murk-cli 0.8.0

Encrypted secrets manager for developers — one file, age encryption, git-friendly
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

[workspace]
members = [".", "node"]
exclude = ["fuzz"]

[package]
name = "murk-cli"
version = "0.8.0"
edition = "2024"
rust-version = "1.89"
description = "Encrypted secrets manager for developers — one file, age encryption, git-friendly"
license = "MIT OR Apache-2.0"
repository = "https://github.com/iicky/murk"
keywords = ["secrets", "encryption", "age", "dotenv", "security"]
categories = ["command-line-utilities", "cryptography"]
exclude = ["CLAUDE.md", "AGENTS.md", "SPEC.md", ".beads/"]

[lints.clippy]
# Secret-handling guardrail: dbg! prints the Debug of any value — including a
# decrypted secret — and must never ship. It is allow-by-default (restriction
# group), so `-D warnings` alone won't catch it; deny it explicitly. Source-level
# invariants clippy can't express live in tests/invariants.rs. (murk-p9o.2)
dbg_macro = "deny"

[lib]
name = "murk_cli"
path = "src/lib.rs"

[[bin]]
name = "murk"
path = "src/main.rs"

[dependencies]
age = { version = "0.11.3", features = ["ssh", "plugin", "cli-common"] }
ureq = "3"
base64 = "0.22.1"
bech32 = "0.12.0"
bip39 = "2.2.2"
clap = { version = "4.6.1", features = ["derive", "env"] }
chrono = { version = "0.4", default-features = false, features = ["clock"] }
colored = "3"
rand = "0.10.1"
rpassword = "7"
serde = { version = "1.0.228", features = ["derive"] }
serde_json = "1.0.150"
sha2 = "0.11.0"
blake3 = "1"
ed25519-dalek = "2"
# OpenSSH private-key parsing for ssh-ed25519 vault signing. RSA/encryption
# features are deliberately off: we only need ed25519, and keeping RSA out avoids
# widening the Marvin-attack surface (RUSTSEC-2023-0071, already tracked in deny.toml).
ssh-key = { version = "0.6", default-features = false, features = ["ed25519", "alloc"] }
constant_time_eq = "0.4"
tempfile = "3.27.0"
clap_complete = "4.6.5"
fs2 = "0.4.3"
pyo3 = { version = "0.29", features = ["extension-module"], optional = true }
walkdir = "2.5.0"
zeroize = "1"

[target.'cfg(unix)'.dependencies]
libc = "0.2"

[features]
default = []
python = ["pyo3"]

[dev-dependencies]
assert_cmd = "2"
assert_fs = "1"
predicates = "3"