cachix/secretspec v0.16.0

0.16.0 - 2026-07-17

on GitHub

Release Notes

Added

• Composed secrets derive read-only values such as connection strings from
  other declared secrets using strict {SECRET_NAME} templates. Dependencies
  are order-independent, may include other compositions, and are validated for
  unknown references and cycles before provider access; unlike dotenv
  expansion, values are substituted once without ambient environment lookup,
  fallback operators, recursive expansion, or silent empty replacements.
• C# SDK (Cachix.SecretSpec, available in 0.16): resolve secrets from .NET
  through the shared native resolver, with fluent builder and one-shot APIs,
  typed failure exceptions, value-free preflight reports, provenance,
  environment export, typed-codegen input, and deterministic cleanup of
  as_path files. The trimming-safe, NativeAOT-compatible NuGet package
  includes native resolver builds for glibc and musl Linux x64/Arm64, macOS
  x64/Arm64, and Windows x64/Arm64; Windows applications do not need a separate
  Visual C++ Redistributable.
• Infisical provider (infisical://), for Infisical Cloud and self-hosted
  instances. Authenticates as a machine identity via Universal Auth, whose
  client_id and client_secret can be sourced as provider credentials (with
  INFISICAL_CLIENT_ID/INFISICAL_CLIENT_SECRET fallbacks), or with a
  ready-made token/INFISICAL_TOKEN. A profile names the Infisical
  environment, so a production profile reads the production environment;
  projects whose environments do not correspond to profiles pin one with
  ?env=, and profiles stay separate either way. Secrets live at
  /secretspec/{project}/{profile} (?path= overrides the prefix), with keys
  stored verbatim, and secrets sharing a folder are fetched in one request. A
  folder's imported secrets resolve too, with Infisical's own precedence. A
  secret's ref can name an Infisical secret by folder, key and version.
  Self-hosted and EU instances are named by the URI host, INFISICAL_DOMAIN, or
  Infisical's legacy INFISICAL_API_URL. Provider selection and Rust API
  documentation identify Infisical as available from SecretSpec 0.16.

Install secretspec 0.16.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.16.0/secretspec-installer.sh | sh

Download secretspec 0.16.0