feat: integrate credential generators and X.509 identities

.github/workflows/haskell-build.yml

@@ -124,6 +124,9 @@ jobs:
         uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
       - name: Install NASM (aws-lc-sys assembly)
         uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2
+      # Build the MSVC CLI before entering the MSYS2 build environment.
+      - name: Build CLI for the test-suite
+        run: cargo build -p secretspec
       # MINGW64 (msvcrt-based) matches the CRT the x86_64-pc-windows-gnu Rust
       # target links, so every object in the archive agrees on one C runtime.
       - name: Install MSYS2 MinGW toolchain (compiles the staticlib's C deps)
@@ -146,9 +149,8 @@ jobs:
           # members that objcopy below refuses to process.
           cargo rustc -p libsecretspec --release --target x86_64-pc-windows-gnu \
             --crate-type staticlib
-          # The CLI (for the test-suite's end-to-end codegen test) builds for
-          # the default MSVC host target, same as the released binaries.
-          cargo build -p secretspec
+          # The CLI for the test-suite's end-to-end codegen test was built for
+          # the default MSVC host before entering MSYS2.
           export SECRETSPEC_BIN="$(cygpath -w "$PWD/target/debug/secretspec.exe")"
           native_libs="$(cargo rustc -q -p libsecretspec --release \
             --target x86_64-pc-windows-gnu --crate-type staticlib -- \

CHANGELOG.md

@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Generate passphrases, BIP-39 mnemonics, WireGuard private keys, signing JWKs,
+  age identities, and self-signed P-256 X.509 identities. Derive keys,
+  certificates, chains, and password-protected PKCS#12 archives from a declared
+  identity with `from`, `format`, and `credentials`, or select JSON/INI fields
+  from another declared secret with `from` and `extract`. Dependencies resolve
+  in order and scopes include hidden inputs without exposing their values.
+
 - Provider reads now retry recognized transient failures with bounded exponential
   backoff, including CLI providers such as BWS. Set `[defaults.retry].max_attempts`
   in user configuration or use `Secrets::with_retry_policy` in Rust to control
@@ -20,6 +27,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Imported X.509 identities accept self-issued certificates signed by a distinct
+  issuer with the same name and preserve supplementary Unicode in certificate
+  subjects for both leaf and issuer certificates when exporting PKCS#12,
+  including in builds using published dependencies.
+  Scoped explanations redact hidden derivation
+  source names.
+
+- X.509 identity generation, validation, and PKCS#12 conversion no longer
+  build or require OpenSSL. PKCS#12 passwords currently support the Unicode Basic
+  Multilingual Plane; unsupported characters produce a clear credential error.
+
+- Stored X.509 identities and their derived secrets retain credential expiry
+  and refresh deadlines so SDK consumers refresh them when their inputs change.
+
 - Secret declarations now warn about ignored unknown fields, with a suggestion
   to use `composed` when `compose` is misspelled and a note that the field may
   be supported in a newer version. Unknown fields remain accepted for