural Changes

Capability	Legacy (v5.x)	v6.0.0
Identity System	Master Password + Argon2id	Asymmetric Age / SSH public keys
Access Boundaries	protag secondary passwords	Scoped tags + recipient authorization
Branch Context	Explicit manual --tag	Automatic branch-to-tag detection
Collaborator Access	Distribute shared password	envseal recipient add / rm
Leak Prevention	Manual .gitignore management	Native pre-commit hook (git-setup)
Legacy File Support	v5.x vault container	None (clean re-initialization required)

---

CLI & Command Reference

Added:

• envseal recipient id: Print your local public identity key.
• envseal recipient add <@user | KEY | FILE>: Add a collaborator via GitHub handle, raw public key, or keyfile.
• envseal recipient ls: List all authorized recipient keys for the current vault.
• envseal recipient rm <NAME INDEX KEY |>: Revoke a recipient and re-encrypt the vault for remaining keys.

Removed:

• envseal passwd: Removed. Master passphrases no longer exist; encryption is tied to asymmetric keypairs.
• envseal protag: Removed. Tag-level secondary passwords have been replaced by asymmetric recipient management and branch scoping.

---

Security Considerations

• Git History & Forward Secrecy: Running envseal recipient rm or envseal rotate prevents revoked keys from reading future commits. However, older Git commits retain their historic ciphertext. If a collaborator departs or a key is compromised, you must rotate the actual credentials (API keys, database passwords) at the provider level.

• Solo Developer Key Recovery: Zero-trust architecture means there is no central password recovery. Back up your identity key (~/.ssh/id_ed25519 or Age identity), or add a secondary hardware/device key as a backup recipient to avoid locking yourself out.

Full Changelog: v5.1.0...v6.0.0

EnvSeal v5.1.0

Native Git Integration

• 3-way cryptographic merge driver (envseal merge): Safely merges encrypted .envseal vaults during Git conflicts without ever exposing plaintext secrets.

• Configurable merge strategies: Support for standard strategies via git config envseal.merge.strategy [fail|ours|theirs], or one-off overrides with git -c envseal.merge.strategy=ours merge.

• On-the-fly diff driver (envseal diff / textconv): git diff, git log, etc. now show plaintext diffs in memory only—no sensitive data written to disk.

• envseal git-setup command (renamed from earlier setup): Configures local Git merge/diff drivers and automatically updates .gitignore to exclude lock files. Also cleans up orphaned .merge_file_*.lock temporary files.

Password Management

• New envseal passwd command: Change the vault master password. Rotates the Key Encryption Key (KEK), re-encrypts the Master DEK in-place, and leaves secret entries and existing zero-trust tokens untouched.

Reliability, UX & Platform Improvements

• IDE $GIT_ASKPASS support: Background Git operations triggered by editors (VS Code, Cursor, JetBrains, etc.) now correctly surface password prompts in the IDE’s native UI.

• Timeout-bound coalescing locks (.envseal.prompt.lock): Prevents “thundering herd” password prompt storms when multiple concurrent IDE workers access the vault.

• Headless Linux / WSL2 degradation: Graceful fallback when D-Bus/keyring is unavailable—warns on stderr and continues with in-memory decryption instead of crashing.

• Improved group resolution: Recursive search for group fetching.

• Bug fixes & quality: Crucial bug fixes (including rotation and architectural issues), code formatting, updated integration tests, binary size/speed improvements, install-script and workflow updates.

• Windows: Re-added support via WinGet (work in progress in this release cycle).

• Extensive README updates covering Git merge strategies, conflict handling, and overall documentation polish.

Full Changelog

v5.0.0...v5.1.0

This is a focused quality and developer-experience release that makes EnvSeal far more practical for real team Git workflows while adding the missing password-change capability.

EnvSeal v5.0.0

EnvSeal v5.0.0

Zero-trust secrets for local development and production CI/CD.

EnvSeal just grew up. What started as “a better way to stop committing .env files” is now a full cryptographic secrets engine with least-privilege tokens, instant revocation, and a design that assumes your CI runner is already compromised.

No more sharing the master password with the pipeline. No more hoping expiration will save you. No more plaintext secrets sitting in process lists.

---

Highlights

• Zero-trust bearer tokens — Mint short-lived, least-privilege tokens that can decrypt specific secrets (or an entire tag) without ever seeing the master password, KEK, or signing key.
• DEK rotation — One command (envseal rotate) regenerates the Data Encryption Key for a scope and instantly invalidates every existing token for that scope.
• Cryptographic hierarchy — Master password → Argon2id → KEK → Master DEK → HKDF Scope DEKs → per-variable Entry Keys. Secrets are never encrypted directly under the password. Every vault mutation is Ed25519-signed.
• Anti-snooping token ingestion — Tokens are accepted only via file, environment variable, or stdin. No CLI flag that ends up in ps aux.
• Faster sessions — The OS keyring now caches derived cryptographic material instead of the raw password. Subsequent commands drop from ~500 ms to ~2 ms.
• Cleaner storage — MessagePack with deterministic ordering and raw binary payloads. Atomic writes via the standard filesystem.

---

New Commands

Command	What it does
envseal token	Mint a zero-trust bearer token with optional name, description, expiration, and key-level scoping.
envseal rotate	Rotate the DEK for a group or tag and revoke all tokens that depended on the old key.

Existing commands (run, get, export, load, etc.) now accept --token-file so the same workflows work with tokens.

---

Security Notes You Should Actually Read

Token expiration (--exp) is a convenience, not a security boundary. Clocks drift. Tokens get copied. “It expires in an hour” is not a revocation strategy.

If a token is compromised (or even just suspected):

1. Rotate the DEK for the affected scope (envseal rotate --tag prod).
2. Rotate the actual credentials that token could reach (database passwords, API keys, etc.).

Do both. Always.

---

Platform Support

• Linux (x86_64 / ARM64)
• macOS (Apple Silicon only — Intel Macs are no longer supported)
• Windows

---

Installation

curl -sSfL https://raw.githubusercontent.com/viswajith275/EnvSeal-CLI/master/scripts/install.sh | bash

EnvSeal v4.0.0

Full Changelog: v2.0.1...v4.0.0

EnvSeal v2.0.1

Full Changelog: v1.2.0...v2.0.1

EnvSeal v2.0.0

feat: Refactor README formatting and content

Updated formatting and removed upcoming features section from README.

envseal v1.2.0

Added groups, run command, easier exporting and importing of existing .envs

EnvSeal v1.1.0

Full Changelog: v1.0.1...v1.1.0

envfuse v1.0.1

feat: Added list command to see all saved keys