Provide an option to reproducibly encrypt without dependency on time
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Right now encryption includes timestamps, so repeatedly encrypting the same secret results in different output. This is a problem if the result of sops goes into kustomize, as it will look as if the secret changed (which it actually didn't).
Would it be possible to add a way to encrypt secrets in a way that always results in the exact same output for the same input?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no file, test, or entry point. Start by tracing where timestamps enter the encryption flow and review the security implications of deterministic output; done means an explicitly scoped option produces identical output for identical input without weakening the encryption guarantees.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100