egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

docs: update README for v0.2.1.0

Browse source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Brian Majewski 2026-06-05 10:29:07 -07:00
parent 8d9e9a3bfc
commit ba4c53a160
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -404,13 +404,15 @@ If you suspect your key has been compromised, or a teammate leaves the team:
secrets rekey secrets rekey
``` ```
This generates a new key and re-encrypts all secrets. After rekeying: This generates a new key and re-encrypts all secrets (including `.env` and other dotfiles). After rekeying:
1. Copy the new `~/.secrets/key.txt` to every machine and teammate 1. Copy the new `~/.secrets/key.txt` to every machine and teammate
2. Old encrypted files remain in git history (encrypted with the old key, which should be discarded) 2. Old encrypted files remain in git history (encrypted with the old key, which should be discarded)
For complete rotation with no historical exposure, create a fresh `~/.secrets/` repo. For complete rotation with no historical exposure, create a fresh `~/.secrets/` repo.
> **Recovering from a broken rekey (pre-0.2.1.0):** Older versions of `rekey` skipped dotfiles (`.env`, `.dev.vars`) when re-encrypting, leaving their blobs on the *old* key while `key.txt` was replaced. If `secrets pull` now fails with `no identity matched any of the recipients`, those blobs are still encrypted to a key you no longer have. Restore the **old** `key.txt` from another machine that hasn't rekeyed, `secrets pull` to recover the plaintext, then `secrets rekey` again on 0.2.1.0 or later.
## Environment variables ## Environment variables
| Variable | Default | Purpose | | Variable | Default | Purpose |
@ -423,6 +425,8 @@ For complete rotation with no historical exposure, create a fresh `~/.secrets/`
**"Not initialized"** — Run `secrets init` to create the `~/.secrets/` directory. **"Not initialized"** — Run `secrets init` to create the `~/.secrets/` directory.
**"Found an existing key ... but no repo"** — You copied `key.txt` into `~/.secrets` and then ran `secrets init`. On a second machine you should *clone* your existing secrets repo, not re-initialize it (`init` is only for the very first machine). The error prints the exact `git clone` command to run — copy-paste it, or see [Additional machines](#additional-machines). When your project's `.secrets-store` file declares a remote URL, the command is filled in with the real URL.
**"No secret files found"** — You're in a directory that doesn't have `.env`, `.env.*`, or `.dev.vars` files. Make sure you're in the right project directory. **"No secret files found"** — You're in a directory that doesn't have `.env`, `.env.*`, or `.dev.vars` files. Make sure you're in the right project directory.
**"Project not found"** — The project name doesn't match anything in `~/.secrets/`. Run `secrets list` to see what's stored. The name is usually derived from your directory name or git remote. **"Project not found"** — The project name doesn't match anything in `~/.secrets/`. Run `secrets list` to see what's stored. The name is usually derived from your directory name or git remote.
@ -432,7 +436,7 @@ For complete rotation with no historical exposure, create a fresh `~/.secrets/`
## Development ## Development
```bash ```bash
# Run the test suite (113 tests) # Run the test suite (126 tests)
brew install bats-core brew install bats-core
bats test/secrets.bats bats test/secrets.bats
``` ```