jdx/fnox v1.41.0

v1.41.0: gopass provider and profile-aware config templates

on GitHub

fnox 1.41.0 adds a gopass provider and lets secret defaults and provider fields use the active profile through Tera templates. fnox exec no longer decrypts env = false secrets that nothing uses, and the AWS SSO login prompt now logs in to the profile your provider is configured with.

Added

• gopass provider (#980) by @jdx. Teams that already keep secrets in gopass can now read them through fnox. fnox reads values with gopass cat, writes them with gopass insert -f (fnox set --provider gopass), and tests the connection with gopass ls --flat. The optional mount setting is added to the front of every secret path. fnox removes one trailing newline from each value and leaves other whitespace alone. Errors tell you whether gopass is missing, the GPG key is locked or unavailable, or the secret path doesn't exist. You can also add the provider with fnox provider add <name> gopass.

  [providers]
  gopass = { type = "gopass", mount = "company" }  # mount is optional
  
  [secrets]
  # read with: gopass cat company/apps/myapp/database_url
  DATABASE_URL = { provider = "gopass", value = "apps/myapp/database_url" }

• Profile-aware templates in config (#993) by @jdx. A secret default and literal string provider fields are now rendered as Tera templates if they contain {{, {% or {#. Two variables are available: fnox.profile (the selected profile with the highest priority, or default if none is selected) and fnox.profiles (all selected profiles, lowest priority first). This means you can write values that follow the profile, such as AWS profiles or SST stages, once instead of repeating them for every profile. FNOX_PROFILE is still not exported to child processes.

  [providers.aws]
  type = "aws-ps"
  region = "eu-central-1"
  profile = "{{ fnox.profile }}"
  
  [secrets]
  SST_STAGE = { default = "{{ fnox.profile }}" }

  • Templates are rendered before ${NAME} interpolation. A default is only rendered when it's actually used, and only the ${NAME} references left after rendering must exist. So a branch of an {% if %} that isn't taken requires nothing.
  • An undefined variable or a syntax error fails with a message that names the field. To keep a marker as literal text, wrap it in {% raw %}...{% endraw %}.
  • These fields are not templated: value, description, list fields such as age recipients, and credential_command, which keeps its own template context.
  • Check existing configs: a default or provider field that already contains {{, {% or {# as plain text will now be treated as a template. Wrap it in {% raw %} to keep the old value.
• More detailed --help (#990) by @jdx. Every public command now shows a description, examples and links to the relevant guides when you run fnox <command> --help. This is the same content as the CLI reference at fnox.jdx.dev/cli. Flags and behavior are unchanged.

Fixed

• fnox exec no longer resolves unused env = false secrets (#984) by @andersonkrs. Previously, fnox exec resolved every secret in the profile and then removed the env = false ones from the child's environment. With a PIN-protected age identity, each extra decrypt asked for the PIN again. fnox exec now selects secrets the same way as fnox env --json. It resolves only the secrets it injects plus what they depend on: ${NAME} references in defaults, provider secret references such as token = { secret = ... }, and the inputs of selected leases. If a command lease is selected, it still resolves the whole profile. The aws-sts lease's list of inputs now also includes the environment variables for web identity, container credentials and EC2 instance metadata, so those can still be supplied as env = false secrets. The child's environment is the same as before.
• AWS SSO login prompt uses the provider's profile (#991) by @balintant. When authentication fails for an aws-ps, aws-sm or aws-kms provider that sets profile, the default prompt now runs aws sso login --profile <name> instead of a bare aws sso login. Before, the bare command logged in to the default profile and failed if your AWS config had none. The profile is only added when it's a literal value and no auth_command is set. On Windows, it's only added when the name uses ASCII letters, digits, -, _ and ..

Documentation

• The guides, landing page, README, provider pages, lease pages and configuration and environment variable references were reorganized and rewritten (#987, #988, #990) by @jdx. This fixes some wrong statements, for example: an earlier import takes precedence over a later one, and imports are not recursive. The sync docs now cover TPM PIN protection and hardware-backed service tokens (#986) by @andersonkrs.

New Contributors

• @balintant made their first contribution in #991

Full Changelog: v1.40.0...v1.41.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.