ENV files should be valid dotenv and pass dotenv-linter validation

It would be very nice if dotenv files encrypted by sops would also pass validation, e.g. with dotenv-linter which is also part of GitHub super-linter.

Currently this doesn't work, even if the input is valid:

$ cat blub.env
BLUB=ENC[AES256_GCM,data:mILi0g==,iv:bgIa1PFf+MzICbDgdrwHfHfoPw/sSKC0ajuQ09GlZcg=,tag:GIOe+5N+/y5x18pc9sgKog==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_lastmodified=2021-01-14T09:46:43Z
sops_pgp__list_0__map_created_at=2021-01-14T09:38:15Z
sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcDMAzDpqLNTWD6gAQwAD0wldR5+4KqMPITWhnFrIdXAunWFptziQHaj0XG7bf5v\nQ/4Vhk+Khve24fpgRCTwpAvck8XW7ZVeI7OGZwO/2/5DQub+aclvUv5gMVSX8pZG\nIjbHLASccVtTBAYZcq8Ku0GAEJHHVjwYfobGiagLPHLhiRYgOcuSSPrJD+Rar+xm\neNL47a07uWpKU2B6pOLzpR1zIPvWEpMs3gW4FQQMJAT0iIsS8t7hrsszZ0NoFy8B\nnQI7BItlvU6Avw8Z/e4hd1jnfR6UuvUSulj4gOfkK6wfOqVQe+3H3xXXF+MsYpKF\nnSExo4vAfbTqJo1vJbdVliiZ+8z2u4PDDMYKjcs7rekJE7FhyHM5gpkD2oYGf9d5\ncp1jZKoya/QG5o6+ZqTrfyXWDzYWi39nldI96oBMR4cClph0g2tFWXwpuzVbBfuu\nuHaRoiSsxy89gjJAeK5L5FK24EZ0r0xPFL60H0CJy/gpf5VtvdtdreXjxNzgOu60\nqJxKpWW0g5SIK6vLhT2B0uAB5B6ZKomhAckZx0BuTYpDu07hcKjgOuAz4VB34GLi\ntKNvP+AR5fvbK6tbUSH+FhjfccCWfOhvJdh5h4HgpyxtIwb0dIRQ4LHkmg2WGKCI\n5MbDRe8LtKZW6uJ91OwF4Wy3AA==\n=3SQm\n-----END PGP MESSAGE-----
sops_version=3.6.1
sops_mac=ENC[AES256_GCM,data:L9WP145EGJy8I61R6X59b+6Cj7E7I4fiaPDix03uINLSh7SrdHIpVxcjK8Bzro23jXHil1x3oSY2eeRWP6UDn4iIt21/VCrm/e7vp8U96/64JSxxztoG09oMOpMQuqfHbsMQ8UULyfzcUnaT3z4kRI11QdQa8g+stVPdAVL0g+0=,iv:ncQEtEzt5Xu72ZlTMcWSz0lmh7mc4xzviYCxBI1UcqE=,tag:lJF5HpT8wX594zGxMHNmyQ==,type:str]
sops_pgp__list_0__map_fp=E20ABEDF09DCC7B7449189225EB19057B4DBE301

$ dotenv-linter blub.env
Checking blub.env
blub.env:2 LowercaseKey: The sops_unencrypted_suffix key should be in uppercase
blub.env:3 LowercaseKey: The sops_lastmodified key should be in uppercase
blub.env:3 UnorderedKey: The sops_lastmodified key should go before the sops_unencrypted_suffix key
blub.env:4 LowercaseKey: The sops_pgp__list_0__map_created_at key should be in uppercase
blub.env:4 UnorderedKey: The sops_pgp__list_0__map_created_at key should go before the sops_unencrypted_suffix key
blub.env:5 LowercaseKey: The sops_pgp__list_0__map_enc key should be in uppercase
blub.env:5 UnorderedKey: The sops_pgp__list_0__map_enc key should go before the sops_unencrypted_suffix key
blub.env:6 LowercaseKey: The sops_version key should be in uppercase
blub.env:7 LowercaseKey: The sops_mac key should be in uppercase
blub.env:7 UnorderedKey: The sops_mac key should go before the sops_pgp__list_0__map_created_at key
blub.env:8 LowercaseKey: The sops_pgp__list_0__map_fp key should be in uppercase
blub.env:8 UnorderedKey: The sops_pgp__list_0__map_fp key should go before the sops_unencrypted_suffix key

Found 12 problems

The problems I see are

1. sops key ordering: should be alphabetical
2. sops key naming: should be all capps

The actual problem is maybe less that sops produce invalid dotenv files (according to the linter), but also that all my other ENV files are valid but I can only disable/enable dotenv-linter in super-linter globally and not per-file. It would therefore be nice to fix the one remaining tool in my toolchain that produces invalid dotenv files.

Start with the example blub.env and run dotenv-linter blub.env to reproduce the reported casing and ordering warnings. Review how sops-generated dotenv files are produced, then consider the work complete when the resulting file passes dotenv-linter while preserving the encrypted values and metadata.