getsops / getsops/sops

Delay when encrypting file

Open
#402 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

Hi Adrian,

when I try to encrypt a new file with PGP only on a host that has no internet connectivity (firewall is configured to drop web traffic) it takes ca. 30 seconds until the EDITOR opens the new file.

An strace of the sops command and the corresponding tcpdumps show connections to amazon hosts via tcp443.

Here's the configuration (variables unset)

$ echo $SOPS_AZURE_KEYVAULT_URL

$ echo $SOPS_KMS_ARN

$ echo $SOPS_GCP_KMS_IDS

$ echo $SOPS_PGP_FP
C2789216BD1B5A847F26E8366D9F858539385789

$ cat .sops.yaml
creation_rules:
- pgp: 'C2789216BD1B5A847F26E8366D9F858539385789'

$ cat /etc/debian_version
9.5

Sops was installed from the .deb file.

How can i persuade sops not to do any network connections ?

Here's the trace:

$ strace sops -p C2789216BD1B5A847F26E8366D9F858539385789 foo

brk(NULL)                               = 0x170c000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d079f000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=26888, ...}) = 0
mmap(NULL, 26888, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fc6d0798000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=135440, ...}) = 0
mmap(NULL, 2212936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc6d0362000
mprotect(0x7fc6d037a000, 2093056, PROT_NONE) = 0
mmap(0x7fc6d0579000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7fc6d0579000
mmap(0x7fc6d057b000, 13384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc6d057b000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\4\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1689360, ...}) = 0
mmap(NULL, 3795296, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc6cffc3000
mprotect(0x7fc6d0158000, 2097152, PROT_NONE) = 0
mmap(0x7fc6d0358000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x195000) = 0x7fc6d0358000
mmap(0x7fc6d035e000, 14688, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc6d035e000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d0796000
arch_prctl(ARCH_SET_FS, 0x7fc6d0796700) = 0
mprotect(0x7fc6d0358000, 16384, PROT_READ) = 0
mprotect(0x7fc6d0579000, 4096, PROT_READ) = 0
mprotect(0x7fc6d07a2000, 4096, PROT_READ) = 0
munmap(0x7fc6d0798000, 26888)           = 0
set_tid_address(0x7fc6d07969d0)         = 32611
set_robust_list(0x7fc6d07969e0, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7fc6d0367bd0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fc6d0367c60, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
brk(NULL)                               = 0x170c000
brk(0x172d000)                          = 0x172d000
sched_getaffinity(0, 8192, [0])         = 64
mmap(0xc000000000, 65536, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc000000000
munmap(0xc000000000, 65536)             = 0
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d0756000
mmap(0xc420000000, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc420000000
mmap(0xc41fff8000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc41fff8000
mmap(0xc000000000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc000000000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d0746000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d0736000
rt_sigprocmask(SIG_SETMASK, NULL, [], 8) = 0
sigaltstack(NULL, {ss_sp=NULL, ss_flags=SS_DISABLE, ss_size=0}) = 0
sigaltstack({ss_sp=0xc420002000, ss_flags=0, ss_size=32768}, NULL) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
gettid()                                = 32611
rt_sigaction(SIGHUP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGINT, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGQUIT, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGILL, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGILL, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGTRAP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTRAP, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGABRT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGABRT, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGBUS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGFPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGFPE, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGUSR1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGUSR2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGUSR2, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGPIPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGPIPE, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGALRM, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTERM, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGSTKFLT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGSTKFLT, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGCHLD, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGURG, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGURG, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGXCPU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGXCPU, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGXFSZ, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGXFSZ, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGVTALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGVTALRM, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGPROF, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGPROF, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGWINCH, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGWINCH, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGIO, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGIO, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGPWR, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGPWR, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGSYS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGSYS, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRTMIN, NULL, {sa_handler=0x7fc6d0367bd0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, 8) = 0
rt_sigaction(SIGRTMIN, NULL, {sa_handler=0x7fc6d0367bd0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, 8) = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7fc6d0367bd0, sa_mask=[], sa_flags=SA_RESTORER|SA_STACK|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, NULL, {sa_handler=0x7fc6d0367c60, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, 8) = 0
rt_sigaction(SIGRT_1, NULL, {sa_handler=0x7fc6d0367c60, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fc6d0367c60, sa_mask=[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_2, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_3, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_3, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_4, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_4, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_5, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_5, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_6, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_6, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_7, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_7, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_8, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_8, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_9, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_9, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_10, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_10, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_11, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_11, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_12, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_12, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_13, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_13, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_14, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_14, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_15, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_15, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_16, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_16, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_17, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_17, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_18, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_18, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_19, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_19, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_20, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_20, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_21, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_21, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_22, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_22, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_23, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_23, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_24, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_24, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_25, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_25, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_26, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_26, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_27, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_27, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_28, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_28, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_29, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_29, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_30, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_30, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_31, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_31, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigaction(SIGRT_32, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGRT_32, {sa_handler=0x45b560, sa_mask=~[], sa_flags=SA_RESTORER|SA_STACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc6d03730c0}, NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0
mmap(NULL, 8392704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc6cf7c2000
mprotect(0x7fc6cf7c2000, 4096, PROT_NONE) = 0
clone(child_stack=0x7fc6cffc1ff0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7fc6cffc29d0, tls=0x7fc6cffc2700, child_tidptr=0x7fc6cffc29d0) = 32612
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0
mmap(NULL, 8392704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc6cefc1000
mprotect(0x7fc6cefc1000, 4096, PROT_NONE) = 0
clone(child_stack=0x7fc6cf7c0ff0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7fc6cf7c19d0, tls=0x7fc6cf7c1700, child_tidptr=0x7fc6cf7c19d0) = 32613
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
futex(0x1153750, FUTEX_WAIT, 0, NULL)   = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/usr/local/bin/sops", 128) = 19
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc6d06f6000
openat(AT_FDCWD, "/proc/sys/net/core/somaxconn", O_RDONLY|O_CLOEXEC) = 3
epoll_create1(EPOLL_CLOEXEC)            = 4
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=3496980336, u64=140491877232496}}) = 0
fcntl(3, F_GETFL)                       = 0x8000 (flags O_RDONLY|O_LARGEFILE)
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
read(3, "128\n", 4096)                  = 4
read(3, "", 4092)                       = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc42004dc8c) = 0
close(3)                                = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
openat(AT_FDCWD, "/etc/sops/audit.yaml", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
mmap(0xc420100000, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc420100000
mmap(0xc41fff0000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xc41fff0000
stat("sops", 0xc4201a0ac8)              = -1 ENOENT (No such file or directory)
futex(0x1153750, FUTEX_WAIT, 0, NULL)   = 0
epoll_wait(4, [], 128, 0)               = 0
futex(0x1153750, FUTEX_WAIT, 0, NULL)   = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("<dns server ip>")}, 16) = 0
epoll_ctl(4, EPOLL_CTL_ADD, 5, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=3496980144, u64=140491877232304}}) = 0
getsockname(5, {sa_family=AF_INET, sin_port=htons(58744), sin_addr=inet_addr("<my ip>")}, [112->16]) = 0
getpeername(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("<dns server ip>")}, [112->16]) = 0
write(5, "\35!\1\0\0\1\0\0\0\0\0\0\3gpg\7mozilla\3org\0\0\1\0"..., 33) = 33
read(5, 0xc4201c6600, 512)              = -1 EAGAIN (Resource temporarily unavailable)
epoll_wait(4, [{EPOLLOUT, {u32=3496980336, u64=140491877232496}}, {EPOLLOUT, {u32=3496980144, u64=140491877232304}}], 128, 0) = 2
epoll_wait(4, [{EPOLLIN|EPOLLOUT, {u32=3496980336, u64=140491877232496}}], 128, -1) = 1
futex(0x1152d38, FUTEX_WAKE, 1)         = 1
read(3, "l\314\201\200\0\1\0\1\0\1\0\0\3gpg\7mozilla\3org\0\0\34\0"..., 512) = 185
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc42003cb14) = 0
close(3)                                = 0
epoll_wait(4, [{EPOLLIN|EPOLLOUT, {u32=3496980144, u64=140491877232304}}], 128, 0) = 1
read(5, "\35!\201\200\0\1\0\3\0\0\0\0\3gpg\7mozilla\3org\0\0\1\0"..., 512) = 138
epoll_ctl(4, EPOLL_CTL_DEL, 5, 0xc42003db14) = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("54.165.22.40")}, 16) = 0
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=3496980144, u64=140491877232304}}) = 0
getsockname(3, {sa_family=AF_INET, sin_port=htons(42664), sin_addr=inet_addr("<my ip>")}, [112->16]) = 0
getpeername(3, {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("54.165.22.40")}, [112->16]) = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc42003b9ac) = 0
close(3)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("52.5.218.108")}, 16) = 0
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=3496980144, u64=140491877232304}}) = 0
getsockname(3, {sa_family=AF_INET, sin_port=htons(42086), sin_addr=inet_addr("<my ip>")}, [112->16]) = 0
getpeername(3, {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("52.5.218.108")}, [112->16]) = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc42003b9ac) = 0
close(3)                                = 0
futex(0x1152740, FUTEX_WAKE, 1)         = 1
socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("54.165.22.40")}, 16) = -1 EINPROGRESS (Operation now in progress)
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=3496980144, u64=140491877232304}}) = 0
epoll_wait(4, [], 128, 0)               = 0
epoll_wait(4,

