getsops / getsops/sops

Can sops save `input_type` in the output and use them as the default output format?

Open
#697 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

sops encrypts my binary files, and I get the json output by default

$ sops -e my_ssh > my_ssh_encrypted.json

How if I want use the output, I have two options

$ sops -d my_ssh_encrypted.json | jq -r .data
$ sops -d --output-type binary my_ssh_encrypted.json

Before we go, please note that for .yaml and .json input, it's safe to save their output as .yaml and .json too, because sops can detect if the file is encrypted, and if I use sops -d against the encrypted output:

$ sops -e test.yaml > test.enc.yaml
$ sops -d test.enc.yaml > test.dec.yaml
$ diff test.yaml test.dec.yaml  # they are the same

That means, for .yaml and .json file types, I don't need to learn about output before I use them, thing works out of the box.

But for binary output, I have to learn them and decide the best option to use. This is quite confusing to me. If I have to send the output to some developers, this would be a problem for them. And for scripting, it'd add a little work. I don't really like to use sops -d my_ssh_encrypted.json | jq -r .data, because it requires more work dealing with errors from sops.

My suggestion is that, if possible we store the input_type in the sops output, and since then sops detects its best option for output

$ sops -e --output-type binary my_ssh > my_ssh.enc.json
$ < my_ssh.enc.json jq -r .sops.input_type
binary
$ sops -e my_ssh.enc.json
# output binary file here

I'm gonna fire another issue that sops has problem dealing with original data when the wrong output-type is used.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files, tests, or entry points are named. Trace how sops records encrypted input and selects the output type, then check existing JSON and binary encryption/decryption tests. Done means encrypted binary input type is preserved, the default output uses it on decryption or re-encryption, and existing YAML and JSON behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.