@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/cpp/feature/secrets/plugins/Httpjson.hpp

@@ -0,0 +1,160 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Httpjson.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Just enough HTTP to ask a vault for a secret.
+//
+// C++ has no HTTP client in its standard library, so this speaks HTTP/1.1
+// over a POSIX socket directly: a request with headers and an optional
+// body, a status line, and a response body delimited by Content-Length, by
+// chunks, or by the connection closing.
+//
+// The framing is in-tree deliberately. libcurl and cpp-httplib would both
+// supply it, and both are HTTP clients rather than cryptographic transport
+// - the one thing the dependency rule permits. So only the TLS half is
+// bound out, and it is bound in Tls.cpp and nowhere else.
+//
+// It is not a general-purpose client: no redirect following, no
+// keep-alive, no proxies, no client certificates. Each of those absences
+// is load-bearing and the reasons are at their call sites.
+//
+// The shared transport of the plugins, and it is UNDER plugins/ for the
+// reason the whole split exists: a chain of built-ins must never link an
+// HTTP client, a TLS library or the socket beneath them.
+//
+// The percent-encoding and the base64 decoder live here rather than beside
+// the SigV4 signer, because most of what needs them signs nothing: Azure,
+// 1Password, Doppler and Infisical build query strings, and AWS and GCP
+// decode payloads. Keeping them with the signer would put SHA-256 in the
+// link map of every plugin that only ever speaks HTTP.
+//
+// A port of rust/src/http.rs.
+
+#ifndef SEKRETO_PLUGINS_HTTPJSON_HPP
+#define SEKRETO_PLUGINS_HTTPJSON_HPP
+
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "../sekreto/Json.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+/// How long any single round-trip may take before the store is treated as
+/// unreachable. Ports carry the same bound.
+extern const int TIMEOUT;
+
+/// How much of a response body will be read before the store is treated as
+/// having answered incoherently. Ports carry the same bound.
+///
+/// Far above anything real - the largest legitimate payload this library
+/// fetches is Doppler's whole-config download, measured in kilobytes. A
+/// bound is needed because the timeout is not one: ten seconds on a
+/// loopback or datacentre link is gigabytes, and the body is accumulated
+/// in memory before it is parsed. This runs on an application's startup
+/// path, so the failure is the application never starting.
+extern const size_t MAXBODY;
+
+/// The environment variable naming extra trust roots, as a PEM bundle.
+/// One cross-port spelling, so a private CA is configured the same way
+/// whichever port an application uses.
+extern const char* const CABUNDLE;
+
+/// Anything a request can run over: a plain socket, or a TLS session
+/// wrapping one. Failure is a thrown SekretoError; `readsome` answers 0
+/// at end of stream.
+class Stream {
+ public:
+  virtual ~Stream() = default;
+  virtual size_t readsome(char* buf, size_t len) = 0;
+  virtual void writeall(const char* buf, size_t len) = 0;
+};
+
+/// What a vault answered: the status code and the raw body.
+struct Response {
+  int status = 0;
+  std::string body;
+};
+
+/// A url without its query string, for a message that must not leak one.
+///
+/// A query here carries the vault path, the secret name or a filter -
+/// `secretPath=/prod/payments/stripe` - which belongs in neither a log nor
+/// a stack trace.
+std::string bareurl(const std::string& url);
+
+/// One HTTP exchange. A non-2xx status is RETURNED, not raised: a 404 from
+/// a vault means "no such secret", which is a miss rather than a failure.
+/// Only a transport failure raises.
+Response httprequest(const std::string& method, const std::string& url,
+                     const Ordered& headers, const std::optional<std::string>& body);
+
+/// Extract every certificate from a PEM bundle, as DER blocks.
+///
+/// In-tree, per the rule: the TLS exception covers transport, and reading
+/// a text file is not transport. No header handling, no attributes, no
+/// other label types, no private keys.
+std::vector<std::string> pemcerts(const std::string& text);
+
+/// One JSON round-trip's result: the status, and the parsed body. An
+/// unparsed body is Null, which every accessor reads as "no value".
+struct Answer {
+  int status = 0;
+  Json body;
+};
+
+/// One JSON round-trip. Network failure is always an error - an
+/// unreachable store is a store that could not answer.
+///
+/// Redirects are never followed: a vault API does not legitimately
+/// redirect, and a followed redirect would carry X-Vault-Token to a host
+/// checkaddr never saw, and could downgrade https to http. Proxies are
+/// never consulted: the GCP and Azure metadata endpoints are not loopback,
+/// and an `http_proxy` in the environment has sent a Vault token in the
+/// clear before. Httpjson.cpp does neither, so there is nothing to switch
+/// off.
+Answer fetchjson(const std::string& method, const std::string& url,
+                 const Ordered& headers = Ordered(),
+                 const std::optional<std::string>& body = std::nullopt);
+
+/// A field's text, or nothing.
+std::optional<std::string> textof(const Json& val);
+
+/// RFC 3986 escaping, stricter than the usual URL encoder: the unreserved
+/// set is exactly `A-Za-z0-9-_.~`, everything else becomes `%XX` with
+/// UPPERCASE hex, byte by byte over UTF-8. `!\'()*` are escaped too, which
+/// is where this differs from the encoders most standard libraries offer.
+std::string uriescape(const std::string& text);
+
+/// Percent-decode, and nothing else: `+` stays `+`, as on the wire, and a
+/// malformed escape is kept literal.
+std::string uridecode(const std::string& text);
+
+/// Decode standard (not URL-safe) base64, STRICTLY.
+///
+/// Whitespace is stripped first; anything outside `A-Za-z0-9+/`, more than
+/// two `=`, or a length that is not a multiple of four is a REFUSAL. A
+/// lenient decoder skips bytes it does not know and hands back plausible
+/// bytes for a corrupted payload - which then get returned as the secret.
+/// Call sites: an AWS SecretBinary, a GCP payload, a PEM body.
+bool unbase64(const std::string& text, std::string& out);
+
+/// Milliseconds since the epoch. The only clock a provider reads, and it
+/// is read for token renewal alone - never for a signature, which takes
+/// its timestamp from its caller.
+double nowms();
+
+/// A renewal time that never comes.
+extern const double NEVER;
+
+/// When a logged-in token must be renewed, from its expiry in seconds (a
+/// JSON number, or a string as Azure IMDS sends it): now + max(seconds -
+/// 60, 1). A missing or zero expiry means never renew, which is also what
+/// a configured token gets.
+double renewtime(const Json& expires);
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Infisical.cpp

@@ -0,0 +1,123 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Infisical.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Infisical.hpp"
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// -------------------------------------------------------------- infisical
+
+/// Infisical.
+///
+/// `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+/// convention is environment-style keys) at a secret path in one
+/// environment of a project. Auth is a token, or a universal-auth (machine
+/// identity) login with clientid/clientsecret.
+class InfisicalProvider : public Provider {
+ public:
+  InfisicalProvider(const std::string& addr, const std::string& token,
+                    const std::string& clientid, const std::string& clientsecret,
+                    const std::string& project, const std::string& environment,
+                    const std::string& path)
+      : addr_(addr),
+        token_(token),
+        clientid_(clientid),
+        clientsecret_(clientsecret),
+        project_(project),
+        environment_(environment),
+        path_(path) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    std::string useaddr = trimslash(first(addr_, "https://app.infisical.com"));
+    checkaddr(useaddr);
+
+    if (project_.empty() || environment_.empty()) {
+      throw SekretoError("sekreto: infisical: no project/environment");
+    }
+
+    if (!livetoken_.has_value() || nowms() >= renewat_) {
+      livetoken_ = login(useaddr);
+    }
+
+    // envkey here takes NO prefix.
+    std::string url = useaddr + "/api/v3/secrets/raw/" + envkey(name) +
+                      "?workspaceId=" + uriescape(project_) +
+                      "&environment=" + uriescape(environment_) +
+                      "&secretPath=" + uriescape(first(path_, "/"));
+
+    Ordered headers;
+    headers.set("authorization", "Bearer " + livetoken_.value_or(""));
+
+    Answer res = fetchjson("GET", url, headers);
+
+    if (404 == res.status) return std::nullopt;
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: infisical error: " + std::to_string(res.status));
+    }
+
+    return textof(res.body.get("secret").get("secretValue"));
+  }
+
+  std::string describe() const override {
+    return "infisical:" + project_ + "/" + environment_;
+  }
+
+ private:
+  std::string login(const std::string& useaddr) {
+    if (!token_.empty()) return token_;
+
+    if (clientid_.empty() || clientsecret_.empty()) {
+      throw SekretoError("sekreto: infisical: no token and no client credentials");
+    }
+
+    Json payload = Json::obj({{"clientId", Json::str(clientid_)},
+                              {"clientSecret", Json::str(clientsecret_)}});
+
+    Ordered headers;
+    headers.set("content-type", "application/json");
+
+    Answer res = fetchjson("POST", useaddr + "/api/v1/auth/universal-auth/login", headers,
+                           Json::stringify(payload));
+
+    std::optional<std::string> got = textof(res.body.get("accessToken"));
+
+    if (200 != res.status || !got.has_value() || got.value().empty()) {
+      throw SekretoError("sekreto: infisical login failed: " + std::to_string(res.status));
+    }
+
+    // camelCase, unlike everyone else's expires_in.
+    renewat_ = renewtime(res.body.get("expiresIn"));
+
+    return got.value();
+  }
+
+  std::string addr_;
+  std::string token_;
+  std::string clientid_;
+  std::string clientsecret_;
+  std::string project_;
+  std::string environment_;
+  std::string path_;
+
+  std::optional<std::string> livetoken_;
+  double renewat_ = NEVER;
+};
+
+}  // namespace
+
+Definition infisical() {
+  return providerplugin("infisical", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<InfisicalProvider>(spec.addr, spec.token, spec.clientid,
+                                               spec.clientsecret, spec.project,
+                                               spec.environment, spec.path);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Infisical.hpp

@@ -0,0 +1,23 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Infisical.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Infisical.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_INFISICAL_HPP
+#define SEKRETO_PLUGINS_INFISICAL_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `infisical` provider kind, as a voxgig/plugin definition.
+Definition infisical();
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Onepassword.cpp

@@ -0,0 +1,125 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Onepassword.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Onepassword.hpp"
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// -------------------------------------------------------------- 1password
+
+/// 1Password, through a Connect server.
+///
+/// The item titled `api.token` (titles keep their dots), in the named
+/// vault. The value is the field with purpose PASSWORD, or the field
+/// labelled `value`. A vault that cannot be found is an ERROR - config
+/// names it, so its absence is a broken store, not a missing secret.
+class OnepasswordProvider : public Provider {
+ public:
+  OnepasswordProvider(const std::string& addr, const std::string& token,
+                      const std::string& vault)
+      : addr_(addr), token_(token), vault_(vault) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    checkname(name);
+
+    std::string useaddr = trimslash(addr_);
+    if (useaddr.empty()) throw SekretoError("sekreto: onepassword: no addr");
+    checkaddr(useaddr);
+
+    if (!vaultid_.has_value()) vaultid_ = resolvevault(useaddr);
+
+    std::string id = vaultid_.value();
+
+    std::string filter = uriescape("title eq \"" + name + "\"");
+    Answer found =
+        fetchjson("GET", useaddr + "/v1/vaults/" + id + "/items?filter=" + filter, auth());
+
+    if (200 != found.status || !found.body.isarr()) {
+      throw SekretoError("sekreto: onepassword error: " + std::to_string(found.status) +
+                         ": finding " + name);
+    }
+
+    if (found.body.arrval.empty()) return std::nullopt;
+
+    std::string itemid = textof(found.body.arrval[0].get("id")).value_or("");
+    Answer item =
+        fetchjson("GET", useaddr + "/v1/vaults/" + id + "/items/" + itemid, auth());
+
+    if (200 != item.status) {
+      throw SekretoError("sekreto: onepassword error: " + std::to_string(item.status) +
+                         ": reading " + name);
+    }
+
+    Json fields = item.body.get("fields");
+    if (!fields.isarr()) return std::nullopt;
+
+    // Two full passes, in order: a password field wins over a field merely
+    // labelled `value`.
+    for (const Json& field : fields.arrval) {
+      std::string purpose;
+      if (field.get("purpose").asstr(purpose) && "PASSWORD" == purpose) {
+        return textof(field.get("value"));
+      }
+    }
+
+    for (const Json& field : fields.arrval) {
+      std::string label;
+      if (field.get("label").asstr(label) && "value" == label) {
+        return textof(field.get("value"));
+      }
+    }
+
+    return std::nullopt;
+  }
+
+  std::string describe() const override { return "onepassword:" + vault_; }
+
+ private:
+  Ordered auth() const {
+    Ordered out;
+    out.set("authorization", "Bearer " + token_);
+    return out;
+  }
+
+  std::string resolvevault(const std::string& useaddr) {
+    if (vault_.empty()) throw SekretoError("sekreto: onepassword: no vault");
+
+    Answer res = fetchjson("GET", useaddr + "/v1/vaults", auth());
+
+    if (200 != res.status || !res.body.isarr()) {
+      throw SekretoError("sekreto: onepassword error: " + std::to_string(res.status) +
+                         ": listing vaults");
+    }
+
+    for (const Json& entry : res.body.arrval) {
+      std::string id = textof(entry.get("id")).value_or("");
+      std::string name = textof(entry.get("name")).value_or("");
+
+      if (vault_ == id || vault_ == name) return id;
+    }
+
+    throw SekretoError("sekreto: onepassword: no vault named " + vault_);
+  }
+
+  std::string addr_;
+  std::string token_;
+  std::string vault_;
+
+  std::optional<std::string> vaultid_;
+};
+
+}  // namespace
+
+Definition onepassword() {
+  return providerplugin("onepassword", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<OnepasswordProvider>(spec.addr, spec.token, spec.vault);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Onepassword.hpp

@@ -0,0 +1,23 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Onepassword.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// 1Password, through a Connect server.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_ONEPASSWORD_HPP
+#define SEKRETO_PLUGINS_ONEPASSWORD_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `onepassword` provider kind, as a voxgig/plugin definition.
+Definition onepassword();
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Proc.cpp

@@ -0,0 +1,223 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Proc.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Proc.hpp"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <cstdlib>
+
+extern char** environ;
+
+namespace sekreto {
+
+namespace {
+
+/// Where a command lives, searched along PATH, so that "this binary is not
+/// installed" stays a `cannot run` error rather than arriving as a
+/// non-zero exit the miss detection would then have to reason about.
+bool findcommand(const std::string& command, const std::string& path, std::string& out) {
+  auto runnable = [](const std::string& candidate) {
+    return 0 == ::access(candidate.c_str(), X_OK);
+  };
+
+  if (std::string::npos != command.find('/')) {
+    if (!runnable(command)) return false;
+    out = command;
+    return true;
+  }
+
+  size_t start = 0;
+
+  while (start <= path.size()) {
+    size_t at = path.find(':', start);
+    std::string dir =
+        (std::string::npos == at) ? path.substr(start) : path.substr(start, at - start);
+
+    std::string candidate = dir.empty() ? command : dir + "/" + command;
+    if (runnable(candidate)) {
+      out = candidate;
+      return true;
+    }
+
+    if (std::string::npos == at) break;
+    start = at + 1;
+  }
+
+  return false;
+}
+
+}  // namespace
+
+/// Run a child to completion and collect both its streams.
+///
+/// The two streams are drained CONCURRENTLY, by polling both pipes.
+/// Reading stdout to EOF and only then reading stderr deadlocks the moment
+/// the child writes more than one pipe buffer (64 KiB on Linux) to stderr:
+/// the parent is blocked on stdout, the child is blocked waiting for room
+/// on stderr, and neither can move. Nothing here sets a timeout, so that
+/// hang is permanent - `get()` simply never returns. secretspec's
+/// diagnostics are box-drawn and reach that size easily.
+///
+/// The child's stdin is the null device rather than a pipe nobody writes
+/// to, so a CLI that reads it - one prompting for a passphrase when its
+/// environment variable is absent - sees EOF and gives up instead of
+/// waiting forever.
+///
+/// The argument list is passed as an array, never through a shell, and no
+/// secret is ever put on a command line where the process table publishes
+/// it.
+Ran runcmd(const std::vector<std::string>& argv,
+           const std::vector<std::string>& environment, const std::string& command) {
+  std::string path;
+  for (const std::string& entry : environment) {
+    if (0 == entry.compare(0, 5, "PATH=")) path = entry.substr(5);
+  }
+
+  std::string binary;
+  if (!findcommand(argv[0], path, binary)) {
+    throw SekretoError("sekreto: cannot run " + command + ": no such file or directory");
+  }
+
+  int outpipe[2];
+  int errpipe[2];
+
+  if (0 != pipe(outpipe)) {
+    throw SekretoError(std::string("sekreto: cannot run ") + command + ": " + strerror(errno));
+  }
+  if (0 != pipe(errpipe)) {
+    ::close(outpipe[0]);
+    ::close(outpipe[1]);
+    throw SekretoError(std::string("sekreto: cannot run ") + command + ": " + strerror(errno));
+  }
+
+  std::vector<char*> args;
+  for (const std::string& arg : argv) {
+    args.push_back(const_cast<char*>(arg.c_str()));
+  }
+  args.push_back(nullptr);
+
+  std::vector<char*> envp;
+  for (const std::string& entry : environment) {
+    envp.push_back(const_cast<char*>(entry.c_str()));
+  }
+  envp.push_back(nullptr);
+
+  pid_t child = fork();
+
+  if (0 > child) {
+    ::close(outpipe[0]);
+    ::close(outpipe[1]);
+    ::close(errpipe[0]);
+    ::close(errpipe[1]);
+    throw SekretoError(std::string("sekreto: cannot run ") + command + ": " + strerror(errno));
+  }
+
+  if (0 == child) {
+    int null = ::open("/dev/null", O_RDONLY);
+    if (0 <= null) {
+      dup2(null, STDIN_FILENO);
+      ::close(null);
+    }
+
+    dup2(outpipe[1], STDOUT_FILENO);
+    dup2(errpipe[1], STDERR_FILENO);
+
+    ::close(outpipe[0]);
+    ::close(outpipe[1]);
+    ::close(errpipe[0]);
+    ::close(errpipe[1]);
+
+    execve(binary.c_str(), args.data(), envp.data());
+    _exit(127);
+  }
+
+  ::close(outpipe[1]);
+  ::close(errpipe[1]);
+
+  Ran ran;
+  std::string errtext;
+
+  pollfd waiting[2];
+  waiting[0].fd = outpipe[0];
+  waiting[1].fd = errpipe[0];
+
+  while (0 <= waiting[0].fd || 0 <= waiting[1].fd) {
+    waiting[0].events = POLLIN;
+    waiting[1].events = POLLIN;
+    waiting[0].revents = 0;
+    waiting[1].revents = 0;
+
+    if (0 > poll(waiting, 2, -1)) {
+      if (EINTR == errno) continue;
+      break;
+    }
+
+    for (int side = 0; side < 2; side++) {
+      if (0 > waiting[side].fd || 0 == waiting[side].revents) continue;
+
+      char buf[4096];
+      ssize_t got = ::read(waiting[side].fd, buf, sizeof(buf));
+
+      if (0 < got) {
+        if (0 == side) {
+          ran.out.append(buf, static_cast<size_t>(got));
+        } else {
+          errtext.append(buf, static_cast<size_t>(got));
+        }
+        continue;
+      }
+
+      if (0 > got && EINTR == errno) continue;
+
+      ::close(waiting[side].fd);
+      waiting[side].fd = -1;
+    }
+  }
+
+  if (0 <= waiting[0].fd) ::close(waiting[0].fd);
+  if (0 <= waiting[1].fd) ::close(waiting[1].fd);
+
+  int state = 0;
+  while (0 > waitpid(child, &state, 0)) {
+    if (EINTR != errno) break;
+  }
+
+  ran.status = WIFEXITED(state) ? WEXITSTATUS(state) : 1;
+  ran.why = trimtext(errtext);
+
+  return ran;
+}
+
+/// The process environment as `KEY=value` entries.
+std::vector<std::string> processenv() {
+  std::vector<std::string> out;
+
+  for (char** step = environ; nullptr != *step; step++) {
+    out.push_back(*step);
+  }
+
+  return out;
+}
+
+void setenvvar(std::vector<std::string>& environment, const std::string& key,
+               const std::string& value) {
+  std::string prefix = key + "=";
+
+  for (std::string& entry : environment) {
+    if (0 == entry.compare(0, prefix.size(), prefix)) {
+      entry = prefix + value;
+      return;
+    }
+  }
+
+  environment.push_back(prefix + value);
+}
+
+}  // namespace sekreto