Here there's ca. 30 s of waiting, then the file opens in vi, then after closing it, the rest is as follows:

epoll_wait(4, [{EPOLLIN, {u32=3496979952, u64=140491877232112}}], 128, -1) = 1
futex(0x1152d38, FUTEX_WAKE, 1)         = 1
read(6, "-----BEGIN PGP MESSAGE-----\n\nhQE"..., 512) = 512
read(6, "GUzDmEoSTgGx6Q==\n=XJvE\n-----END "..., 1024) = 49
read(6, 0xc4201c8e31, 975)              = -1 EAGAIN (Resource temporarily unavailable)
epoll_wait(4, [], 128, 0)               = 0
epoll_wait(4, [{EPOLLHUP, {u32=3496979568, u64=140491877231728}}], 128, -1) = 1
futex(0x1152d38, FUTEX_WAKE, 1)         = 1
read(8, "", 512)                        = 0
epoll_ctl(4, EPOLL_CTL_DEL, 8, 0xc42002adf4) = 0
close(8)                                = 0
epoll_wait(4, [], 128, 0)               = 0
epoll_wait(4, [{EPOLLHUP, {u32=3496979952, u64=140491877232112}}], 128, -1) = 1
read(6, "", 975)                        = 0
epoll_ctl(4, EPOLL_CTL_DEL, 6, 0xc42002bdf4) = 0
close(6)                                = 0
epoll_wait(4, [], 128, 0)               = 0
epoll_wait(4, File has not changed, exiting.
 <unfinished ...>)        = ?
+++ exited with 200 +++

tcpdump during that command:

tcpdump -i ens192 -n host 52.5.218.108

09:31:22.070578 IP <my ip>.52108 > 52.5.218.108.443: Flags [S], seq 2604724289, win 29200, options [mss 1460,sackOK,TS val 879445312 ecr 0,nop,wscale 7], length 0
09:31:24.086580 IP <my ip>.52108 > 52.5.218.108.443: Flags [S], seq 2604724289, win 29200, options [mss 1460,sackOK,TS val 879445816 ecr 0,nop,wscale 7], length 0
09:31:28.214590 IP <my ip>.52108 > 52.5.218.108.443: Flags [S], seq 2604724289, win 29200, options [mss 1460,sackOK,TS val 879446848 ecr 0,nop,wscale 7], length 0

The IP resolves to amazon cloud territory:

$ dig -x 52.5.218.108

;; ANSWER SECTION:
108.218.5.52.in-addr.arpa. 300  IN      PTR     ec2-52-5-218-108.compute-1.amazonaws.com.

Also, the version command takes ca. 30s due to timing out:

$ sops -v

[warning] failed to retrieve latest version from upstream: Get https://raw.githubusercontent.com/mozilla/sops/master/cmd/sops/version.go: dial tcp 151.101.112.133:443: i/o timeout

[warning] failed to compare current version with latest: Version string empty
 (latest)

Thanks & best regards

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the PGP-only command from the issue with the shown .sops.yaml on a host without internet access. Use strace and tcpdump to identify why the sops command connects to Amazon hosts; done means PGP-only encryption opens without network connections or the reported delay.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.