jdx/fnox v1.47.0

v1.47.0: Named and passphrase-protected age identities, Azure Container Apps push target

on GitHub

The age provider can now pick one identity per machine from a shared config, read passphrase-protected identity files, and use a named table of recipients. fnox push adds an Azure Container Apps target that writes all of a target's variables in one request. This release also fixes op signin detection for 1Password and fnox sync caching for secrets that use a profile's default_provider.

Added

• Named age identities (#1099, #1100) by @jdx. One shared fnox.toml can list an identity for each machine, for example one per YubiKey. Choose one with default_identity, or set FNOX_AGE_IDENTITY to override it on a given machine. An entry can be a key file path or a { provider, value } reference, such as an age identity unlocked through the fido2 provider:

  [providers.age]
  type = "age"
  recipients = ["age1...", "age1...", "age1..."]
  default_identity = "yk1"
  
  [providers.age.identities]
  yk1 = { provider = "fido2-yk1", value = "..." }
  yk2 = { provider = "fido2-yk2", value = "..." }
  recovery = "~/.config/fnox/recovery.txt"

  • The selected identity replaces key_file, or identity for provider-backed entries. FNOX_AGE_KEY still takes precedence over everything.
  • fnox only calls the provider of the selected entry, so a machine never asks for another machine's key.
  • An unknown name is an error that lists the available names. A table that mixes secret with provider/value is rejected.
  • Configs that don't set identities, default_identity or FNOX_AGE_IDENTITY work as before.
• Passphrase-encrypted age identity files (#1097) by @jdx. key_file can now point at an identity created with age-keygen | age -p -o identity.age, in binary or armored form. When fnox decrypts a secret, it prompts for the passphrase once per file in each run. fnox set only uses the public recipients, so it never prompts. Without a terminal, fnox fails with an auth error that suggests decrypting the identity and setting FNOX_AGE_KEY. The daemon does not cache the passphrase, and no environment variable can supply it.
• Named age recipients (#1104) by @jdx. recipients can now be a table, so you can see whose key each entry is:

  [providers.age.recipients]
  desktop = "age1..."
  laptop = "age1..."
  recovery = "age1..."

  Secrets are encrypted to every key, in the order written. The names are only labels, so renaming one doesn't require fnox reencrypt. The array form still works.
• azure-container-apps push target (#1098) by @jdx. fnox push can now set environment variables on an Azure Container App through the ARM REST API. It uses the same credentials as azure-sm and azure-ac: service principal environment variables, an az/azd login, or a managed identity. Values never appear on a command line.

  [targets.api]
  type = "azure-container-apps"
  subscription = "00000000-0000-0000-0000-000000000000"
  resource_group = "rg-dev"
  app = "ca-api-dev"
  # container = "api"   # required if the app has several containers

  • Every env change creates a new revision, so fnox writes all of a target's variables in one request. If every value already matches, it writes nothing.
  • Variables that fnox doesn't push, and the app's secrets, are left alone. A pushed variable is stored as a plain value and replaces any existing variable with the same name, including one that used a secretRef.
  • When Azure provides an ETag, the write is conditional, so a concurrent change to the app causes the push to fail instead of being overwritten. fnox polls long-running updates for up to five minutes but doesn't wait for the new revision to become ready. Only the public cloud is supported.
  • fnox push now groups writes by target, so output lines are ordered by target. If a batch fails, every variable in it is reported as failed.

Fixed

• 1Password: When op reports "You are not currently signed in", fnox now treats it as an authentication failure. In a terminal, it offers to run op signin and then retries. Otherwise, it shows the op signin hint. Item, vault or field names containing words like "authorization" no longer cause unrelated failures to be reported as sign-in errors. (#1102) by @djgoku
• Sync: fnox sync now caches secrets that have a value but no provider and are read through the profile's default_provider. Before, --local-file skipped them, so they kept calling the remote provider and failed offline. The same rule now applies to --source, the "from" labels, and the cleanup of stale cache entries. (#1106) by @jdx

New Contributors

• @djgoku made their first contribution in #1102

Full Changelog: v1.46.0...v1.47.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.