git textconv failures with added age key
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Unclear what is going on using common sopsdiffer, ie. in .gitattributes. This is an issue with adding a second key; which as advertised means I should only need one of them to decrypt in the default use (ie. not using groups).
**/secrets.yaml diff=sopsdiffer
and .git/config:
grep -A 1 sopsdiffer .git/config
[diff "sopsdiffer"]
textconv = sops -d
This works fine with the initial GCP KMS key. When I add a second (AGE) key, it fails.
Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
age1n6k8uqcpnnn5826k0exxck47f55ltdv4g6yzxml7nq2jtfqvvqdq930Qfv: FAILED
- | failed to create reader for decrypting sops data key with
| age: no identity matched any of the recipients
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
fatal: unable to read files to diff
I'v confirmed that I can decrypt fine with either key alone, but what about git and textconv is making it such that a.) it ignores my GCP KMS and b.) requires the AGE?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the .gitattributes entry and the sopsdiffer textconv configuration in .git/config, then reproduce the failure with a file encrypted by both the GCP KMS and AGE keys. Compare the textconv result with direct sops -d using each key alone. Done means explaining why git textconv fails and identifying the configuration or behavior that permits either key to decrypt the diff.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, git
- Domain
- devops, security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100