Sops swallows YAML comment of each first key:value pair
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
I'm used to extensively describe the contents of my YAML files with comments. But with sops I have the problem, that each comment line, which is located right above of a key-value-pair which stands on top of a hierarchy level, disappears when the yaml file gets encrypted with sops.
-
My environment:
Windows 10
Sops version 3.1.1 -
My document in clear text:
# level 1, pos 1 comment
key1: value
# level 1, pos 2 comment
key2: value
# level 1, pos 3 comment
key3:
# level 2, pos 1 comment
key1: value
# level 2, pos 2 comment
key2: value
- The encrypted document (without sops meta data):
key1: ENC[AES256_GCM,data:UwPZMFg=,iv:xPdFZTYT6sYQn6OCPKeqw00EcqAif9VUuBPz6VEb+vU=,tag:0ciGE608lqo+AcrM63zz+A==,type:str]
#ENC[AES256_GCM,data:bAnAxvnHLi4UoPBALf9S/piTuJg7vko=,iv:kEoo5qeUnO0q9gYdx34kUSryuOfCG0BbTVVVkRVjeq8=,tag:YHhn21H+AQPTzV400+p1Fg==,type:comment]
key2: ENC[AES256_GCM,data:kRPrHrE=,iv:+Q1byOFYvVM5rjzZYOGldCRpWPv7r+Ih4H/xsO+u9FI=,tag:U0u0zq6kJjjPbwSnkLkQYg==,type:str]
#ENC[AES256_GCM,data:zO9n8/aQ2qhyhMWRvcZfB632pUOoEjk=,iv:Ah8H79x3eVJbRtCBwvrzDSoYCzy2WCcuJEJ5B1/EQN0=,tag:dEtOiCgw8sD0eeHn/BkVmA==,type:comment]
#ENC[AES256_GCM,data:9HDfsvGdJQAW9qw6Z7t6x8yTT5LFgCQ=,iv:sALPLPo4IZrKfA2X4VqSPlnSppOfou5IW3/2+IQac3U=,tag:7xzhSZgKKMAkU+DN4Eo6lw==,type:comment]
key3:
key1: ENC[AES256_GCM,data:lHvpmKc=,iv:a5eaxNvCWDAlyXT3yf3c/7sP3WVm7GjwwfKQ14NgGDY=,tag:yCEeeji7+5D2ySlzWCA8RA==,type:str]
#ENC[AES256_GCM,data:CKG9iEaVd63bbRPgylCdz3aiA34pSlc=,iv:Z6blU40o57uJ1juFrmn88vmAPQMCGkBzp2gPsYl7QSQ=,tag:gA6COjpAJkO9oFJom+MLpg==,type:comment]
key2: ENC[AES256_GCM,data:cIQYAL8=,iv:TA+tkLZ9fFcJki4Ngnvvgh8zd+lWn9vTaBm4W2EmR0Q=,tag:+IUxoYRMUjnytkhEJRN2JQ==,type:str]
Please note that the comment lines "# level 1, pos 1 comment" and "# level 2, pos 1 comment" are already missing here in the encrypted document.
- The actual decrypted document:
key1: value
# level 1, pos 2 comment
key2: value
# level 1, pos 3 comment
# level 2, pos 1 comment
key3:
key1: value
# level 2, pos 2 comment
key2: value
Please note the missing comment lines "# level 1, pos 1 comment" and "# level 2, pos 1 comment".
-
The expected decrypted document:
The same document as shown above under 2). -
My workaround:
I'm adding dummy key-value-pairs as the first line on each hierarchy level, like this:
protect: the comment below from sops encryption
# level 1, pos 1 comment
key1: value
# level 1, pos 2 comment
key2: value
# level 1, pos 3 comment
key3:
protect: the comment below from sops encryption
# level 2, pos 1 comment
key1: value
# level 2, pos 2 comment
key2: value
The downside of this workaround is that I'm seeing the "protect: the comment below from sops encryption" key-value-pairs in my configuration target environment (the receiver of the yaml file) which is a bit confusing because these keys have nothing to do with the target environment.
It would be great if someone could fix this issue.
Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce issue 384 with the YAML examples and the reported sops version, then compare the encrypted and decrypted output with the expected document. Trace the YAML comment handling involved in encryption and decryption; done means comments immediately above the first key at each hierarchy level survive the round trip without requiring dummy keys.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, yaml
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100