Module secrets 

__gunnar_secrets__ — per-repository secret material, on the same one-RecordBatch-per-push log as crate::refs.

Deploy keys, webhook tokens and signing keys change with the same shape a ref does: rarely, transactionally, and with a history worth keeping. So they use the same mechanism (crate::pushlog) rather than a second one — the reason this is a native package format and not two bolt-ons stapled together.

What znippy is and is not responsible for

ciphertext is already encrypted by the caller. znippy never sees plaintext, holds no key, and performs no encryption: it stores an opaque blob and records what it is called and when it arrived. Anything else would put key management inside an archiver.

Two consequences follow, and both are enforced here:

• ciphertext is high-entropy, so it is never compressed — the same law that keeps znippy off .pack files. znippy_common::SkipPolicy is asked for the whole batch via secret_skip_policy.
• a secret that is stored unencrypted by mistake is a leak that no later fix undoes, so SecretUpdate::new refuses empty ciphertext outright rather than writing a row that looks like a stored secret.

Structs

SecretState

The state of one secret after replaying the log.

SecretUpdate

One secret update inside a push.

SecretsLog

The secrets log of one repository.

Functions

build_push_batch

fold

Replay pushes into the current secret set. Last writer wins by push_seq; a null ciphertext revokes.

read_secrets

Read the sealed __gunnar_secrets__ section out of an archive.

secret_skip_policy

Secret material is ciphertext: it never compresses, so it never goes to the codec. One policy for the whole batch — the free, exact answer.

secrets_schema