getsops / getsops/sops

Support input/output type overrides (configuration/metadata)

Open
#813 0 comments 25 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

Some applications use parsers that are not as standards-compliant or the sops parser introduces issues on it's own (e.g. #751 ).

To workaround those situations, we can create the file via specific type override to binary:

sops --input-type binary --output-type binary test.ini

However, this type information is not saved into the sops metadata inside the encrypted JSON structure.

This makes automatic handling of these cases in decryption (CI/CD/...) unnecessarily complex and application-specific overrides need to be introduced.

Neither can this be specified via the .sops.yaml for creation_rules.

Furthermore, no option exists to "publish" to a local directory, which currently is the only command that supports the omit_extension option, which could have been used as an alternative by using a command as follows instead of the above:

sops test.ini.enc

...which would automatically make sops to fall-back to binary type and allow easily workaround the issue.

For the cases that I have to handle (e.g. configuration for the mozilla/tokenserver), the ideal situation would be:

  1. support input_type and output_type in creation_rules
  2. additionally store and respect input_type and output_type in sops metadata

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how creation_rules are parsed and how input/output types are handled and stored in the sops metadata. Confirm the existing publish-to-directory and omit_extension behavior, then define tests showing that configured input_type and output_type are saved, respected during decryption, and applied when creating files.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devops, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.