Skip to content

sops: rotate secrets 2026/Q3 - #20

Merged
rtucek merged 2 commits into
mainfrom
secrets/rotate
Aug 19, 2026
Merged

sops: rotate secrets 2026/Q3#20
rtucek merged 2 commits into
mainfrom
secrets/rotate

Conversation

@rtucek

@rtucek rtucek commented Aug 19, 2026

Copy link
Copy Markdown
Owner

Changes:

  • rotate secrets for 2026/Q3.
  • add helper script for keeping keys updated and rotate in one shot for all secrets in ./secrets

@rtucek rtucek self-assigned this Aug 19, 2026
@rtucek
rtucek merged commit fb00032 into main Aug 19, 2026
6 checks passed
@rtucek
rtucek deleted the secrets/rotate branch August 19, 2026 21:22
rtucek added a commit that referenced this pull request Aug 23, 2026
Version changes:
```
[C*]  #1  acl                                     2.3.2, 2.4.0, 2.4.0-bin, 2.4.0-dev, 2.4.0-doc, 2.4.0-man -> 2.4.0 x2, 2.4.0-bin, 2.4.0-dev, 2.4.0-doc, 2.4.0-man
[C*]  #2  attr                                    2.5.2, 2.6.0, 2.6.0-bin, 2.6.0-dev, 2.6.0-doc, 2.6.0-man -> 2.6.0 x2, 2.6.0-bin, 2.6.0-dev, 2.6.0-doc, 2.6.0-man
[C*]  #3  audit                                   4.1.2-unstable-2025-09-06-lib, 4.2.1, 4.2.1-bin, 4.2.1-lib, 4.2.1-man -> 4.2.1, 4.2.1-bin, 4.2.1-lib x2, 4.2.1-man
[C.]  #4  aws-c-http                              0.10.4, 0.11.0 -> 0.11.0 x2
[C.]  #5  aws-c-io                                0.22.0, 0.27.2 -> 0.27.2 x2
[C.]  #6  c-ares                                  1.34.6 x2, 1.34.6-dev, 1.34.8 -> 1.34.8 x3, 1.34.8-dev
[U*]  #7  cpupower                                7.1.8, 7.1.8_fish-completions -> 7.2, 7.2_fish-completions
[C*]  #8  curl                                    8.20.0, 8.21.0, 8.21.0-bin, 8.21.0-dev, 8.21.0-fish-completions, 8.21.0-man -> 8.21.0 x2, 8.21.0-bin, 8.21.0-dev, 8.21.0-fish-completions, 8.21.0-man
[U*]  #9  docker                                  29.6.2, 29.6.2-fish-completions -> 29.7.2, 29.7.2-fish-completions
[U.]  #10  docker-containerd                       29.6.2 -> 29.7.2
[U.]  #11  docker-runc                             29.6.2 -> 29.7.2
[U.]  #12  docker-tini                             29.6.2 -> 29.7.2
[C.]  #13  expat                                   2.8.0, 2.8.2, 2.8.2-dev -> 2.8.2, 2.8.3, 2.8.3-dev
[C*]  #14  gawk                                    5.4.0, 5.4.1, 5.4.1-fish-completions, 5.4.1-info, 5.4.1-man -> 5.4.1 x2, 5.4.1-fish-completions, 5.4.1-info, 5.4.1-man
[U.]  #15  gdk-pixbuf                              2.44.6, 2.44.6-dev -> 2.44.7, 2.44.7-dev
[C.]  #16  glib                                    2.88.1 x2, 2.88.1-bin x2, 2.88.1-dev -> 2.88.1, 2.88.1-bin, 2.88.3, 2.88.3-bin, 2.88.3-dev
[C*]  #17  glibc                                   2.42-61, 2.42-67, 2.42-67-bin, 2.42-67-dev, 2.42-67-getent -> 2.42-67 x2, 2.42-67-bin, 2.42-67-dev, 2.42-67-getent
[C*]  #18  gnused                                  4.9, 4.10, 4.10_fish-completions x2, 4.10-info -> 4.10 x2, 4.10_fish-completions x2, 4.10-info
[C.]  #19  go                                      1.26.3, 1.26.5, 1.26.5-fish-completions -> 1.26.5, 1.26.6, 1.26.6-fish-completions
