Repository navigation
chore: sync upstream SecretSpec 0.21.1 post-release work and security fixes - #100
Merged
Merged
Conversation
…ff51e) Port the upstream post-0.21.1 changes into the fork: - retry transient provider failures (cachix#478) with RetryPolicy plumbing - credential generators and X.509 identities (cachix#483) - preserve encoded X.509 identities on text writes (cachix#493) - profile selection for import (cachix#494) - redact ResolvedSecret values in Debug output (cachix#470) - bound v1 JSON integers for portable clients (cachix#467) - accept additive v1 response fields (cachix#466) - add schema directive to generated manifest (cachix#465) - warn about ignored unknown fields in secret declarations (cachix#485) - make block_on safe inside current-thread runtimes (cachix#468) - accept additive v1 initialize result members in resolver-c (cachix#471) - install fake provider CLIs without holding a write descriptor (cachix#479) sync-report.txt documents the per-path port status. Also fix the local dprint dart exec command to run dart format in stdin mode (the exec plugin contract); the dartfmt wrapper never drained stdin so every local dprint run over dart files failed with a broken pipe. CI never noticed because the lint job runs dart format directly. Two dart files local dprint could never reach are formatted as part of this.
- fix(check): stop persisting as_path temp files (upstream cachix#469, 123cdfb): check never prints the paths, so decrypted secrets accumulated in the temp directory; they now drop with the command. Regression tests pin get/export persistence and check cleanup. - fix(kdbx): keepass 0.13.17 -> 0.13.21 for correct DeletionTime serialization (upstream cachix#498, bd45207). - feat(protonpass): read item fields through `field` refs (upstream cachix#500, 12fe45b); field refs stay read-only because pass-cli only accepts field values as command-line arguments, which would expose them in the process list. - fix(ipc): port the missed C half of additive v1 initialize results (upstream cachix#471, 16cd582): requests stay strict, results tolerate unknown members. Caught by the client-additive-initialize conformance case the sync ported. - restore the wire_integer module and MAX_JSON_INTEGER declarations the rebase dropped from monosecret_rpc's crate root. - chore(deps): rustls 0.23.46, rustls-webpki 0.103.16, webpki-root-certs 1.0.11 for RUSTSEC advisories (secret-exposing Debug impls, KEX downgrade, distrusted intermediates, emSign distrust).
The sync pointed @monosecret/cli's optional platform dependencies at workspace:* but left pnpm-lock.yaml at the 0.4.4 specifiers, so every CI job's frozen-lockfile install failed during setup.
- pulumi standalone feature: name dep:http like every other reqwest feature; the shared response buffering in provider/http.rs builds an ::http::Response, so --no-default-features --features pulumi failed. - docs: port the VersionCompatibility marker as a local component for the mdx pages and as plain markdown (badge notes and Changed-in callouts) for the md pages, which cannot use components; upstream left a stray closing tag behind the extraction section, now a proper callout. Upstream 0.22 version markers map to the fork's 0.5.0.
vercel.rs reads its team ID through preferred_env, but the re-export was gated on cloudflare/openbao/scaleway/vault only, so a standalone --features vercel check failed to find it. The full standalone feature matrix now passes locally.
The port bounded response integers to the 2^53-1 range every v1 JSON peer can represent, but the checked-in IPC schemas still advertised u64::MAX maximums. The discover document embeds those schemas verbatim, so its own response failed the new integer validation and degraded to an internal error — the wire.notifications conformance case caught it because it is the first case to call rpc.discover. Clamp the schema maximums to 9007199254740991, matching upstream.
