What it is
secrets.
Two tiers over the same port. A tenant's secrets live inside that tenant's own database, beside its migration history and its audit chain, which is what makes backup, restore and offboarding one-database operations. The other tier holds the platform's own secrets — never a tenant's — in the control database. Each store holds its own wrapped data key, which the KMS unwraps and never stores, so what a database dump contains is ciphertext plus a blob nobody outside the KMS can open.
A copied row fails to decrypt rather than quietly succeeding. Every ciphertext is bound by the AEAD's additional data to its store, its name, its version and its key id, so a row that is copied into another tenant, renamed, rolled back or repointed at a different key does not open. SecretBytes zeroises on drop, prints as [redacted], and implements neither Display, Serialize nor Clone.
Ports
Database · Clock
Also
A tamper-evident audit chain over every read and write, and key rotation that re-wraps without re-encrypting every row.
History
Changelog.
From the crate’s CHANGELOG.md in the harness, as of 0c5560b. 4 versions recorded, newest first. Every published version is on crates.io.
Other
- updated the following local packages: cratefield-core
Other
- updated the following local packages: cratefield-core
2 earlier versions 0.3.1 to 0.4.0
Changed
- Breaking: requires
cratefield-core0.8 (was 0.7), and so a minor rather than a patch bump: a venture still on core 0.7 does not pick this release up through a caret requirement and end up with two copies of core (#712).
Other
- updated the following local packages: cratefield-core
- Breaking: requires
Other
- updated the following local packages: cratefield-core
The unwrapping half is the KMS port.