# SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials

DevFeed: [SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials](<https://devfeed.tech/articles/secretspec-0-17-scopes-secrets-caching-sops-age-and-systemd-credentials-31363.md>)

Original publisher: [Read original article](<https://discourse.nixos.org/t/secretspec-0-17-scopes-secrets-caching-sops-age-and-systemd-credentials/79184>)

Author: domenkozar

Published: 2026-07-27T04:36:14Z

Content type: release

Language: en

Sources: [Announcements - NixOS Discourse](<https://devfeed.tech/sources/announcements-nixos-discourse.md>)

Topics: [SDKs](<https://devfeed.tech/topics/sdks.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [forgejo](<https://devfeed.tech/topics/forgejo.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>)

Tags: [announcements](<https://devfeed.tech/tags/announcements.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [caching](<https://devfeed.tech/tags/caching.md>), [forgejo](<https://devfeed.tech/tags/forgejo.md>), [github](<https://devfeed.tech/tags/github.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [scaleway](<https://devfeed.tech/tags/scaleway.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [sdks](<https://devfeed.tech/tags/sdks.md>), [systemd](<https://devfeed.tech/tags/systemd.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

## AI overview

SecretSpec 0.17 adds scoped secret resolution, caching for slow remote providers, cross-secret validation, JWT/OIDC authentication for Vault and OpenBao, GitHub and Forgejo Actions support, and six new providers. Its SDKs also gain scope support, requiring applications to upgrade the SDK package and bundled native resolver together.

## Source excerpt

Hi all, We've released SecretSpec 0.17 with: scopes: consumers can now resolve only the secrets it declares, instead of receiving an entire profile. Secrets caching for slow remote providers, with configurable freshness and explicit invalidation. Cross-secret validation, including "at least one" and "exactly one" credential groups. JWT/OIDC authentication for Vault and OpenBao. A new GitHub and Forgejo Action that resolves, masks, and exposes secrets to later workflow steps. Six new providers: SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials. All SecretSpec SDKs have been updated with scope support. This required an FFI change, so applications should upgrade the SDK package and bundled native resolver together. Read the release blog post post or see the GitHub release. Domen Disclaimer: LLMs have been used in all the work delivered 1 post - 1 participant Read full topic