jdx/fnox v1.42.0

v1.42.0: Export selected secrets by name, managed identity for azure-token leases

on GitHub

In fnox 1.42.0, fnox export can export only the secrets you name, and the azure-token lease can authenticate with an Azure managed identity. This release also fixes the AWS SSO login prompt for templated profiles, stops fnox sync --local-file from deleting personal secrets, and updates the bundled TLS root certificates after the eMudhra CA compromise.

Added

• Export only named secrets (#1002) by @jdx. fnox export now takes optional KEY arguments. When you pass keys, fnox resolves and exports only those secrets, so it doesn't need to authenticate to providers for the rest of the profile. It still resolves the secrets they depend on for interpolation, but doesn't export them. A named key is exported whatever its env setting, so you don't need --all. An unknown key fails with the same "did you mean" suggestions as fnox get. Format, --output, --dry-run and as_file work the same as before, and running fnox export without keys behaves as it did.

  fnox export API_KEY
  fnox export --format json DATABASE_URL API_KEY

• Managed identity for the azure-token lease (#1003) by @jdx. The lease now accepts the same auth and managed_identity_client_id settings as azure-sm, azure-kms and azure-ac. CI jobs on Azure-hosted runners no longer need to install the Azure CLI and run az login --identity just for the lease. You have to turn managed identity on with auth = "managed-identity"; fnox never tries it on its own. Without it, fnox still uses service principal environment variables and then az/azd. In managed identity mode, fnox doesn't check for az on PATH. Setting managed_identity_client_id without auth = "managed-identity", or using an unknown auth value, is a config error.

  [leases.azure-openai-access-token]
  type = "azure-token"
  scope = "https://ai.azure.com/.default"
  env_var = "AI_ACCESS_TOKEN"
  auth = "managed-identity"
  managed_identity_client_id = "00000000-0000-0000-0000-000000000000"  # omit for system-assigned

Fixed

• AWS SSO login prompt with templated or secret-based profiles (#998) by @balintant. When profile was a template such as "{{ fnox.profile }}", the aws-kms, aws-ps and aws-sm providers offered to run aws sso login --profile '{{ fnox.profile }}', and that command failed. The prompt now uses the provider's resolved profile, for example aws sso login --profile production. A profile set with profile = { secret = "..." } also gets its resolved name now; before, fnox ran a bare aws sso login. An auth_command you configure still takes precedence.
• fnox sync --local-file deleting personal secrets (#1004) by @jdx. When you ran the sync a second time, fnox mistook secrets defined only in fnox.local.toml for cached copies of shared secrets and deleted their source references. Synced entries for these secrets now record local_source = true in their sync block. fnox keeps and refreshes those entries on every sync. Cached copies of shared fnox.toml secrets are still removed when the shared secret is deleted. Existing files work without changes. If this bug already removed one of your secrets, add it back to fnox.local.toml once and it will be kept from then on.
• Revoked eMudhra intermediate certificates (#1005) by @jdx. The private keys of eight eMudhra intermediate CA certificates were compromised. fnox now uses rustls-webpki 0.103.16 and webpki-root-certs/webpki-roots 1.0.10, which stop trusting those certificates for HTTPS connections.

Full Changelog: v1.41.0...v1.42.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.