SourceOrrery 0.1.4

SourceOrrery (.NET)

Read secrets from SourceOrrery vaults in .NET. Secrets belong to the runtime, not the repository.

using SourceOrrery;

using var reader = SecretReader.Open("development");
using var secret = reader.Get("database-password");
Connect(password: secret.Value.ExposeText());   // disposing zeroises the value

SourceOrrery replaces the plaintext .env file with an encrypted local vault. This package is its read-only .NET SDK: it opens a vault, reads the newest accessible version of a secret (or an exact version), its properties and sourceorrery:// references, and loads every secret a project's sourceorrery.toml declares. It cannot create, change or delete a secret: an application that only reads cannot be tricked into writing.

Documentation: the .NET guide · Getting started · Threat model

Before you start: the CLI

This package only reads. Vaults are created, and secrets stored, with the sourceorrery command-line tool, which NuGet does not install. Install it once on the machine where you manage secrets, from the GitHub release (Windows, macOS and Linux, x64 and arm64) or with cargo install --locked sourceorrery-cli --version 0.1.4 (step by step), then:

sourceorrery vault create development
sourceorrery secret set database-password --vault development   # typed at a hidden prompt

The CLI does not have to be installed where your application runs: this package opens the vault file itself.

Install

dotnet add package SourceOrrery

Targets .NET 8 and later, with source-generated LibraryImport P/Invoke, so it is trimming- and AOT-compatible. The package carries the native library for win-x64, win-arm64, osx-x64, osx-arm64, linux-x64 and linux-arm64 under runtimes/; set SOURCEORRERY_NATIVE_DIR to use a library from elsewhere. It is published by trusted publishing and carries nuget.org's repository signature (Supply chain).

Unlocking

SecretReader.Open("development") finds the vault under SOURCEORRERY_HOME (or the platform data directory) and unlocks it like the CLI: the OS credential store first, then SOURCEORRERY_PASSPHRASE, then the file named by SOURCEORRERY_PASSPHRASE_FILE; never an interactive prompt. On servers, in containers and in CI, give the vault a passphrase protector and pass the passphrase as a file (Headless).

Errors and values

Every failure is a SourceOrreryException or a subclass (SecretNotFoundException, VaultLockedException, SecretExpiredException, …) with a stable Code and a Hint that says what to do, such as the sourceorrery secret set command that would store a missing secret. A value is a SecretValue: it prints as [REDACTED], lends its bytes as a span through Use or copies them out through Expose and ExposeText, and is zeroised when disposed.

Building from source

From a clone of the repository, with Rust 1.88+, a C compiler and the .NET 10 SDK. The tests read a vault that the CLI creates; the fixture script also points SOURCEORRERY_NATIVE_DIR at the library just built. In Bash (Git Bash on Windows):

cargo build --release -p sourceorrery-cli -p sourceorrery-ffi
eval "$(bash scripts/ci/fixture-vault.sh)"
dotnet test bindings/dotnet/SourceOrrery.sln

Every step, with the prerequisites for each platform: https://sourceorrery.ai/sdks/dotnet/#building-from-source.

Licence

MIT or Apache-2.0, at your option. Source: https://github.com/Netizine/sourceorrery/tree/main/bindings/dotnet.