rosa/gtt

Watch

Fork 0

chore(deps): update dependency fnox to v1.32.0 #7

Merged

rosa merged 1 commit from renovate/fnox-1.x into main

2026-08-08 12:03:23 +00:00

rosa commented

2026-08-03 00:05:40 +00:00

Owner

This PR contains the following updates:

Package	Type	Update	Change
fnox	tools	minor	`1.31.0` → `1.32.0`

Release Notes

jdx/fnox (fnox)

`v1.32.0`: : Credential proxy, process replacement, and Azure App Configuration

Compare Source

A feature-packed release adding a destination-scoped credential proxy, a process-replacement mode for exec, a new Azure App Configuration provider, and IAM role assumption for the AWS providers, plus a fix to how global config layers under explicit --config paths.

Highlights

New ways to keep real secrets out of workloads: a credential proxy that brokers HTTPS requests without exposing secret values, and an exec --replace mode for clean environment-only execution.
Broader cloud coverage: a read-only Azure App Configuration provider and cross-account IAM role assumption in the AWS providers.

Added

Credential proxy (#667) -- @jdx

A new [proxy] configuration and fnox proxy command let agent-style workloads call external APIs without ever receiving real secret values in their environment. fnox runs an ephemeral loopback TLS interception proxy that substitutes credentials into allowed request headers only for destinations that match your rules, and redacts reflected secret values from responses.

fnox proxy rules            # inspect the effective policy
fnox proxy run -- ./agent   # run a command through the local proxy

Rules match on domain, HTTP method, path globs, and headers, with strict (block-by-default) or permissive egress. The child environment is scrubbed of profile secrets and ambient provider credentials, redirects and ambient upstream proxies are blocked, and overlay configs replace [proxy] wholesale so layered rules cannot silently broaden authority. This is an intentionally narrow first pass: OS sandboxing is not yet included (same-user processes can bypass proxy env vars), interception is HTTPS on port 443 over HTTP/1.1, credential substitution is header-only, and responses over 10 MiB are rejected.

fnox exec --replace process replacement mode (#654) -- @davdroman

On Unix-like systems, fnox exec --replace runs your command via process replacement so it keeps the same PID and receives signals directly, instead of fnox staying resident as a parent.

fnox exec --replace -- ./app

Because replacement prevents post-command cleanup, file-based secrets and credential leases are rejected up front. Ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE values are omitted while explicitly selected secrets with those names are still passed through, and inherited ignored SIGINT/SIGTERM dispositions are preserved.

Azure App Configuration provider (azure-ac) (#659) -- @jmoreno11

A read-only provider for Azure App Configuration, the non-secret half of Azure's config surface (endpoints, feature toggles, tuning values) that complements the existing azure-sm Key Vault provider. Supports optional label (which maps naturally onto profiles) and prefix, using the same DeveloperToolsCredential auth as azure-sm with no new dependencies. Configure it with your App Configuration endpoint and an optional label:

[profiles.prod.providers]
appconfig = { type = "azure-ac", endpoint = "<your-appconfig-endpoint>", label = "prod" }

IAM role assumption in the AWS providers (#671) -- @halms

aws-sm, aws-ps, and aws-kms now accept an optional role_arn. When set, fnox calls sts:AssumeRole using the credentials from profile (or the default chain) and uses the result for every request — enabling the common "log in with this SSO profile, read secrets as that role" cross-account setup. aws-kms also gains the profile field that the other two already had, and malformed role ARNs are rejected before any AWS call.

[providers.sm]
type = "aws-sm"
region = "eu-west-1"
profile = "sso-dev"
role_arn = "arn:aws:iam::123456789012:role/secrets-reader"

Fixed

Global config now layers under explicit --config paths (#651) -- @jdx. Previously, pointing -c/--config at anything other than a bare default filename silently skipped the global config and ignored that file's own import = [...], while fnox config-files listed files that were never actually loaded. An explicit path now loads that file, its imports, and the global config underneath it, and fnox config-files reflects the path loading actually takes. Note: fnox -c custom.toml sync -p <provider> can now pull globally-declared secrets into the custom file, consistent with discovered configs. For full isolation, point FNOX_CONFIG_DIR at a directory with no config.toml.