[C.]  #20  icu4c                                   76.1 x2, 76.1-dev x2 -> 76.1 x2, 76.1-dev, 78.3, 78.3-dev
[U.]  #21  initrd-linux                            7.1.8 -> 7.2
[C.]  #22  jq                                      1.8.1, 1.8.1-bin, 1.8.2, 1.8.2-bin, 1.8.2-fish-completions, 1.8.2-man -> 1.8.2 x2, 1.8.2-bin x2, 1.8.2-fish-completions, 1.8.2-man
[C.]  #23  krb5                                    1.22.1-lib, 1.22.2, 1.22.2-dev, 1.22.2-lib -> 1.22.2, 1.22.2-dev, 1.22.2-lib x2
[U.]  #24  libadwaita                              1.9.2 -> 1.9.3
[C.]  #25  libarchive                              3.8.7-lib, 3.8.8, 3.8.8-dev, 3.8.8-lib -> 3.8.8, 3.8.8-dev, 3.8.8-lib x2
[C.]  #26  libffi                                  3.5.2, 3.7.1, 3.7.1-dev -> 3.7.1, 3.8.0, 3.8.0-dev
[C.]  #27  libgit2                                 1.9.3-lib x2 -> 1.9.3-lib, 1.9.4-lib
[C.]  #28  libidn2                                 2.3.8 x2, 2.3.8-bin, 2.3.8-dev -> 2.3.8, 2.3.8-bin, 2.3.8-dev
[U.]  #29  libmpg123                               1.33.4 -> 1.33.7
[C.]  #30  libseccomp                              2.6.0-lib, 2.6.1-lib -> 2.6.1-lib x2
[U.]  #31  libssh                                  0.12.1 -> 0.12.2
[C.]  #32  libunistring                            1.4.2 x2 -> 1.4.2
[U.]  #33  libxfont_2                              2.0.8 -> 2.0.9
[C.]  #34  libxml2                                 2.15.2, 2.15.3, 2.15.3-bin, 2.15.3-dev -> 2.15.3 x2, 2.15.3-bin, 2.15.3-dev
[U.]  #35  linux                                   7.1.8, 7.1.8-modules x2 -> 7.2, 7.2-modules x2
[C.]  #36  llhttp                                  9.4.1, 9.4.1-dev, 9.4.2 -> 9.4.2, 9.4.2-dev, 9.4.3
[U.]  #37  moby                                    29.6.2 -> 29.7.2
[U.]  #38  mpg123                                  1.33.4 -> 1.33.7
[U.]  #39  neovim                                  0.12.3 -> 0.12.4
[U.]  #40  neovim-unwrapped                        0.12.3 -> 0.12.4
[C.]  #41  nix-cmd                                 2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #42  nix-expr                                2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #43  nix-fetchers                            2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #44  nix-flake                               2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #45  nix-main                                2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #46  nix-store                               2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #47  nix-util                                2.34.7, 2.34.8, 2.34.8-dev -> 2.34.8 x2, 2.34.8-dev
[C.]  #48  nixfmt                                  1.3.1, 1.4.0 -> 1.4.0 x2
[U.]  #49  nixos-system-tux-ibp-amdgen9-nixos-btw  26.05.20260814.02e0898 -> 26.05.20260820.5880666
[U.]  #50  nodejs                                  24.15.0 -> 24.18.1
[U.]  #51  nodejs-slim                             24.15.0, 24.15.0-corepack, 24.15.0-npm -> 24.18.1, 24.18.1-corepack, 24.18.1-npm
[U.]  #52  nspr                                    4.39 -> 4.40
