charly secrets

Served by	plugin-secrets
Placement	runtime (out-of-process over gRPC)
Version	2026.178.2100

secrets is a command word served by the plugin-secrets plugin candy. This plugin is not listed in charly/charly.yml’s compiled_plugins:. It is not part of the shipped binary: charly builds and loads it out-of-process over gRPC when a plan references one of its words (the coexist path).

About the plugin that serves it

OUT-OF-TREE charly plugin serving the ENTIRE secrets subsystem — a standalone Go module (go.mod + main.go) that owns the credential store (Secret Service / config-file backends, the iteration-capable godbus client) AND the GPG .secrets surface, so github.com/zalando/go-keyring lives HERE, out of charly’s core binary entirely (the C2 dep-shed removed go-keyring from charly/go.mod). charly’s loader fetches this candy’s repo, go-builds the provider binary on the HOST, and serves it OUT-OF-PROCESS via LocalTransport — or runs the host-installed /usr/lib/charly/plugins binary on a project-less host. It provides TWO capabilities:

• verb:credential — the externalized CREDENTIAL STORE BACKEND (NOT a check verb). charly’s core pluginCredentialStore (charly/credential_plugin.go) forwards every CredentialStore method (get/set/delete/list/name), the env-less resolve (resolve → {value,source}), the doctor keyring health probe (health), and the keyring re-probe (reset) over go-plugin gRPC. Every core credential consumer (enc.go / secrets.go / layer_secrets.go / runtime_config.go / vnc_helpers.go) is UNCHANGED — it resolves secret_require / secret_accept / VNC / enc passphrases exactly as before.

• command:secrets — charly secrets … (list / get / set / delete / import / export / migrate-secrets + the gpg subgroup), the externalized secrets CLI. charly DISPATCHES the command by syscall.Exec’ing this binary in CLI mode (sdk.Main → cliMain), so it owns real terminal stdio: secure password prompts (term.ReadPassword), $EDITOR for secrets gpg edit, and live gpg shell-outs all reach the real terminal.

verb:credential is served over gRPC (the provider registry); command:secrets is served via the CLI syscall.Exec path — so command:secrets is declared in plugin.providers (for the CLI-grammar prescan + baked manifest) but NOT advertised in Describe. The R10 consumer is a deploy that resolves a secret_require/secret_accept through the externalized store (e.g. check-k3s-vm’s K3S_CLUSTER_TOKEN autogen, or a pod bed) plus a host charly secrets round-trip.

Run charly secrets --help for the live flag grammar.