Deneblab.StashLock.Cli 0.4.10

Deneblab.StashLock.Cli

Command-line interface for StashLock secrets management vault. Uses X25519 ECIES (Elliptic Curve Integrated Encryption Scheme) with AES-256-GCM for keypair-based secrets encryption.

Installation

dotnet tool install -g Deneblab.StashLock.Cli

Usage

1. Initialize a vault directory

stashlock init ./my-vault -tags production,develop

Creates a stashlock.config.json with the specified environment tags and auto-generates key files for each tag.

2. Generate key pairs

stashlock keygen ./my-vault

Generates X25519 key pairs (stashlock.key.{tag}.json) for each tag defined in the config. Skips existing key files.

3. Encrypt secrets

stashlock encode ./my-vault/secrets.json

Reads a plaintext JSON secrets file, encrypts it with each tag's public key using sealed box encryption, and outputs encrypted files (stashlock.enc.{tag}.secrets.json).

Two encryption modes are supported:

• SOPS mode (default) — field-level encryption with MAC verification
• Whole-file mode — encrypts entire JSON as a single blob

4. Decrypt secrets

stashlock decode ./my-vault/stashlock.enc.production.secrets.json

Decrypts an encrypted stashlock.enc.*.json file back to plaintext JSON. Auto-detects encryption mode and key file.

Options:

• -key <path> — Specify key file path (auto-detected if omitted)
• -output <path> — Write to file instead of stdout

5. Publish to vault server

stashlock publish ./my-vault/stashlock.enc.production.secrets.json

Uploads encrypted stashlock.enc.*.json files to the StashLock vault API. Extracts the vault key from the file metadata and POSTs the content to the server.

Accepts a single file or a directory (publishes all stashlock.enc.*.json files found).

# Publish all encrypted files in a directory
stashlock publish ./my-vault

# Publish with explicit API URL and key
stashlock publish ./my-vault --url https://my-vault.example.com/api --api-key my-secret-key

# Publish with TTL (auto-expires after 3600 seconds)
stashlock publish ./my-vault/stashlock.enc.production.secrets.json --expires-in 3600

Options:

• --url <url> — API base URL (falls back to STASHLOCK_API_URL env var, then default)
• --api-key <key> — API authentication key (falls back to STASHLOCK_API_KEY env var)
• --expires-in <seconds> — TTL in seconds for the published secret

6. Generate connection string

# Interactive mode — lists tags, lets you pick
stashlock cstring ./my-vault

# Quick mode — skip prompts
stashlock cstring ./my-vault --tag production

# Base64 output only
stashlock cstring ./my-vault --tag production --base64

# Output as environment variable command
stashlock cstring ./my-vault --tag production --env

Reads stashlock.config.json (ServerUrl, ApiKey, Name) and stashlock.key.{tag}.json (PrivateKey) from the vault directory, generates a connection string in Key=Value;Key=Value format.

Output includes plain text, base64-encoded, and a copy-paste set/export command.

Commands

Workflow

init  -->  keygen  -->  encode  -->  publish  -->  decode
 |           |            |           |             |
 v           v            v           v             v
config     keypairs    encrypted   uploaded      plaintext
 file       files       files     to server       output

         cstring (cs)
              |
              v
        connection string
       (for Client library)

Encryption Details

• Key Agreement: X25519 ECIES (Elliptic Curve Integrated Encryption Scheme)
• Key Derivation: HKDF-SHA256
• Symmetric Encryption: AES-256-GCM
• Key Size: 32 bytes (X25519 public/private keys)
• Nonce: 12 bytes (random per encryption)
• Auth Tag: 16 bytes
• Output format: ephemeral public key (32B) || nonce (12B) || ciphertext || tag (16B)

Environment Variables

Links

• StashLock Client Library
• Repository
• Issues

License

MIT