From ba4c53a160f72c666ab79b411fc5644be3a243bf Mon Sep 17 00:00:00 2001 From: Brian Majewski Date: Fri, 5 Jun 2026 10:29:07 -0700 Subject: [PATCH] docs: update README for v0.2.1.0 Co-Authored-By: Claude Opus 4.8 --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2e23b41..d594f57 100644 --- a/README.md +++ b/README.md @@ -404,13 +404,15 @@ If you suspect your key has been compromised, or a teammate leaves the team: secrets rekey ``` -This generates a new key and re-encrypts all secrets. After rekeying: +This generates a new key and re-encrypts all secrets (including `.env` and other dotfiles). After rekeying: 1. Copy the new `~/.secrets/key.txt` to every machine and teammate 2. Old encrypted files remain in git history (encrypted with the old key, which should be discarded) For complete rotation with no historical exposure, create a fresh `~/.secrets/` repo. +> **Recovering from a broken rekey (pre-0.2.1.0):** Older versions of `rekey` skipped dotfiles (`.env`, `.dev.vars`) when re-encrypting, leaving their blobs on the *old* key while `key.txt` was replaced. If `secrets pull` now fails with `no identity matched any of the recipients`, those blobs are still encrypted to a key you no longer have. Restore the **old** `key.txt` from another machine that hasn't rekeyed, `secrets pull` to recover the plaintext, then `secrets rekey` again on 0.2.1.0 or later. + ## Environment variables | Variable | Default | Purpose | @@ -423,6 +425,8 @@ For complete rotation with no historical exposure, create a fresh `~/.secrets/` **"Not initialized"** — Run `secrets init` to create the `~/.secrets/` directory. +**"Found an existing key ... but no repo"** — You copied `key.txt` into `~/.secrets` and then ran `secrets init`. On a second machine you should *clone* your existing secrets repo, not re-initialize it (`init` is only for the very first machine). The error prints the exact `git clone` command to run — copy-paste it, or see [Additional machines](#additional-machines). When your project's `.secrets-store` file declares a remote URL, the command is filled in with the real URL. + **"No secret files found"** — You're in a directory that doesn't have `.env`, `.env.*`, or `.dev.vars` files. Make sure you're in the right project directory. **"Project not found"** — The project name doesn't match anything in `~/.secrets/`. Run `secrets list` to see what's stored. The name is usually derived from your directory name or git remote. @@ -432,7 +436,7 @@ For complete rotation with no historical exposure, create a fresh `~/.secrets/` ## Development ```bash -# Run the test suite (113 tests) +# Run the test suite (126 tests) brew install bats-core bats test/secrets.bats ```