(feat) Use X509 for local encryption similar to PGP
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
It is very nice that we can use PGP for local encryption.
Would it be possible to also support X509 certificates, e.g. those provided by a central corporate PKI?
It should be similar to how GitHub and GitLab handle X509 for git commit signing.
The benefit would be to reuse existing infrastructure and crypto material in corporate settings, being able to comply with internal compliance requirements and additionally revoking certificates of ex-employees centrally.
As with PGP it is also possible to store crypto material on hardware and the OS already provides all the abstractions for that.
Is there a reason why SOPS couldn't or shouldn't support that idea?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by reviewing the existing PGP local-encryption path and clarifying how X509 certificates, hardware-backed keys, and certificate revocation should integrate. Done means an agreed implementation scope with tests covering the supported X509 behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100