Module secrets 

Shared secret vault helpers used by the CLI and task execution

Structs

SecretConfig

SecretSettings

VaultMeta

Metadata stored inside a vault directory that describes how the vault should be accessed. Written by mk secrets vault init --gpg-key-id so subsequent commands (store, show, export, …) pick up the GPG key automatically without flags.

Enums

SecretBackend

SecretValueSource

Functions

encrypt_with_gpg

Encrypt plaintext using the system gpg binary for the given key ID or fingerprint. The output is ASCII-armored PGP data suitable for storing as a data.asc vault file.

infer_secret_backend

list_secret_paths

load_secret_env

load_secret_value

load_secret_values

merge_optional_secret_settings

read_vault_backend

read_vault_gpg_key_id

Read the GPG key ID stored in a vault’s metadata file, if present. Returns None when the file does not exist or cannot be parsed.

read_vault_meta

resolve_secret_config

verify_vault

write_vault_meta

Write (or overwrite) the vault’s metadata file with the supplied settings.