From One Seed to a Thousand Leaves – Merkle's Authentication Tree

7 hours ago

Content addressing uses cryptographic hashes to identify data, enabling integrity verification, deduplication, and tamper evidence across package management systems.
Hashing occurs at multiple levels: individual files, single artifacts, dependency graphs, package versions, registry indices, metadata, and build inputs, each with specific use cases.
Identical extracted content can produce different hashes due to archive metadata; solutions include canonical formats (e.g., Nix NAR) or hashing file trees directly (e.g., Go's dirhash).

SecretSpec 0.17 introduces scopes to limit each service or task to only its declared subset of a profile.
Secrets caching allows a slow fallback route to be cached locally with bounded freshness and explicit invalidation.
Cross-secret validation enables declaring alternative or mutually exclusive credentials instead of marking every value independently required or optional.

Content addressing uses cryptographic hashes to identify data, enabling integrity verification, deduplication, and tamper evidence across package management systems.
Hashing occurs at multiple levels: individual files, single artifacts, dependency graphs, package versions, registry indices, metadata, and build inputs, each with specific use cases.
Identical extracted content can produce different hashes due to archive metadata; solutions include canonical formats (e.g., Nix NAR) or hashing file trees directly (e.g., Go's dirhash).

SecretSpec 0.17 introduces scopes to limit each service or task to only its declared subset of a profile.
Secrets caching allows a slow fallback route to be cached locally with bounded freshness and explicit invalidation.
Cross-secret validation enables declaring alternative or mutually exclusive credentials instead of marking every value independently required or optional.

Hasty Briefsbeta