New Contributors

@jmoreno11 made their first contribution in #659
@davdroman made their first contribution in #654
@halms made their first contribution in #671

Full Changelog: https://github.com/jdx/fnox/compare/v1.31.1...v1.32.0

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

`v1.31.1`: : Maintenance and dependency updates

Compare Source

A small maintenance release. There are no new features or bug fixes in v1.31.1 — it consists entirely of dependency updates and internal tooling changes.

Changed

Routine dependency bumps across the runtime and build stack, including tokio, rustls, clap, regex, toml_edit, keepass, google-cloud-secretmanager-v1, apple-native-keyring-store, and others, by @renovate.
Cargo now uses MSRV-aware dependency resolution (incompatible-rust-versions = "fallback") so updates prefer versions compatible with fnox's declared minimum Rust version, keeping the project buildable for distro and nixpkgs packagers (#627) -- @jdx.

Full Changelog: https://github.com/jdx/fnox/compare/v1.31.0...v1.31.1

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [fnox](https://github.com/jdx/fnox) | tools | minor | `1.31.0` → `1.32.0` | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.32.0`](https://github.com/jdx/fnox/releases/tag/v1.32.0): : Credential proxy, process replacement, and Azure App Configuration [Compare Source](https://github.com/jdx/fnox/compare/v1.31.1...v1.32.0) A feature-packed release adding a destination-scoped credential proxy, a process-replacement mode for `exec`, a new Azure App Configuration provider, and IAM role assumption for the AWS providers, plus a fix to how global config layers under explicit `--config` paths. #### Highlights - New ways to keep real secrets out of workloads: a credential proxy that brokers HTTPS requests without exposing secret values, and an `exec --replace` mode for clean environment-only execution. - Broader cloud coverage: a read-only Azure App Configuration provider and cross-account IAM role assumption in the AWS providers. #### Added **Credential proxy** ([#667](https://github.com/jdx/fnox/pull/667)) -- [@jdx](https://github.com/jdx) A new `[proxy]` configuration and `fnox proxy` command let agent-style workloads call external APIs without ever receiving real secret values in their environment. fnox runs an ephemeral loopback TLS interception proxy that substitutes credentials into allowed request headers only for destinations that match your rules, and redacts reflected secret values from responses. ```sh fnox proxy rules # inspect the effective policy fnox proxy run -- ./agent # run a command through the local proxy ``` Rules match on domain, HTTP method, path globs, and headers, with strict (block-by-default) or permissive egress. The child environment is scrubbed of profile secrets and ambient provider credentials, redirects and ambient upstream proxies are blocked, and overlay configs replace `[proxy]` wholesale so layered rules cannot silently broaden authority. This is an intentionally narrow first pass: OS sandboxing is not yet included (same-user processes can bypass proxy env vars), interception is HTTPS on port 443 over HTTP/1.1, credential substitution is header-only, and responses over 10 MiB are rejected. **`fnox exec --replace` process replacement mode** ([#654](https://github.com/jdx/fnox/pull/654)) -- [@davdroman](https://github.com/davdroman) On Unix-like systems, `fnox exec --replace` runs your command via process replacement so it keeps the same PID and receives signals directly, instead of fnox staying resident as a parent. ```sh fnox exec --replace -- ./app ``` Because replacement prevents post-command cleanup, file-based secrets and credential leases are rejected up front. Ambient `FNOX_AGE_KEY` and `FNOX_AGE_KEY_FILE` values are omitted while explicitly selected secrets with those names are still passed through, and inherited ignored `SIGINT`/`SIGTERM` dispositions are preserved. **Azure App Configuration provider (`azure-ac`)** ([#659](https://github.com/jdx/fnox/pull/659)) -- [@jmoreno11](https://github.com/jmoreno11) A read-only provider for Azure App