2026-10-11 - 2026-11-11
Overview
4 Releases published by 1 user
Published
v1.0.0-rc4
Published
v1.0.0-rc3
Published
v1.0.0-rc2
Published
v1.0.0-rc1
32 Pull requests merged by 1 user
Merged
#196 Point the commandWait comment at the Dockerfile's test limit (closes #195)
Merged
#193 Keep Go's build cache in check builds: re-vendor sneak/prompts e3f79c4 (closes #129)
Merged
#194 Set the time zone in main and run Entry in its own test process (closes #192)
Merged
#191 Log the audit fixes in TODO.md
Merged
#190 A secret mv between vaults unlocks both vaults before taking the lock
Merged
#188 Ask for the mnemonic and passphrase before taking the state directory lock
Merged
#185 A cross-vault secret mv that cannot remove the source fails (closes #159)
Merged
#162 Hold the encrypt and decrypt result in memory until it is written (closes #143)
Merged
#182 Commands fail when currentvault names no vault (closes #156)
Merged
#187 Print every time in UTC, whatever the time zone
Merged
#186 Unknown subcommands of vault, unlocker, version and generate fail
Merged
#175 Ask for the new passphrase in unlocker add when the variable is set (closes #154)
Merged
#172 Stop vault creation when a vault's metadata cannot be read
Merged
#184 README says secret add drops one trailing newline and import keeps it
Merged
#179 Include gpg's stderr in the error when gpg fails
Merged
#181 secret version list no longer shows a version without NOT_AFTER as expired (closes #150)
Merged
#178 Print an empty unlocker or vault list as [] in JSON
Merged
#170 A secret too large for the locked-memory limit fails with an error, not a panic
Merged
#176 Count every file of each version in secret info's Total Size
Merged
#174 Remove secret vault import
Merged
#180 version promote --help says the current file is rewritten (closes #153)
Merged
#177 Refuse an existing vault before asking for the mnemonic
Merged
#166 secret get fails when it cannot write the value
Merged
#168 secret list gives each secret's own creation and last-update times (closes #142)
Merged
#167 Use gpg.conf's default-key when unlocker add pgp has no --keyid
Merged
#171 A wrong passphrase gives an error that says so
Merged
#165 Ask for the passphrase on the controlling terminal, not stdin
Merged
#164 Print the mnemonic and the vault and unlocker listings to stdout
Merged
#163 Make another unlocker current when the current one is removed
Merged
#161 A failed secret add --force leaves the secret unchanged
Merged
#160 Derive the vault key from the mnemonic's words however they are spaced (closes #135)
Merged
#134 Remove the keychain and Secure Enclave unlockers (closes #132)
1 Pull request proposed by 1 user
Proposed
#199 Keep only open work in TODO.md (closes #198)
33 Issues closed from 1 user
Closed
#195 The commandWait comment names a 30-second test limit that no longer exists
Closed
#192 make test sometimes fails with a data race on time.Local in cli.Entry
Closed
#173 Log the audit fixes in TODO.md in one change
Closed
#189 A secret mv between vaults asks for the passphrase while holding the state directory lock
Closed
#152 Commands that prompt for a mnemonic or passphrase hold the state directory lock while waiting, so other changing commands wait silently
Closed
#159 A cross-vault secret mv whose source could not be removed reports "Moved" and exits 0, leaving the secret in both vaults
Closed
#143 secret decrypt and secret encrypt truncate the --output file before they can fail, and --input equal to --output destroys the input
Closed
#156 A currentvault file naming a vault that does not exist makes secret list report an empty vault with exit 0
Closed
#169 Listed times are in the local time zone, not UTC as AGENTS.md requires
Closed
#183 An unknown subcommand of vault, unlocker, version or generate prints help and exits 0
Closed
#154 With SB_UNLOCK_PASSPHRASE set, secret unlocker add passphrase gives the new unlocker the old passphrase without asking
Closed
#140 A vault with corrupt or unreadable metadata is skipped when choosing the next derivation index, so the next vault gets its key
Closed
#158 README does not say that secret add drops one trailing newline from the value while secret import keeps it
Closed
#146 A gpg failure is reported as only its exit status; gpg's reason on stderr is dropped
Closed
#150 secret version list shows STATUS expired for every version that is not current, including ones with no NOT_AFTER
Closed
#148 secret unlocker list --json prints "unlockers": null when the vault has no unlockers
Closed
#145 A secret larger than about half the locked-memory limit crashes secret add, import and generate secret with a panic
Closed
#147 secret info counts only metadata.age, so Total Size leaves out every secret value
Closed
#139 secret vault import cannot succeed on any vault the tool creates, and the mnemonic help points at secret import
Closed
#153 secret version promote --help says it updates the current symlink; current is a plain file
Closed
#151 secret init and secret vault create ask for the mnemonic and passphrase before refusing a vault that already exists
Closed
#155 secret get ignores a failed write of the value to stdout and exits 0
Closed
#142 secret list reports the time of the listing as every secret's creation and last-update time
Closed