The rebase onto main replayed only the sync diff, so rpc and C files that an earlier partial port had already carried but the sync commit itself never touched fell back to their pre-port versions: - error.rs: the wire-integer serde bounds on InteractionReference and ErrorData, and the tolerant (additive) error parsing from upstream 7a2502c — the ported integer_bounds tests failed without them - internal.h, json.c, fake_peer.c, regressions.c in the C resolver - the dead root test crate stays deleted; the shell fixtures the bw tests include_str! are kept - the canonical root schema/ copies now match the clamped crate copies, including the missing cleared maximum the schema-agreement test checks
The fork's packaging check requires npm manifests to reference the platform packages by publishable exact versions: registry clients cannot resolve workspace: protocols, and monochange rewrites the pins on release through monochange.toml's versioned_files entries. The sync port had adopted upstream's workspace:* style, which the policy rejects.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #100 +/- ##
==========================================
+ Coverage 35.18% 35.41% +0.23%
==========================================
Files 117 121 +4
Lines 38697 41516 +2819
Branches 49 49
==========================================
+ Hits 13614 14703 +1089
- Misses 25074 26804 +1730
Partials 9 9
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bundles the full upstream sync that was sitting uncommitted in the working tree (a port of
cachix/secretspecb3a29191..50ff51e8, documented per-path insync-report.txt), rebased onto currentmain, plus the three substantive upstream commits after that cutoff, a missed C-side wire fix the conformance suite caught, and dependency advisory bumps.Upstream sync (
b3a29191..50ff51e8)RetryPolicyplumbingResolvedSecretDebug redaction (fix(resolve): redact ResolvedSecret values in Debug output cachix/secretspec#470), IPC v1 JSON integer bounds (fix(ipc): bound v1 JSON integers for portable clients cachix/secretspec#467), additive v1 response fields (fix(ipc): accept additive v1 response fields cachix/secretspec#466), additive v1 initialize results in the C resolver (fix(resolver-c): accept additive v1 initialize result members cachix/secretspec#471)block_onfix (fix(providers): make block_on safe inside current-thread runtimes cachix/secretspec#468), ETXTBSY-safe fake CLI harness (test: install fake provider CLIs without holding a write descriptor cachix/secretspec#479)Follow-up ports after the cutoff
as_pathtemp files (upstream fix(check): stop leaking as_path temp files cachix/secretspec#469) —checkpersisted every decryptedas_pathsecret into the temp directory and never printed the paths, so nothing could use or clean them. They now drop with the command; regression tests pinget/exportpersistence andcheckcleanup.fieldrefs (upstream feat(protonpass): read any item field via ref.field cachix/secretspec#500); field refs are read-only because pass-cli only accepts field values as command-line arguments, which would expose them in the process listclient-additive-initializeconformance case failed against the C client until this landedSecurity audit and dependency advisories
A full security audit ran against this tree (exec wrappers, secret lifetime/zeroization, dotenv/file write paths, IPC daemon, HTTP layer, npm wrappers, workflows, C resolver). Findings acted on here:
wire_integermodule andMAX_JSON_INTEGERdeclarations a rebase dropped frommonosecret_rpc's crate root (the integer-bounds hardening was unbuildable without it)cargo auditadvisories fixed where releases exist: rustls 0.23.46 (secret-exposing Debug impls, KEX downgrade), rustls-webpki 0.103.16 (distrusted-intermediate acceptance), webpki-root-certs 1.0.11 (emSign distrust). The legacy rustls 0.21 chain pinned under the AWS SDK stack and the unfixedrsaMarvin advisory remain as accepted risk; thezipadvisories are stale unreachable lock entries.Not ported, deliberately: the Elixir SDK and python-wheels CI/docs commits (the fork carries no Elixir package; workflows are fork-managed).
Testing
cargo test -p monosecret -p monosecret_rpc -p monosecret-rpc-conformance— all green, including the newcheck_leaves_no_as_path_files_behind,get_keeps_the_as_path_file_it_prints, and the protonpass field-ref testsclient-additive-initializeconformance case now passes against both the C and Rust clientscargo clippyclean,dprint checkclean (this PR also fixes the local-only brokendartfmtdprint exec command that made every local commit fail the format hook)Created on behalf of Ifiok Jr. (@ifiokjr), generated with GLM-5.3 at high thinking level.