Can sops save `input_type` in the output and use them as the default output format?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
sops encrypts my binary files, and I get the json output by default
$ sops -e my_ssh > my_ssh_encrypted.json
How if I want use the output, I have two options
$ sops -d my_ssh_encrypted.json | jq -r .data
$ sops -d --output-type binary my_ssh_encrypted.json
Before we go, please note that for .yaml and .json input, it's safe to save their output as .yaml and .json too, because sops can detect if the file is encrypted, and if I use sops -d against the encrypted output:
$ sops -e test.yaml > test.enc.yaml
$ sops -d test.enc.yaml > test.dec.yaml
$ diff test.yaml test.dec.yaml # they are the same
That means, for .yaml and .json file types, I don't need to learn about output before I use them, thing works out of the box.
But for binary output, I have to learn them and decide the best option to use. This is quite confusing to me. If I have to send the output to some developers, this would be a problem for them. And for scripting, it'd add a little work. I don't really like to use sops -d my_ssh_encrypted.json | jq -r .data, because it requires more work dealing with errors from sops.
My suggestion is that, if possible we store the input_type in the sops output, and since then sops detects its best option for output
$ sops -e --output-type binary my_ssh > my_ssh.enc.json
$ < my_ssh.enc.json jq -r .sops.input_type
binary
$ sops -e my_ssh.enc.json
# output binary file here
I'm gonna fire another issue that sops has problem dealing with original data when the wrong output-type is used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files, tests, or entry points are named. Trace how sops records encrypted input and selects the output type, then check existing JSON and binary encryption/decryption tests. Done means encrypted binary input type is preserved, the default output uses it on decryption or re-encryption, and existing YAML and JSON behavior remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100