Repository navigation
feat: integrate credential generators and X.509 identities - #483
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
secretspec | bb01b97 | Commit Preview URL Branch Preview URL |
Oct 13 2026, 05:25 PM |
domenkozar
marked this pull request as ready for review
October 8, 2026 14:18
8 tasks
ifiokjr
added a commit
to ifiokjr/monosecret
that referenced
this pull request
Oct 24, 2026
… fixes (#100) * chore: sync upstream SecretSpec 0.21.1 post-release work (b3a2919..50ff51e) Port the upstream post-0.21.1 changes into the fork: - retry transient provider failures (cachix#478) with RetryPolicy plumbing - credential generators and X.509 identities (cachix#483) - preserve encoded X.509 identities on text writes (cachix#493) - profile selection for import (cachix#494) - redact ResolvedSecret values in Debug output (cachix#470) - bound v1 JSON integers for portable clients (cachix#467) - accept additive v1 response fields (cachix#466) - add schema directive to generated manifest (cachix#465) - warn about ignored unknown fields in secret declarations (cachix#485) - make block_on safe inside current-thread runtimes (cachix#468) - accept additive v1 initialize result members in resolver-c (cachix#471) - install fake provider CLIs without holding a write descriptor (cachix#479) sync-report.txt documents the per-path port status. Also fix the local dprint dart exec command to run dart format in stdin mode (the exec plugin contract); the dartfmt wrapper never drained stdin so every local dprint run over dart files failed with a broken pipe. CI never noticed because the lint job runs dart format directly. Two dart files local dprint could never reach are formatted as part of this. * chore: port upstream follow-up fixes and advisory bumps - fix(check): stop persisting as_path temp files (upstream cachix#469, 123cdfb): check never prints the paths, so decrypted secrets accumulated in the temp directory; they now drop with the command. Regression tests pin get/export persistence and check cleanup. - fix(kdbx): keepass 0.13.17 -> 0.13.21 for correct DeletionTime serialization (upstream cachix#498, bd45207). - feat(protonpass): read item fields through `field` refs (upstream cachix#500, 12fe45b); field refs stay read-only because pass-cli only accepts field values as command-line arguments, which would expose them in the process list. - fix(ipc): port the missed C half of additive v1 initialize results (upstream cachix#471, 16cd582): requests stay strict, results tolerate unknown members. Caught by the client-additive-initialize conformance case the sync ported. - restore the wire_integer module and MAX_JSON_INTEGER declarations the rebase dropped from monosecret_rpc's crate root. - chore(deps): rustls 0.23.46, rustls-webpki 0.103.16, webpki-root-certs 1.0.11 for RUSTSEC advisories (secret-exposing Debug impls, KEX downgrade, distrusted intermediates, emSign distrust). * build: regenerate pnpm lockfile for workspace platform deps The sync pointed @monosecret/cli's optional platform dependencies at workspace:* but left pnpm-lock.yaml at the 0.4.4 specifiers, so every CI job's frozen-lockfile install failed during setup. * fix: repair CI breaks in the upstream sync port - pulumi standalone feature: name dep:http like every other reqwest feature; the shared response buffering in provider/http.rs builds an ::http::Response, so --no-default-features --features pulumi failed. - docs: port the VersionCompatibility marker as a local component for the mdx pages and as plain markdown (badge notes and Changed-in callouts) for the md pages, which cannot use components; upstream left a stray closing tag behind the extraction section, now a proper callout. Upstream 0.22 version markers map to the fork's 0.5.0. * fix(provider): gate preferred_env for the vercel feature too vercel.rs reads its team ID through preferred_env, but the re-export was gated on cloudflare/openbao/scaleway/vault only, so a standalone --features vercel check failed to find it. The full standalone feature matrix now passes locally. * fix(ipc): clamp embedded IPC schema integers to the v1 JSON bound The port bounded response integers to the 2^53-1 range every v1 JSON peer can represent, but the checked-in IPC schemas still advertised u64::MAX maximums. The discover document embeds those schemas verbatim, so its own response failed the new integer validation and degraded to an internal error — the wire.notifications conformance case caught it because it is