AGE and Google KMS edge case
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Hello,
I think I've found an edge case. On my computer I'm working on several projects, and all of them use sops.
The problem is that not all store their keys in the same place. Some of them use AGE, others use GCP KMS.
But if I try to encrypt saying with AGE using --age param, but having SOPS_GCP_KMS_IDS env variable set, the encrypted file seems to encrypt with both keys in some way. If I look inside the encrypted file I can see that age and gcp_kms have a value.
Do you guys have the same behaviour ?
Specifying the type of encryption explicitly on the command line should override the encryption specified in the environment variable right ?
Thanks !
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the command that uses --age while SOPS_GCP_KMS_IDS is set, then inspect the resulting encrypted file for both age and gcp_kms entries. Compare this with runs where each key source is configured alone; done means the explicit command-line choice has a documented and verified effect on the encrypted output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, go
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100