cofre 0.1.1

Typed secret materialization — generates and seeds secrets into SOPS / Akeyless without ever exposing plaintext to the operator. The bin half of the cofre toolchain.
cofre-0.1.1 is not a library.

cofre — typed secret materialization CLI.

Subcommands: plan — show what apply would do (no plaintext touched) apply — materialize missing secrets; --rotate forces re-gen verify — confirm every declared secret exists in its backend inventory — emit BLAKE3-attested inventory (no values, ever)

Hard rules (security-critical, audited per release):

  • Plaintext NEVER hits stdout, stderr, argv, env, or any log line.
  • Plaintext lives only in Zeroizing<String> (zeroed on drop).
  • Generation uses getrandom (OS CSPRNG).
  • SOPS writes go via EDITOR-mode hijack — value lives in our own editor child's memory and the temp file SOPS creates with 0600.
  • Akeyless writes go via akeyless-api SDK (HTTPS) — never via the akeyless CLI's --value argv flag.