SecretSpec 0.18: Secret lifecycle, four new providers, and Swift

0.18 release expands the secret lifecycle, adds four providers, and introduces a Swift SDK. We have a new logo! Declare, delete, and safely move secrets Declare secrets without hand-editing the manifest: $ secretspec add STRIPE_API_KEY --description "Stripe API access token" ✓ Added secret 'STRIPE_API_KEY' to profile 'default' in secretspec.toml secretspec add preserves the manifest’s comments and formatting without asking for or storing a value. secretspec delete removes stored values while keeping their declarations. Provider migrations can remove the source after proving the move succeeded: secretspec import dotenv:~/.config/payments/.env --delete-source SecretSpec verifies each destination value before deleting its source and leaves the source intact when conflicts occur. Discover declarations from existing stores secretspec init --from can now discover declarations from age files, AWS Parameter Store hierarchies, and scoped Bitwarden collections, in addition to dotenv. It writes names and generated descriptions to secretspec.toml, never values. Four new providers SecretSpec now supports 24 providers, including: Bitwarden Password Manager (bw://): read, write, and discover vault items through the bw CLI. Keeper Secrets Manager (keeper://): batched reads, writes, deletion, and existing-record references. AWS Parameter Store (awsps://): KMS-encrypted parameters, versioned references, and bounded discovery. Dashlane (dashlane://): read-only secrets, secure notes, and logins through dcli. Swift SDK and provider authentication The new Swift SDK brings the shared SecretSpec resolver to macOS 12+ on Intel and Apple silicon as a checksummed XCFramework. Vault and OpenBao also gain custom AppRole and JWT mount paths, dotenv paths accept ~, and Linux keyring builds no longer require system libdbus. Read the full announcement: SecretSpec SecretSpec 0.18: Secret lifecycle, Bitwarden, Keeper, AWS Parameter Store,... Declare, discover, migrate, and delete secrets from the CLI; use four new providers; and resolve the same manifests from Swift. GitHub release: GitHub Release 0.18.0 - 2026-08-03 · cachix/secretspec Release Notes Changed The keyring provider now uses keyring 4's Rust-native Secret Service transport on Linux, so source builds and binaries no longer require system libdbus. secretspec init --fro... Questions and feedback are welcome on Discord: Discord Join the Cachix Discord Server! Check out the Cachix community on Discord - hang out with 1328 other members and enjoy free voice and text chat. Disclaimer: LLMs have been used 1 post - 1 participant Read full topic