Look for .sops.yaml relative to target

file under use-ability:

this may be rtfm fail on my behalf, but i thought the path checking would find my .sops.yaml config in heirarchy to the target. This assumption explained:

the release: 2.0.10

the setup:

mkdir -p foo/bar/baz/
cp $sops_config_file foo/bar/.sops.yaml
sops foo/bar/baz/secrets.yaml

In this scenario, editor proceeds, but saving it carps:

No master keys were provided, so sops can't encrypt the file.
Press a key to return to the editor, or Ctrl+C to exit.

Should it not find the .sops.yaml starting from the target file's path?

looking closer with strace:

stat("foo/bar/baz/secrets.yaml", 0xc42015eed8) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "foo/bar/baz/secrets.yaml", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat(".sops.yaml", 0xc42015efa8)        = -1 ENOENT (No such file or directory)
stat("../.sops.yaml", 0xc42015f078)     = -1 ENOENT (No such file or directory)
stat("../../.sops.yaml", 0xc42015f148)  = -1 ENOENT (No such file or directory)
stat("../../../.sops.yaml", 0xc42015f218) = -1 ENOENT (No such file or directory)
stat("../../../../.sops.yaml", 0xc42015f2e8) = -1 ENOENT (No such file or directory)
stat("../../../../../.sops.yaml", 0xc42015f3b8) = -1 ENOENT (No such file or directory)
stat("../../../../../../.sops.yaml", 0xc42015f488) = -1 ENOENT (No such file or directory)
stat("../../../../../../../.sops.yaml", 0xc42015f558) = -1 ENOENT (No such file or directory)
stat("../../../../../../../../.sops.yaml", 0xc42015f628) = -1 ENOENT (No such file or directory)
[pattern repeats (up to maxDepth afaict) ]

indeed it is going up from my PWD.

Of course this does work fine if i specify location; eg. sops --config foo/bar/.sops.yaml foo/bar/baz/secrets.yaml. But it does put the burden on the editor to a) know where the config is and .b) be in the target file's dir.

Start by reproducing the reported commands and trace the configuration-discovery entry point used by sops when opening the target file. Compare discovery from the current working directory with discovery relative to foo/bar/baz/secrets.yaml, and verify the result against the explicit --config behavior. Done means the parent foo/bar/.sops.yaml is found without requiring --config.