cachix/secretspec v0.18.0

0.18.0 - 2026-08-03

on GitHub

Release Notes

Changed

• The keyring provider now uses keyring 4's Rust-native Secret Service
  transport on Linux, so source builds and binaries no longer require system
  libdbus.
• secretspec init --from now accepts every provider with declaration
  reflection, including age, AWS Parameter Store, and Bitwarden Password
  Manager, and accepts --project and --profile as explicit discovery
  context for hierarchical stores.
• Custom Rust providers now pass discovery context to the
  Provider::reflect hook so hierarchical stores can select the project and
  profile namespace.

Fixed

• The Bitwarden provider now treats a locked vault or a missing session as a
  clear authentication failure on get/set, with the same "run bw login
  and bw unlock, then set BW_SESSION" guidance in both cases, instead of
  surfacing the underlying CLI error text.
• The Bitwarden provider now reports a missing bw CLI with install
  instructions instead of an authentication error: a machine without the CLI
  is not an authentication state, and the install guidance ("…run 'bw login'
  and 'bw unlock' to authenticate") used to match the not-authenticated
  classifier and mask the real problem.
• Vault and OpenBao JWT authentication now allows the role to be omitted when
  the auth mount has a server-configured default_role, while explicit URI or
  environment roles continue to take precedence.
• Vault and OpenBao AppRole authentication now supports roles configured with
  bind_secret_id=false by omitting secret_id from the login request when no
  SecretID credential is configured.
• secretspec import --delete-source now compares resolved storage entries
  without conflating distinct cache address spaces, preventing equivalent
  provider configurations (including dotenv path aliases) from deleting the
  destination value. Sources without deletion support are also rejected before
  any destination is written.
• The AWS Secrets Manager provider now authenticates with shared credentials
  file profiles backed by an active AWS login session, which previously failed
  because the required AWS SDK feature was not enabled. BatchGetSecretValue
  failures also report the full service error instead of a shortened message.

Added

• The dotenv provider accepts a leading ~ in custom paths, such as
  dotenv:~/.config/my-project/.env, and resolves it to the user's home
  directory.
• Vault and OpenBao AppRole and JWT authentication can target non-default auth
  method mounts, including printable Unicode mount names, with the auth_mount
  provider URI option.
• secretspec add NAME --description "..." (available in 0.18) adds a secret
  declaration to the active profile while preserving the manifest's
  existing comments, formatting, and unrelated configuration.
• AWS Parameter Store convention templates and bounded GetParametersByPath
  discovery can create declarations from the direct children of an existing
  hierarchy without decrypting their values.
• Swift SDK (available in 0.18) for resolving SecretSpec manifests from macOS
  12+ on Intel and Apple silicon. The SwiftPM package provides fluent and
  one-shot resolution, typed failures, scopes, value-free reports, provenance,
  environment export, codegen input, and deterministic as_path cleanup. Its
  checksummed XCFramework includes the shared Rust resolver, so applications do
  not need a Rust toolchain or separately installed native library.
• secretspec delete removes one or more stored secret values without changing
  their manifest declarations, while --all requires explicit confirmation.
  secretspec import --delete-source verifies each destination value before
  deleting its source, and retains the source when an existing target differs.
• Bitwarden Password Manager provider (bw://, bw build feature) for reading
  and writing secrets in a personal or organization vault through the bw CLI.
  Collections and organizations are addressed by name or by id
  (bw://myorg@dev-secrets), ?type= and ?field= select an item type and
  field, and ?server= asserts which self-hosted server the configuration
  expects. Every item type is supported (login, secure note, card, identity, SSH
  key), each with a default field shared by reads and writes. Item names are
  matched in full and case-insensitively, and an ambiguous name is refused with
  the colliding ids rather than resolved to an arbitrary item.
• Dashlane provider (dashlane://) for reading secrets from a Dashlane vault
  through the dcli CLI. Convention secrets read the item titled
  secretspec/{project}/{profile}/{key}, and a ref names an existing item by
  title or identifier with an optional field. dashlane://note,
  dashlane://secret, or dashlane://password restrict the search to one
  content type. The provider is read-only, because dcli has no command that
  creates or edits a vault item; secretspec set fails with that reason.
  Non-interactive use is supported through DASHLANE_SERVICE_DEVICE_KEYS,
  which can also be injected as the service_device_keys provider credential.
  Injected credentials read through a private, owner-only dcli state
  directory of their own, because dcli otherwise prefers a device already
  registered on the machine and reads that identity's vault instead.
• Keeper Secrets Manager provider (keeper://FOLDER_UID, keeper build feature) using
  Keeper's official Rust SDK, with convention-based records, references to
  existing records and fields, provider credentials, batch reads, writes, and
  cache-compatible deletion. SDK calls are safe from async Rust applications,
  and updates preserve the JSON types of Keeper fields such as dates,
  checkboxes, hosts, and names.
• AWS Systems Manager Parameter Store provider (awsps://, awsps build
  feature) for reading and writing KMS-encrypted
  SecureString parameters. It supports AWS profiles and regions, an optional
  hierarchy prefix, customer-managed KMS keys, parameter tiers, batched reads,
  and references by parameter name, version, label, or ARN. Unversioned
  parameter-name references can be written in place; version-, label-, and
  ARN-pinned references are read-only. Writes reject unsupported reference
  coordinates before requesting a value, and versioned ARN errors point to
  writable parameter-name references. AWS service errors include their error
  codes and messages instead of only unhandled error.
  (#209)

Install secretspec 0.18.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.18.0/secretspec-installer.sh | sh

Download secretspec 0.18.0