Configuration, the non-secret half of Azure's config surface (endpoints, feature toggles, tuning values) that complements the existing `azure-sm` Key Vault provider. Supports optional `label` (which maps naturally onto profiles) and `prefix`, using the same `DeveloperToolsCredential` auth as `azure-sm` with no new dependencies. Configure it with your App Configuration `endpoint` and an optional `label`: ```toml [profiles.prod.providers] appconfig = { type = "azure-ac", endpoint = "<your-appconfig-endpoint>", label = "prod" } ``` **IAM role assumption in the AWS providers** ([#671](https://github.com/jdx/fnox/pull/671)) -- [@halms](https://github.com/halms) `aws-sm`, `aws-ps`, and `aws-kms` now accept an optional `role_arn`. When set, fnox calls `sts:AssumeRole` using the credentials from `profile` (or the default chain) and uses the result for every request — enabling the common "log in with this SSO profile, read secrets as that role" cross-account setup. `aws-kms` also gains the `profile` field that the other two already had, and malformed role ARNs are rejected before any AWS call. ```toml [providers.sm] type = "aws-sm" region = "eu-west-1" profile = "sso-dev" role_arn = "arn:aws:iam::123456789012:role/secrets-reader" ``` #### Fixed - **Global config now layers under explicit `--config` paths** ([#651](https://github.com/jdx/fnox/pull/651)) -- [@jdx](https://github.com/jdx). Previously, pointing `-c/--config` at anything other than a bare default filename silently skipped the global config and ignored that file's own `import = [...]`, while `fnox config-files` listed files that were never actually loaded. An explicit path now loads that file, its imports, and the global config underneath it, and `fnox config-files` reflects the path loading actually takes. Note: `fnox -c custom.toml sync -p <provider>` can now pull globally-declared secrets into the custom file, consistent with discovered configs. For full isolation, point `FNOX_CONFIG_DIR` at a directory with no `config.toml`. #### New Contributors - [@jmoreno11](https://github.com/jmoreno11) made their first contribution in [#659](https://github.com/jdx/fnox/pull/659) - [@davdroman](https://github.com/davdroman) made their first contribution in [#654](https://github.com/jdx/fnox/pull/654) - [@halms](https://github.com/halms) made their first contribution in [#671](https://github.com/jdx/fnox/pull/671) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.31.1...v1.32.0> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools including [mise](https://mise.jdx.dev/), [aube](https://aube.jdx.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at jdx.dev](https://jdx.dev/sponsors.html). Sponsorships are what let fnox stay independent and the project keep moving. ### [`v1.31.1`](https://github.com/jdx/fnox/releases/tag/v1.31.1): : Maintenance and dependency updates [Compare Source](https://github.com/jdx/fnox/compare/v1.31.0...v1.31.1) A small maintenance release. There are no new features or bug fixes in v1.31.1 — it consists entirely of dependency updates and internal tooling changes. #### Changed - Routine dependency bumps across the runtime and build stack, including `tokio`, `rustls`, `clap`, `regex`, `toml_edit`, `keepass`, `google-cloud-secretmanager-v1`, `apple-native-keyring-store`, and others, by [@renovate](https://github.com/renovate). - Cargo now uses MSRV-aware dependency resolution (`incompatible-rust-versions = "fallback"`) so updates prefer versions compatible with fnox's declared minimum Rust version, keeping the project buildable for distro and nixpkgs packagers ([#627](https://github.com/jdx/fnox/pull/627)) -- [@jdx](https://github.com/jdx). **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.31.0...v1.31.1> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools including [mise](https://mise.jdx.dev/), [aube](https://aube.jdx.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at jdx.dev](https://jdx.dev/sponsors.html). Sponsorships are what let fnox stay independent and the project keep moving. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

rosa added 1 commit

2026-08-03 00:05:40 +00:00