getsops / getsops/sops

"error loading config: no matching creation rules found" when using .gitattributes and .sops.yaml

Open
#1,201 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

I'm using SOPS with a .gitattributes and .sops.yaml file.

See content of files below:

# .gitattributes

secret.json filter=sops-json
secret.yaml filter=sops-yaml diff=sops-yaml
secret.yml filter=sops-yaml diff=sops-yaml
# .sops.yaml

creation_rules:
  - age: >-
      age1<REDACTED>,
      age1<REDACTED>
    encrypted_regex: ^(password|metadata|privateKey)$
    path_regex: '(secret.json|test.yaml)'

And the config part from .git/config file:

[filter "sops-json"]
        clean = sops --input-type json --output-type json -e /dev/stdin
        smudge = SOPS_AGE_KEY_FILE=$(pwd)/secrets/age-key.txt sops --input-type json --output-type json -d /dev/stdin
        required = true

I can run the commands for encrypt/decrypt as expected:

sops -e -i secret.json
SOPS_AGE_KEY_FILE=$(pwd)/secrets/age-key.txt sops -d -i secret.json

But when I'm using git to try to commit the files I always get the following error message:

> git status -z -uall
error loading config: no matching creation rules found
error: external filter 'sops --input-type json --output-type json -e /dev/stdin' failed 1
error: external filter 'sops --input-type json --output-type json -e /dev/stdin' failed
fatal: secret.json: clean filter 'sops-json' failed

Maybe someone has an idea what's happening here.

EDIT: When I remove path_regex: '(secret.json|test.yaml)' from the .sops.yaml file it also works with git.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the shown .gitattributes, .sops.yaml, and .git/config entries, then run git status -z -uall and compare the clean-filter invocation with the configured creation rule. Done means the repository's secret.json filter can encrypt the file during Git operations without the “no matching creation rules found” error, while the direct sops commands still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, yaml
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.