Encryption keeps the server from reading your secrets. Signatures keep it from changing them: every value and every version is signed by the device that wrote it, and every client checks that before using a value. A server or database that tries to slip in a value of its own is refused.

What is checked before a value is used#

• The key name is a plain variable name and the value sits where the client expects it (project, environment, service, name, revision).
• The version's signature, and that it covers every file of the version, including files you can't read.
• The value's own signature.
• The signer: a device certified by its account, not revoked, in a complete and fresh copy of the key log.
• That the signer is a writer you trust: yourself, a teammate whose fingerprint you verified, a writer listed in the repository's .storeenv.json "writers", one approved on this device, or one passed with --trust-writer.

The key log#

Account keys, device certificates and revocations go into an append only log. Every client keeps a complete copy and checks it against the server's signed head, so a withheld revocation is caught. Heads older than an hour are refused (SE_LOG_STALE).

The commands#

What happens to unsigned or unknown values#

• run and copy refuse any value that isn't signed by a trusted writer. No flag changes that.
• pull warns about unsigned values. An environment once seen signed refuses unsigned versions.
• Values signed by a device that was since revoked are refused until a trusted writer re-signs them with storeenv sign.
• The web app marks unsigned values as unverified.

Known limits#

• Split view: a server could show different people different, internally consistent logs, for example to hide a revocation from one person. Comparing storeenv verify --head with a teammate detects it; independent witnesses would close it.
• Imported values aren't covered by the source version's signature; each value still is (see Imports and libraries).
• A device reading an environment for the first time can be shown an older genuine version.
• Every signed in user can list the logins, public keys and device names in the key log. Name devices with that in mind.
• CLI 0.1.x and older web builds ignore signatures. Upgrade every client: npm i -g storeenv-cli@latest.
• Signing has not been independently reviewed yet. The client is an open-source client (storeenv-cli and @storeenv/core on GitHub), so you can read exactly what it checks.