#141 secret unlocker add pgp without --keyid fails when gpg.conf sets a default-key, because gpgconf prefixes the value with a quote
Closed
#157 A wrong passphrase is reported as "no identity matched any of the recipients" with advice to make a new unlocker from the mnemonic
Closed
#144 The passphrase prompt reads stdin, so secret add --force with a piped value and secret encrypt/decrypt from stdin cannot ask for the passphrase
Closed
#138 secret generate mnemonic, secret vault list and secret unlocker list print their output to stderr, so it cannot be piped or captured
Closed
#137 Removing the current unlocker leaves the vault unable to open through its remaining unlocker
Closed
#136 A secret add --force that fails to unlock the vault still leaves a new version behind
Closed
#135 A mnemonic typed with extra whitespace derives a different long-term key, so the vault cannot be recovered with the same words
Closed
#132 Take the keychain and Secure Enclave unlockers out of the build and the release
Closed
#149 A secret add --force that fails to unlock the vault still stores the new value as a stray version
Closed
#133 Keep the macOS research code out of the build and the release
36 Issues created by 1 user
Opened
#131 Finish 1.0 and tag it; after that, bugfixes only
Opened
#132 Take the keychain and Secure Enclave unlockers out of the build and the release
Opened
#133 Keep the macOS research code out of the build and the release
Opened
#135 A mnemonic typed with extra whitespace derives a different long-term key, so the vault cannot be recovered with the same words
Opened
#136 A secret add --force that fails to unlock the vault still leaves a new version behind
Opened
#137 Removing the current unlocker leaves the vault unable to open through its remaining unlocker
Opened
#138 secret generate mnemonic, secret vault list and secret unlocker list print their output to stderr, so it cannot be piped or captured
Opened
#139 secret vault import cannot succeed on any vault the tool creates, and the mnemonic help points at secret import
Opened
#140 A vault with corrupt or unreadable metadata is skipped when choosing the next derivation index, so the next vault gets its key
Opened
#141 secret unlocker add pgp without --keyid fails when gpg.conf sets a default-key, because gpgconf prefixes the value with a quote
Opened
#142 secret list reports the time of the listing as every secret's creation and last-update time
Opened
#143 secret decrypt and secret encrypt truncate the --output file before they can fail, and --input equal to --output destroys the input
Opened
#144 The passphrase prompt reads stdin, so secret add --force with a piped value and secret encrypt/decrypt from stdin cannot ask for the passphrase
Opened
#145 A secret larger than about half the locked-memory limit crashes secret add, import and generate secret with a panic
Opened
#146 A gpg failure is reported as only its exit status; gpg's reason on stderr is dropped
Opened
#147 secret info counts only metadata.age, so Total Size leaves out every secret value
Opened
#148 secret unlocker list --json prints "unlockers": null when the vault has no unlockers
Opened
#149 A secret add --force that fails to unlock the vault still stores the new value as a stray version
Opened
#150 secret version list shows STATUS expired for every version that is not current, including ones with no NOT_AFTER
Opened
#151 secret init and secret vault create ask for the mnemonic and passphrase before refusing a vault that already exists
Opened
#152 Commands that prompt for a mnemonic or passphrase hold the state directory lock while waiting, so other changing commands wait silently
Opened
#153 secret version promote --help says it updates the current symlink; current is a plain file
Opened
#154 With SB_UNLOCK_PASSPHRASE set, secret unlocker add passphrase gives the new unlocker the old passphrase without asking
Opened
#155 secret get ignores a failed write of the value to stdout and exits 0
Opened
#156 A currentvault file naming a vault that does not exist makes secret list report an empty vault with exit 0
Opened
#157 A wrong passphrase is reported as "no identity matched any of the recipients" with advice to make a new unlocker from the mnemonic
Opened
#158 README does not say that secret add drops one trailing newline from the value while secret import keeps it
Opened
#159 A cross-vault secret mv whose source could not be removed reports "Moved" and exits 0, leaving the secret in both vaults
Opened
#169 Listed times are in the local time zone, not UTC as AGENTS.md requires
Opened
#173 Log the audit fixes in TODO.md in one change
Opened
#183 An unknown subcommand of vault, unlocker, version or generate prints help and exits 0
Opened
#189 A secret mv between vaults asks for the passphrase while holding the state directory lock
Opened
#192 make test sometimes fails with a data race on time.Local in cli.Entry
Opened
#195 The commandWait comment names a 30-second test limit that no longer exists
Opened
#197 Rewrite README.md and the other prose documents sentence by sentence, on Fable
Opened
#198 TODO: remove work logs; keep only open work
2 Unresolved Conversations
Open
#129
make test takes over 20 seconds: every run compiles everything with -race
Open
#59
next → main: a plain docker build passes and stamps the version