[U.]  #53  nvim-host-python3                       3.13.13-env -> 3.13.14-env
[U*]  #54  openssh                                 10.4p1, 10.4p1-fish-completions, 10.4p1-man -> 10.5p1, 10.5p1-fish-completions, 10.5p1-man
[C.]  #55  openssl                                 3.6.2, 3.6.2-bin, 3.6.2-dev, 3.6.3, 3.6.3-bin, 3.6.3-dev, 3.6.3-fish-completions, 3.6.3-man -> 3.6.3 x2, 3.6.3-bin x2, 3.6.3-dev x2, 3.6.3-fish-completions, 3.6.3-man
[C.]  #56  perl5.42.0-HTTP-Daemon                  6.16, 6.17 -> 6.17 x2
[U*]  #57  podman                                  5.8.2 x2, 5.8.2-fish-completions, 5.8.2-man x2 -> 5.8.6 x2, 5.8.6-fish-completions, 5.8.6-man x2
[U*]  #58  postgresql                              17.10, 17.10-doc, 17.10-lib, 17.10-man -> 17.11, 17.11-doc, 17.11-lib, 17.11-man
[C.]  #59  publicsuffix-list                       0-unstable-2026-03-26, 0-unstable-2026-05-13 -> 0-unstable-2026-05-13 x2
[C.]  #60  python3                                 3.13.13, 3.13.13-env x2, 3.13.14, 3.13.14-env x3 -> 3.13.14, 3.13.14-env x2, 3.13.15, 3.13.15-env x3
[C.]  #61  s2n-tls                                 1.7.2, 1.7.6 -> 1.7.6 x2
[U.]  #62  simdjson                                4.6.0 -> 4.6.4
[C.]  #63  systemd-minimal                         260.1, 260.2 -> 260.2 x2
[C.]  #64  systemd-minimal-libs                    260.1, 260.2, 260.2-dev -> 260.2 x2, 260.2-dev
[U.]  #65  tree-sitter-c-neovim                    0.12.3 -> 0.12.4
[U.]  #66  tree-sitter-lua-neovim                  0.12.3 -> 0.12.4
[U.]  #67  tree-sitter-markdown-neovim             0.12.3 -> 0.12.4
[U.]  #68  tree-sitter-markdown_inline-neovim      0.12.3 -> 0.12.4
[U.]  #69  tree-sitter-query-neovim                0.12.3 -> 0.12.4
[U.]  #70  tree-sitter-vim-neovim                  0.12.3 -> 0.12.4
[U.]  #71  tree-sitter-vimdoc-neovim               0.12.3 -> 0.12.4
[C.]  #72  tzdata                                  2026b, 2026c -> 2026c x2
[U*]  #73  udisks                                  2.11.1, 2.11.1-man -> 2.11.2, 2.11.2-man
[U.]  #74  unbound                                 1.25.2-lib -> 1.26.0-lib
[U*]  #75  upower                                  1.91.2, 1.91.2_fish-completions -> 1.91.3, 1.91.3_fish-completions
[C.]  #76  util-linux-minimal                      2.42-bin, 2.42-lib, 2.42-login, 2.42-mount, 2.42-swap, 2.42.2-bin, 2.42.2-lib, 2.42.2-login, 2.42.2-mount, 2.42.2-swap -> 2.42.2-bin x2, 2.42.2-lib x2, 2.42.2-login x2, 2.42.2-mount x2, 2.42.2-swap x2
[U.]  #77  x86_energy_perf_policy                  6.18.44 -> 6.18.45
[C.]  #78  xgcc                                    15.2.0-libgcc x2 -> 15.2.0-libgcc
Added packages:
[A.]  #1  etc-bash_logout       <none>
[A.]  #2  etc-bashrc            <none>
[A.]  #3  etc-profile           <none>
[A.]  #4  inputrc               <none>
[A.]  #5  merve                 1.2.2
[A+]  #6  nix-bash-completions  0.6.8
Closure size: 2500 -> 2504 (2277 paths added, 2273 paths removed, delta +4, disk usage +38.6MiB).
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant