Use with git-filter config - filter.*.clean and filter.*.smudge

I've been able to integrate sops with git such that files are decrypted/encrypted on checkout/commit. This was achieved like this:

1. Set up git-filter config

   git config --local filter.sops-json.clean "sops --input-type json --output-type json --encrypt /dev/stdin"
   git config --local filter.sops-json.smudge "sops --input-type json --output-type json --decrypt /dev/stdin"
   git config --local filter.sops-json.required true
   

2. Set up .gitattributes to pass files through the filter

   *.json filter=sops-json diff=sops-json
   

3. Have a .sops.yaml configuration with default creation_rules:

   creation_rules:
     - kms: arn:aws:kms:...:...:key/2305235902
   

Checkout and commit work well. Unfortunately the files are always considered changed, I believe because the IV is new on every pass.

Is it necessary for the IV to be ephemeral? Is there a way the random IV could be avoided so this workflow is viable - i.e. so the file isn't always marked as modified by git?

Start by reviewing the git filter.clean and filter.smudge workflow described in the issue, along with how sops encrypts JSON using the configured AWS KMS rule. Determine whether stable encrypted output can support checkout and commit without Git reporting changes while preserving the required security properties. Done means this workflow no longer marks files as modified after a normal checkout and commit, with its behavior documented or tested.