spec for handling build-time secrets
Metadata
Current evaluation
Build-time secrets were delivered through a secrets API and application rendering; managed-mode support followed in #104.
Resolution: closed resolved
Reason: Commits 89232cfc and ef5620dd added the secrets API and rendered build secrets in the application; #104 later added managed-mode support.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### What needs to get done
Create a spec + prototype for supporting build-time secrets in the applications. The idea is to follow [spread's lead](https://github.com/snapcore/spread#environments): For example, a declaration like:
```
parts:
part1:
source: https://user:$(HOST: GIT_PASS)@git.com
source-type: git
....
```
will cause the application to evaluate the `GIT_PASS` environment variable on the host, replacing its value in the `source` line.
### Why it needs to get done
Users need a way to handle passwords, api keys, etc without recording them in the application's project files.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Build-time secrets were delivered through a secrets API and application rendering; managed-mode support followed in #104. | |
| stealth/space-bunny-alpha | — | closed resolved | Build-time secret support was implemented through a secrets API and rendering commits; managed-mode support followed in PR #104. | |
| stealth/space-bunny-alpha | — | closed stale | Closed with no recorded specification, prototype, implementation, or closing explanation. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without implementation. The build-time secret environment substitution spec was abandoned, leaving the feature unaddressed. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without implementation. The request for build-time secret substitution via host environment variables was abandoned after 39 days with no comments or prototype development. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/craft-application#104
(confidence 95%)
Extended the build-secrets implementation to managed mode.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #100 Add support for build secrets | craft-application | closed | Managed-mode build-secret support was merged in canonical/craft-application#104 via commit 8c6c0475. | |
| #104 feat: support build-secrets in managed-mode | craft-application | merged | Merged managed-mode build-secret support in #104 via commit 8c6c0475, encoding host secrets and decoding them in managed instances to re-render project secrets. | |
| #102 Support build secrets in destructive mode | craft-application | merged | PR #102 merged, adding build-secrets support in destructive mode: YAML-service secret handling plus Application rendering. Landed as commit ef5620dd, followed by managed-mode support in #104 (8c6c0475). | |
| #657 feat!(secrets): remove secrets | craft-application | merged | Merged PR #657 in commit ad52b56b, removing built-in secrets support; applications can instead integrate secrets through the prototype secrets service. |