Skip to content

feat(provider): add Passbolt provider support #1030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
VDuchauffour wants to merge 1 commit into
base: main
Choose a base branch
from
+797 −0
Open

feat(provider): add Passbolt provider support #1030

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ It supports various backends including:
- Scaleway
- [Delinea SecretServer](https://delinea.com/products/secret-server)
- Infisical
- Passbolt

- Use `vals eval -f refs.yaml` to replace all the `ref`s in the file to actual values and secrets.
- Use `vals exec -f env.yaml -- <COMMAND>` to populate envvars and execute the command.
Expand Down Expand Up @@ -311,6 +312,7 @@ Please see the [relevant unit test cases](https://github.com/helmfile/vals/blob/
- [HTTP JSON](#http-json)
- [Fetch string value](#fetch-string-value)
- [Fetch integer value](#fetch-integer-value)
- [Passbolt](#passbolt)
- [Delinea Secret Server](#secretserver)
- [Advanced Usages](#advanced-usages)
- [Discriminating config and secrets](#discriminating-config-and-secrets)
Expand Down Expand Up @@ -1213,6 +1215,43 @@ Depending on which one is chosen with the `INFISICAL_AUTH_METHOD` environment va
- **GCP ID Token**: `GCP_ID_TOKEN`
- `INFISICAL_GCP_AUTH_IDENTITY_ID`: your Infisical Machine Identity ID.

### Passbolt

Retrieve secrets from [Passbolt](https://www.passbolt.com/), an open-source password manager for teams.

This provider uses the [go-passbolt](https://github.com/passbolt/go-passbolt) SDK and supports Passbolt CE and PRO editions.

- `ref+passbolt://RESOURCE_UUID#/password`
- `ref+passbolt://RESOURCE_UUID#/username`
- `ref+passbolt://RESOURCE_UUID[?address=PASSBOLT_URL&gpg_key_file=PATH&passphrase=PASSPHRASE]#/FIELD`

Environment variables:

- `PASSBOLT_BASE_URL`: The Passbolt server URL (e.g., `https://passbolt.example.com`)
- `PASSBOLT_GPG_KEY_FILE`: Path to the GPG private key file (ASCII armored)
- `PASSBOLT_GPG_KEY`: The GPG private key content directly (alternative to file)
- `PASSBOLT_GPG_PASSPHRASE`: The passphrase for the GPG private key

Parameters (override environment variables):

- `address`: Passbolt server URL
- `gpg_key_file`: Path to GPG private key file
- `passphrase`: GPG private key passphrase
Comment on lines +1235 to +1239
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provider supports gpg_key as a configuration input (and it’s documented earlier in the PR description/env var list), but the README “Parameters” section omits the gpg_key query parameter. Add gpg_key here (and ideally also include it in the bracketed URI example) so users know they can pass key content directly via URI params.

Copilot uses AI. Check for mistakes.

Supported fields: `password` (default), `username`, `name`, `uri`, `description`, `custom_fields/FieldName`

Custom fields require Passbolt v5.3+ with encrypted metadata enabled.

Examples:

- `ref+passbolt://aaa-bbb-ccc-ddd#/password` gets the password of the resource
- `ref+passbolt://aaa-bbb-ccc-ddd#/username` gets the username of the resource
- `ref+passbolt://aaa-bbb-ccc-ddd?address=https://passbolt.example.com#/password` with explicit server URL
- `ref+passbolt://aaa-bbb-ccc-ddd#/custom_fields/ProjectID` gets the value of custom field `ProjectID`
- `ref+passbolt://RESOURCE_UUID` returns a map with all available fields when no fragment is specified

Note: This provider does not support MFA. Use a service account without MFA enabled for automation.

### SecretServer

This provider allows retrieval of secrets from [Delinea SecretSever](https://delinea.com/products/secret-server) using their [REST API](https://docs.delinea.com/online-help/secret-server/api-scripting/rest-api/index.htm)
Expand Down
3 changes: 3 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ require (
github.com/infisical/go-sdk v0.6.8
github.com/openbao/openbao/api/v2 v2.5.1
github.com/opencontainers/image-spec v1.1.1
github.com/passbolt/go-passbolt v0.7.3-0.20260128122347-95e6a762aa5f
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36
github.com/stretchr/testify v1.11.1
github.com/tidwall/gjson v1.18.0
Expand All @@ -55,6 +56,7 @@ require (
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
github.com/Masterminds/semver/v3 v3.4.0 // indirect
github.com/ProtonMail/gopenpgp/v3 v3.3.0 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
Expand Down Expand Up @@ -101,6 +103,7 @@ require (
github.com/oracle/oci-go-sdk/v65 v65.95.2 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/rs/zerolog v1.26.1 // indirect
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/sony/gobreaker v0.5.0 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
Expand Down
8 changes: 8 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,8 @@ github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEV
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
github.com/ProtonMail/gopenpgp/v3 v3.3.0 h1:N6rHCH5PWwB6zSRMgRj1EbAMQHUAAHxH3Oo4KibsPwY=
github.com/ProtonMail/gopenpgp/v3 v3.3.0/go.mod h1:J+iNPt0/5EO9wRt7Eit9dRUlzyu3hiGX3zId6iuaKOk=
github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=
github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=
github.com/antchfx/jsonquery v1.3.6 h1:TaSfeAh7n6T11I74bsZ1FswreIfrbJ0X+OyLflx6mx4=
Expand Down Expand Up @@ -202,6 +204,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
Expand Down Expand Up @@ -505,6 +509,8 @@ github.com/oracle/oci-go-sdk/v65 v65.95.2 h1:0HJ0AgpLydp/DtvYrF2d4str2BjXOVAeNbu
github.com/oracle/oci-go-sdk/v65 v65.95.2/go.mod h1:u6XRPsw9tPziBh76K7GrrRXPa8P8W3BQeqJ6ZZt9VLA=
github.com/ory/dockertest/v3 v3.12.0 h1:3oV9d0sDzlSQfHtIaB5k6ghUCVMVLpAY8hwrqoCyRCw=
github.com/ory/dockertest/v3 v3.12.0/go.mod h1:aKNDTva3cp8dwOWwb9cWuX84aH5akkxXRvO7KCwWVjE=
github.com/passbolt/go-passbolt v0.7.3-0.20260128122347-95e6a762aa5f h1:j0gWrm9AKW+kAq+AyYik5jFmbWEJutTIblsoNxE1Zvk=
github.com/passbolt/go-passbolt v0.7.3-0.20260128122347-95e6a762aa5f/go.mod h1:YU35wLUTbqylBQGyEhyI8HjyceLChXDxajTIyyQlVU4=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand All @@ -524,6 +530,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo=
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM=
github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
Expand Down
Loading