SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials

Announcements
1

Hi all,

We’ve released SecretSpec 0.17 with:

  • scopes: consumers can now resolve only the secrets it declares, instead of receiving an entire profile.
  • Secrets caching for slow remote providers, with configurable freshness and explicit invalidation.
  • Cross-secret validation, including “at least one” and “exactly one” credential groups.
  • JWT/OIDC authentication for Vault and OpenBao.
  • A new GitHub and Forgejo Action that resolves, masks, and exposes secrets to later workflow steps.
  • Six new providers: SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials.

All SecretSpec SDKs have been updated with scope support. This required an FFI
change, so applications should upgrade the SDK package and bundled native
resolver together.

Read the release blog post post or see the GitHub release.

Domen

Disclaimer: LLMs have been used in all the work delivered

13 Likes