jdx/fnox v1.44.0

v1.44.0: Store whole files by path and edit a single secret

on GitHub

fnox 1.44.0 adds secret files: whole files such as ~/.kube/config stored in the global config under the path they belong at, and written there with fnox files write. fnox edit can now edit one secret, accepts editor commands that include arguments, and saves the change to the config file that defines the secret.

Added

• Secret files (#1056) by @jdx and @owpac. Some secrets need to exist as files at a fixed path, such as ~/.kube/config, ~/.aws/credentials or ~/.npmrc. You can now declare them in a [files] table, using the path as the key. Files use the same providers, profiles and fnox reencrypt as secrets, but fnox never turns them into environment variables.

  # ~/.config/fnox/config.toml
  [files]
  "~/.kube/config" = { provider = "age", value = "YWdl..." }
  
  [profiles.work.files]
  "~/.aws/credentials" = { provider = "age", source = "files/aws-credentials.age" }

  fnox set --file ~/.kube/config      # store the file at that path
  fnox get --file ~/.kube/config      # print it, byte for byte
  fnox edit --file ~/.kube/config     # edit it in $EDITOR
  fnox remove --file ~/.kube/config   # remove the entry
  fnox files                          # list entries without decrypting them
  fnox files write                    # write every file of the active profiles

  • [files] is only allowed in the global config. If a project fnox.toml declares it, fnox reports an error, so a cloned repository can't make fnox overwrite paths such as ~/.ssh/authorized_keys.
  • A key must be an absolute path or start with ~/. Content is kept byte for byte, including the final newline, and must be UTF-8 text.
  • You can keep the encrypted content in a separate file with source instead of value. The path is relative to the config directory and can't point outside it. The plain provider can't be used for files.
  • fnox files write resolves every file before it writes any of them. It writes each file with mode 0600 and replaces a symlink at the path instead of writing through it. Files whose content already matches are left unchanged. --dry-run lists what would be written, and path arguments limit the write to those files.
  • Files are written only when you run fnox files write. fnox exec and shell integration don't write them.
• Edit a single secret (#1045) by @jdx. fnox edit KEY opens only that secret's resolved value in your editor, as raw text in a private temporary file. No other secrets are decrypted. When you save, fnox stores the new value with the secret's provider and keeps env, description and its other settings. If the only change is a final newline added by the editor, fnox ignores it. Secrets from read-only providers can't be edited this way. Running fnox edit with no key works the same as before.

  fnox -P work edit KUBECONFIG

Fixed

• Editor commands with arguments (#1045) by @jdx. Setting EDITOR="code --wait" or EDITOR="vim -n" used to fail with Failed to launch editor. fnox now splits the value using shell quoting rules. If EDITOR is empty, fnox uses VISUAL, then vi (notepad on Windows). fnox now also reports an error when the editor exits with a nonzero status.
• fnox edit KEY saving to the wrong file (#1048) by @jdx. Editing a secret defined in the global config or a parent project used to create a new ./fnox.toml in the current directory. The original definition kept the old value. The new value is now written to the file that defines the secret, encrypted with that file's providers. If a fnox sync --local-file cache holds the secret, fnox updates the shared definition and removes the outdated cache entry.
• fnox set on synced and inherited secrets (#1045) by @jdx. Setting a new value now clears the secret's fnox sync cache, so an outdated cached value no longer takes precedence. Setting a value for a secret inherited from another profile or config layer now keeps its as_file, env, description and other settings.

Full Changelog: v1.43.0...v1.44.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.