getsops / getsops/sops

git textconv failures with added age key

Open
#1,968 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/keyservice keyservice/age keyservice/gcpkms
Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

Unclear what is going on using common sopsdiffer, ie. in .gitattributes. This is an issue with adding a second key; which as advertised means I should only need one of them to decrypt in the default use (ie. not using groups).

**/secrets.yaml diff=sopsdiffer

and .git/config:

 grep -A 1 sopsdiffer .git/config
[diff "sopsdiffer"]
    textconv = sops -d

This works fine with the initial GCP KMS key. When I add a second (AGE) key, it fails.

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  age1n6k8uqcpnnn5826k0exxck47f55ltdv4g6yzxml7nq2jtfqvvqdq930Qfv: FAILED
    - | failed to create reader for decrypting sops data key with
      | age: no identity matched any of the recipients

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
fatal: unable to read files to diff

I'v confirmed that I can decrypt fine with either key alone, but what about git and textconv is making it such that a.) it ignores my GCP KMS and b.) requires the AGE?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the .gitattributes entry and the sopsdiffer textconv configuration in .git/config, then reproduce the failure with a file encrypted by both the GCP KMS and AGE keys. Compare the textconv result with direct sops -d using each key alone. Done means explaining why git textconv fails and identifying the configuration or behavior that permits either key to decrypt the diff.

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, git
Domain
devops, security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.