|
| 1 | +# Created with komac v2.16.0 |
| 2 | +# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json |
| 3 | + |
| 4 | +PackageIdentifier: viswajith275.envseal |
| 5 | +PackageVersion: 5.0.0 |
| 6 | +PackageLocale: en-US |
| 7 | +Publisher: Viswajith M P |
| 8 | +PublisherUrl: https://github.com/viswajith275 |
| 9 | +PublisherSupportUrl: https://github.com/viswajith275/EnvSeal-CLI/issues |
| 10 | +Author: Viswajith M P |
| 11 | +PackageName: envseal |
| 12 | +PackageUrl: https://github.com/viswajith275/EnvSeal-CLI |
| 13 | +License: MIT |
| 14 | +LicenseUrl: https://github.com/viswajith275/EnvSeal-CLI/blob/HEAD/LICENSE |
| 15 | +ShortDescription: Zero-trust secrets engine that replaces dangerous .env files. AES-256 encrypted vaults, least-privilege tokens for CI/CD, and instant DEK rotation, without ever putting your master password on a runner. |
| 16 | +Description: An encrypted vault for your API keys and secrets, because .env files have never once kept a secret. |
| 17 | +Moniker: envseal |
| 18 | +Tags: |
| 19 | +- command-line-tool |
| 20 | +- developer-tools |
| 21 | +- encryption-decryption |
| 22 | +- enviornment-setup |
| 23 | +- envseal |
| 24 | +- hmac-sha256 |
| 25 | +- rust |
| 26 | +ReleaseNotes: |- |
| 27 | + EnvSeal v5.0.0 |
| 28 | + Zero-trust secrets for local development and production CI/CD. |
| 29 | + EnvSeal just grew up. What started as “a better way to stop committing .env files” is now a full cryptographic secrets engine with least-privilege tokens, instant revocation, and a design that assumes your CI runner is already compromised. |
| 30 | + No more sharing the master password with the pipeline. No more hoping expiration will save you. No more plaintext secrets sitting in process lists. |
| 31 | + Highlights |
| 32 | + - Zero-trust bearer tokens — Mint short-lived, least-privilege tokens that can decrypt specific secrets (or an entire tag) without ever seeing the master password, KEK, or signing key. |
| 33 | + - DEK rotation — One command (envseal rotate) regenerates the Data Encryption Key for a scope and instantly invalidates every existing token for that scope. |
| 34 | + - Cryptographic hierarchy — Master password → Argon2id → KEK → Master DEK → HKDF Scope DEKs → per-variable Entry Keys. Secrets are never encrypted directly under the password. Every vault mutation is Ed25519-signed. |
| 35 | + - Anti-snooping token ingestion — Tokens are accepted only via file, environment variable, or stdin. No CLI flag that ends up in ps aux. |
| 36 | + - Faster sessions — The OS keyring now caches derived cryptographic material instead of the raw password. Subsequent commands drop from ~500 ms to ~2 ms. |
| 37 | + - Cleaner storage — MessagePack with deterministic ordering and raw binary payloads. Atomic writes via the standard filesystem. |
| 38 | + New Commands |
| 39 | + ──────────────┬────────────────────────────────────────────────────────────────────────────────────────────────── |
| 40 | + Command │What it does |
| 41 | + ──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────── |
| 42 | + envseal token │Mint a zero-trust bearer token with optional name, description, expiration, and key-level scoping. |
| 43 | + ──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────── |
| 44 | + envseal rotate│Rotate the DEK for a group or tag and revoke all tokens that depended on the old key. |
| 45 | + ──────────────┴────────────────────────────────────────────────────────────────────────────────────────────────── |
| 46 | + Existing commands (run, get, export, load, etc.) now accept --token-file so the same workflows work with tokens. |
| 47 | + Security Notes You Should Actually Read |
| 48 | + Token expiration (--exp) is a convenience, not a security boundary. Clocks drift. Tokens get copied. “It expires in an hour” is not a revocation strategy. |
| 49 | + If a token is compromised (or even just suspected): |
| 50 | + 1. Rotate the DEK for the affected scope (envseal rotate --tag prod). |
| 51 | + 2. Rotate the actual credentials that token could reach (database passwords, API keys, etc.). |
| 52 | + Do both. Always. |
| 53 | + Platform Support |
| 54 | + - Linux (x86_64 / ARM64) |
| 55 | + - macOS (Apple Silicon only — Intel Macs are no longer supported) |
| 56 | + - Windows |
| 57 | + Installation |
| 58 | + curl -sSfL https://raw.githubusercontent.com/viswajith275/EnvSeal-CLI/master/scripts/install.sh | bash |
| 59 | +ReleaseNotesUrl: https://github.com/viswajith275/EnvSeal-CLI/releases/tag/v5.0.0 |
| 60 | +ManifestType: defaultLocale |
| 61 | +ManifestVersion: 1.12.0 |
0 commit comments