Track SecretSpec Debian package release

[domenkozar]

Goal

Publish SecretSpec as an official Debian package.

Current status

The terminal and signal dependency blockers are resolved on main:

inquire 0.9.4 (Console backend)
signal-hook 0.4

A binary-only package using the cli feature has been built and installed successfully in a clean Debian sid container. It contains:

• /usr/bin/secretspec
• /usr/bin/docker-credential-secretspec
• /usr/bin/git-credential-secretspec

secretspec --version also ran successfully from the installed package.

Debian packages Inquire as one broad librust-inquire-dev package, so installing its build dependencies currently pulls in Crossterm and Termion metadata even though SecretSpec only compiles the Console backend. Crossterm is not part of SecretSpec's compiled Cargo graph.

Remaining dependency work

The minimal --no-default-features --features cli graph is available in Debian sid except for these crates:

• detect-coding-agent 0.1.x
• dotenv-ng-core 1.0.0
• dotenv-ng 1.0.0

Prototype Debian packages for all three build successfully. They need proper debcargo-conf overlays and archive submission before SecretSpec can enter Debian.

The currently published SecretSpec crate is 0.19.1 and predates the Console/signal-hook changes, so Debian submission should use the next crates.io release.

Initial provider scope

An initial package can support 22 providers using the Rust crates already available in Debian sid. In addition to the 13 unconditional providers, enable:

• HashiCorp Vault
• OpenBao
• Infisical
• Scaleway Secret Manager
• Cloudflare
• Bitwarden Secrets Manager
• Bitwarden Password Manager
• EJSON
• SOPS

Debian also provides keyring 3.6.3. SecretSpec currently requests 4.1.6, but the existing keyring provider compiles unchanged against 3.6.3. Applying a Debian dependency patch therefore raises the initial package to 23 providers without introducing another package.

The combined 23-provider feature set was compile-checked successfully. Its only missing Debian crates are still detect-coding-agent, dotenv-ng-core, and dotenv-ng.

Defer these providers until their Rust SDK dependency trees enter Debian:

• KDBX
• Keeper
• Google Cloud Secret Manager
• AWS Secrets Manager
• AWS Parameter Store
• Azure Key Vault
• Azure App Configuration
• Age
• Kubernetes

Tracking checklist

• Switch Inquire from Crossterm to the Console backend
• Update SecretSpec to use signal-hook 0.4 exclusively
• Verify the CLI and interactive dependency graph on Linux
• Prototype a binary-only Debian package and install-test all three binaries
• Identify and compile-check an initial 23-provider feature set
• Publish the next SecretSpec release to crates.io
• Package detect-coding-agent, dotenv-ng-core, and dotenv-ng for Debian
• Prepare production debcargo-conf overlays and complete copyright review
• File the ITP and submit SecretSpec to Debian
• Add Debian installation instructions after the package reaches the archive

[domenkozar]

0.20.0 Debian packaging update

Packaging is now prepared from the exact crates.io secretspec 0.20.0 release
(SHA-256 b693a75854657fac1b34288f18503067836007c30f50606c8a1150e01782b081).

The initial Debian package is binary-only and builds the secretspec,
docker-credential-secretspec, and git-credential-secretspec executables.
It enables the 23 providers supported by crates already available in Debian.
The aac, age, akv, awsps, awssm, gcsm, kdbx, keeper, and
kubernetes features remain deferred.

Three new Rust source packages were needed and have also been prepared:

• detect-coding-agent 0.1.1
• dotenv-ng-core 1.0.0
• dotenv-ng 1.0.0

All four packages build on Debian sid. The dependency tests pass, the
SecretSpec autopkgtest reports PASS for all three installed binaries, and
lintian has no warning tags beyond the expected pre-upload changelog marker.

The debcargo-conf work is split into one single-crate branch per Salsa MR, with
RFS dependency notes. The rust-secretspec ITP is
Debian bug #1146627. The
dependency MRs should be submitted before the SecretSpec MR.

Initial dependency MRs:

• detect-coding-agent 0.1.1
• dotenv-ng-core 1.0.0