# SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials

**URL:** https://discourse.nixos.org/t/secretspec-0-17-scopes-secrets-caching-sops-age-and-systemd-credentials/79184
**Category:** Announcements
**Created:** [July 27, 2026, 4:36am UTC](https://discourse.nixos.org/t/secretspec-0-17-scopes-secrets-caching-sops-age-and-systemd-credentials/79184 "2026-07-27T04:36:14Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![domenkozar](https://discourse.nixos.org/user_avatar/discourse.nixos.org/domenkozar/32/38357_2.png) [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [July 27, 2026, 4:36am UTC](https://discourse.nixos.org/t/secretspec-0-17-scopes-secrets-caching-sops-age-and-systemd-credentials/79184/1 "2026-07-27T04:36:14Z")

</div>

Hi all,

We’ve released SecretSpec 0.17 with:

- **scopes** : consumers can now resolve only the secrets it declares, instead of receiving an entire profile.
- **Secrets caching** for slow remote providers, with configurable freshness and explicit invalidation.
- **Cross-secret validation** , including “at least one” and “exactly one” credential groups.
- JWT/OIDC authentication for Vault and OpenBao.
- A new GitHub and Forgejo Action that resolves, masks, and exposes secrets to later workflow steps.
- Six new providers: **SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials**.

All SecretSpec SDKs have been updated with scope support. This required an FFI  
change, so applications should upgrade the SDK package and bundled native  
resolver together.

Read the [release blog post post](https://secretspec.dev/blog/secretspec-0-17-scopes-secrets-caching-age-and-systemd-credentials/) or see the [GitHub release](https://github.com/cachix/secretspec/releases/tag/v0.17.0).

Domen

_Disclaimer: LLMs have been used in all the work delivered_