Allow checksumming of a SOPS encrypted file without decrypting it
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
(I mentioned this to a maintainer at Kubecon EU 2025, I thought I'd file an issue too).
SOPS is great in that the structure of a file is kept after encryption. It makes it easy for a user to see what the outputted file will be without having to decrypt it.
The problem with this is that if someone wants to delete a line, they assume they can do so without using sops to decrypt/encrypt the file. Editing a file without using sops results in the file being invalid.
It would be nice if sops provided a way to checksum/validate the content of a file without the need for a decryption key.
May be sops can store a hash of the encrypted portion of the file in the sops portion, and a new "validate" option added to the CLI allowing for ensuring the file is valid without the decryption key.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing SOPS's encrypted-file structure and the CLI entry points related to file operations. Define how validation can detect changes to encrypted content without a decryption key, and consider the proposed "validate" option and stored hash; done means invalid edits are reported reliably without decrypting the file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100