the first case to call rpc.discover. Clamp the schema maximums to 9007199254740991, matching upstream. * fix(ipc): restore ported files the rebase silently reverted The rebase onto main replayed only the sync diff, so rpc and C files that an earlier partial port had already carried but the sync commit itself never touched fell back to their pre-port versions: - error.rs: the wire-integer serde bounds on InteractionReference and ErrorData, and the tolerant (additive) error parsing from upstream 7a2502c — the ported integer_bounds tests failed without them - internal.h, json.c, fake_peer.c, regressions.c in the C resolver - the dead root test crate stays deleted; the shell fixtures the bw tests include_str! are kept - the canonical root schema/ copies now match the clamped crate copies, including the missing cleared maximum the schema-agreement test checks * fix(npm): keep exact platform pins instead of workspace protocols The fork's packaging check requires npm manifests to reference the platform packages by publishable exact versions: registry clients cannot resolve workspace: protocols, and monochange rewrites the pins on release through monochange.toml's versioned_files entries. The sync port had adopted upstream's workspace:* style, which the policy rejects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Credential generators from #417 merged into a feature branch after its parent PR had landed, leaving
x509_identityand the other additional types unavailable onmain. Integrate those generators with the current resolver and native SDKs, using Rust certificate and PKCS#12 libraries for X.509 operations.fromconversions, JSON/INI selections, and typed password credentials through the shared dependency graph. Support PEM/DER keys and certificates, certificate chains, and password-protected PKCS#12 archives while preserving scoped output, file ownership, and credential refresh deadlines.rcgen,x509-parser, andp12-keystore. Certificate crypto uses the existing AWS-LC backend. Import RSA, P-256, P-384, P-521, and Ed25519 keys; consume every certificate bag and reject unrelated, duplicate, or ambiguous chains. Export AES-256-CBC/PBKDF2-HMAC-SHA-256 archives with a SHA-256 MAC and 100,000 iterations.p12-keystore0.4.1, including the bag-preserving archive API and merged Unicode certificate-label fix. Certificate DER and local key IDs survive Unicode-subject rewrapping; only unrepresentable generated BMP bag labels are omitted. Passwords still support the Unicode Basic Multilingual Plane until RustCrypto/formats#2477 ships.fromversion label to 0.22.Release gate: publish the matching IPC crate first, then verify the packaged crate. The p12-keystore release prerequisite is complete: the minimum registry version is 0.4.1, with no Git override.
RELEASE.mdrecords the remaining steps and the separate supplementary-Unicode password follow-up.Validation on the Rust 1.92 toolchain (full-suite results below precede the final review fixes):
CI passed on final head
bb01b977: Rust tests on Ubuntu, macOS, and Windows; feature and package checks; documentation; the language SDK suite and Swift SDK; and Haskell builds on Linux and Windows.cargo test --workspace --exclude secretspec-php-native --offline: passed, including 1,813 core tests (four ignored), derive compile-fail snapshots, IPC conformance, integration tests, native bindings, and doctests. The PHP extension is excluded as in native CI.cargo check -p secretspec --no-default-features --offline: passed.prek run -ahooks: passed, including full-workspace Clippy with PHP headers and rustfmt.cargo package -p secretspec --allow-dirty --no-verify --locked --offline: passed again with p12-keystore 0.4.1; the packaged manifest requires registry version 0.4.1 without a Git override. Full package verification resolves the new archive API, then fails on the existingMAX_JSON_INTEGERreferences because the publishedsecretspec-ipc0.21.1 predates currentmain. Publish the matching IPC crate first and rerun verification as documented inRELEASE.md.p12-keystore0.4.0 and the supported ChaCha20 0.10.2 patch. The registry crate checksum matches the index, and its sources match the previously tested archive-API fix.main, the credential-deadline test and configuration schema/warning tests passed. The Windows fixture now escapes provider paths through TOML serialization.Fixes #481. Implements the X.509 backend transition tracked in #484; supplementary-Unicode support remains an upstream release follow-up.