Changes

New version released.

New version released.

New version released.

The agent is now also available for Linux. On Windows it works as before.

• New
  sarebamail agent for Linux

  Packages for Debian and Ubuntu (apt), Fedora (dnf) and Arch Linux (pacman), panel icon, desktop notifications. New versions come through the sareba package repository.

• Improved
  Updates now come from updates.sareba.com

  secrets-tool update now fetches new versions from updates.sareba.com. You don't need to do anything: older versions are redirected there automatically. If your firewall only allows certain addresses, allow updates.sareba.com. The download page stays where it is.

• Improved
  secrets-tool check finds values in the clipboard

  If a deploy script reads values from secrets-tool and copies something to the clipboard anywhere, secrets-tool check now reports it – even when the two happen in different places of the script. Every program can read the clipboard, and its history keeps the values. The hint below tells you how to solve it with secrets-tool hostenv without the clipboard.

• New
  sarebamail agent for Windows

  Notifications for new mail, chat messages and calls, even without an open browser window. You pair the device once with a code and manage it in sarebamail under Settings → Devices.

• New
  Check a repository with secrets-tool check

  secrets-tool check checks your repository: is secrets.enc committed correctly, is something missing from .gitignore, is a value from secrets.enc, a private key or a token anywhere in plaintext? Every finding tells you right away what to do – never a value. With secrets-tool check --hook it runs before every commit, with --json in your CI.

• New
  Env files onto the server, without plaintext

  secrets-tool hostenv writes the env files for your Docker containers onto the server – readable by root only, without any value showing up on screen, in the history or in the process list. Your deploy one-liners then only contain --env-file and a check that the file matches the current state. The docs explain how under “Getting env files onto the host”.

• Improved
  Enter values with hidden input

  secrets-tool set NAME without a value now asks for it with hidden input. That way a password or token is neither in your command history nor in the process list.