Skip to content
rolle
Esc
↑↓navigate↵open⌘Jpreview
On this page

Security model

Where secrets live and what never touches disk.

Long-lived secrets stay in the keychain

Identity Center refresh tokens, Azure token caches, and IAM user access keys live in the OS keychain (macOS Keychain, Windows Credential Manager, Secret Service on Linux) under the service name rolle. Large tokens are split into chunks to fit platform limits.

rolle caches short-lived credentials until they expire

A started session caches its temporary credentials in credentials/ under the cache directory (see Storage) with owner-only permissions. credential_process reads that cache. Each entry carries its expiry. The app renews or removes entries. An IAM user without MFA has no temporary credentials: its access key stays in the keychain and never enters the cache.

rolle writes only its own AWS profiles

rolle marks each profile it writes with a rolle_session key. It refuses to touch a section that holds aws_access_key_id or other credential keys. rolle takes over a plain [default] section that only sets region or output, and restores it on stop.

No telemetry

rolle sends no analytics, no crash reports, and no usage data. It has no account. It connects only to:

  • The cloud providers you sign in to: Identity Center portals, AWS OIDC and STS, Microsoft Entra and Azure Resource Manager, Google APIs, and the consoles that Open console opens in your browser.
  • github.com: the update manifest at launch and every six hours while Settings → General → Automatic updates is on, the update download you confirm, and the issue form that Report a problem opens in your browser.

The support bundle is a file in your Downloads folder. You choose whether to attach it to an issue.

Four ways to check this:

  • Host log. Run rolle --debug or set ROLLE_DEBUG=1. Every HTTP client in the process, the cloud SDKs included, uses one transport. It logs the method and the host of each request and nothing else. Verbose logging in the desktop app does the same, and the support bundle carries the last lines.
  • Capability analysis. Capslock reads the Go call graph and reports the capabilities each package reaches through its full dependency tree: network, process execution, file access. capslock.json in the repository holds that set. The capabilities CI job fails a pull request that changes it, so a dependency that starts to use the network shows as a diff in that file.
  • OpenSSF Scorecard. A weekly independent rating of the repository: pinned actions, branch protection, signed releases, token permissions, static analysis, dependency updates.
  • Provenance and reproducible builds, below.

Enterprise networks

rolle verifies TLS against the OS trust store: the macOS Keychain, the Windows certificate store, or the Linux system bundle. A corporate root installed there, as TLS inspection products require, works with no rolle configuration. For a root that is not in the OS store, point Settings → Advanced → Extra CA bundle at a PEM file. HTTPS proxy routes every request through one proxy when the app cannot see your shell’s HTTPS_PROXY. Both apply to the CLI and the app, including the AWS SDK calls.

Signed updates

An Ed25519 key signs every release manifest, and the desktop app verifies the signature before it installs an update. A Developer ID certificate signs the macOS builds, and Apple notarizes them. checksums.txt lists every release asset, CLI archives and desktop packages alike, and carries a keyless Sigstore signature from the release workflow. Install shows the check.

Build provenance

The release workflow writes a SLSA build provenance attestation for every file in checksums.txt. It names the repository, the commit, and the workflow run that built the file, and GitHub signs it with the workflow’s identity. Check a download with the GitHub CLI:

gh attestation verify rolle.dmg --repo nateships/rolle

A pass means the file comes from .github/workflows/release.yml in this repository at the commit it names.

Reproducible builds

The CLI archives are built with -trimpath and without cgo. The same source, toolchain, and flags give a byte-identical binary. To check a release: clone the tag, use the Go version that go version -m rolle prints for the released binary, and build.

git clone --branch v<version> https://github.com/nateships/rolle && cd rolle
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath \
  -ldflags "-s -w -X github.com/nateships/rolle/internal/version.Version=<version>" \
  -o rolle-rebuilt ./cmd/rolle
sha256sum rolle-rebuilt rolle   # rolle from the release archive

The two hashes match. The desktop packages are signed, and on macOS notarized, so they do not compare byte for byte. For those, the provenance attestation is the link to the source.

Reset

rolle reset and Settings → Advanced → Reset remove the workspace, every keychain entry, the credential cache, and the AWS profiles rolle wrote.

Was this page helpful?