cachix/secretspec v0.17.1

0.17.1 - 2026-08-01

on GitHub

Release Notes

Fixed

• Vault and OpenBao AppRole and JWT authentication methods now reuse login
  tokens within each provider operation up to each token's reported use and
  lease limits, including time spent completing authentication, avoiding
  repeated logins without exhausting or outliving tokens during batches,
  writes, or deletes. Invalid batch addresses are rejected before login, and
  concurrent requests remain safe across Tokio runtime flavors while keeping
  pooled HTTP connections alive for the full operation.
• Cached provider routes now recognize Vault and OpenBao configurations that
  address the same endpoint, namespace, and mount as one store, even when they
  use different provider names or authentication methods, so a cache cannot
  target its own authoritative source.
• Provider and SDK errors now retain underlying causes such as authentication,
  timeout, DNS, TLS, connection, and response-parsing failures. AWS Secrets
  Manager errors also report AWS error codes and messages instead of only
  unhandled error.
• Prebuilt Linux Go SDK and secretspec-ffi libraries now include libdbus
  instead of requiring the build host's libdbus-1.so.3, so they load on
  NixOS and other systems without a matching system library.
  (#214)
• The dotenv provider's "cannot store" error now tells you to rename the secret
  in secretspec.toml when the name came from a manifest declaration, instead
  of always pointing at a ref item the config may not contain.
• Typed loaders generated by secretspec-derive now keep temporary files for
  as_path secrets alive until the returned resolved secrets are dropped.

Install secretspec 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.17.1/secretspec-installer.sh | sh

Download secretspec 0.17.1