Skip to content

Age provider delete - #328

Open
GrafBlutwurst wants to merge 2 commits into
cachix:mainfrom
GrafBlutwurst:age-provider-delete
Open

Age provider delete#328
GrafBlutwurst wants to merge 2 commits into
cachix:mainfrom
GrafBlutwurst:age-provider-delete

Conversation

@GrafBlutwurst

Copy link
Copy Markdown

Adds delete capability to the age provider so it can serve as a caching capable provider.

GrafBlutwurst and others added 2 commits August 12, 2026 10:03
Deletion decrypts the blob, removes one key, and re-encrypts to the
current recipients, mirroring set. A missing blob or absent key reports
Ok(false) idempotently — without creating the file or re-encrypting the
unchanged plaintext under fresh randomness.

The registry declares deletes: true, so the plan-time cache-store gate
now admits age: an age file can back a cached provider alias — an
encrypted-at-rest cache with no keyring daemon or OS keychain — and
secretspec delete / import --delete-source work against it. The gate's
"Cache into one of:" list picks the provider up automatically via
deleting_provider_names().

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds age to every hardcoded delete-capable/cache-eligible provider
listing and to its own page's Access row, version-labeled (0.20+) per
the docs convention for unreleased capabilities.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant