MAC is not changed when add null values in yaml file

Let do simple file:

some: null
another: some
secret: password

and rules:

creation_rules:
  - encrypted_regex: ^(.*secret)$
    path_regex: (values|values-testing|values-feature)\.yaml$
    pgp: C4C6693EFEF8E77BB7DBA5EA9FA82DCDB36DD584

And yes, we encrypt only sensible data

On encrypted file we got MAC, which protects from add or remove some keys. But, when i'm directly edit encrypted file, and drop key some, which is null, or even add another key, like another_key: null - MAC is not changed.

When i'm adding not null value, mac will mismach, which is OK

I don't like this behavior, because i'm have at least 3 file of values-*.yaml for deploying helm

• values.yaml, with default values
• values-testing.yaml - for testing
• values-production.yaml - for production
  and run it like

helm upgrade --install some . --values values.yaml, values-testing.yaml

And delete or add some keys with null may break deploy.

So, how to i'm to be sure that file isn't changed?

Reproduce the issue with the YAML example, encryption rule, and direct edits to null-valued keys. Trace how SOPS computes and verifies the MAC for YAML data, then confirm that adding or removing null keys is detected without changing the handling of non-null values. Done means the relevant integrity check rejects both kinds of structural edits.