Feature request: encryption (or failure) based on entropy
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
https://github.com/getsops/sops?tab=readme-ov-file#encrypting-only-parts-of-a-file has many ways to partially encrypt files.
One risk is that the regex, prefix, or postfix doesn't account for new secrets, causing them to mistakenly be committed in plaintext.
I'd like for sops to either:
- encrypt data that looks like a secret, regardless of its key
- cause a failure when a secret-looking string is not encrypted (with a corresponding --ignore flag)
https://github.com/Yelp/detect-secrets has some definitions of entropy that could be useful references: Base64HighEntropyString and HexHighEntropyString.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the README section on encrypting only parts of a file and the linked detect-secrets definitions for Base64HighEntropyString and HexHighEntropyString. Clarify the supported entropy rules, the failure behavior, and the corresponding --ignore semantics before identifying implementation and test locations; done means the agreed cases are detected or encrypted without breaking existing partial-encryption behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100