Repository navigation
Conversation
* add `age-identity:<source>` recipients for SOPS_AGE_KEY, SOPS_AGE_KEY_FILE, SOPS_AGE_KEY_CMD and sops/age/keys.txt * add encryption support for above sources * tag loaded identities with their source * update help text and docs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Aram Akhavan <1147328+kaysond@users.noreply.github.com>
Author
|
@felixfontein can I trouble you for a quick review and workflows approval? If you're happy with the approach I'll submit a PR for the docs too |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2313
Summary
This PR allows users to encrypt files using an age identity (already a feature in age). This is probably most useful for plugins, which can potentially do more sophisticated/secure encryption given the identity contents as opposed to the recipient only. One example is a plugin encrypting with an ssh agent, where having access to the identity, and thus the agent, means you can have a unique salt per file to preventing exposure of the agent + identity file from exposing every secret (see above issue for more details).
Details
One thing that has to be decided is if/how to specify which identity to use. I opted to do this with a pseudo-recipient string "age-identity:" followed by a source. The source is one of the existing ways of specifying age identities for decryption - "SOPS_AGE_KEY", "SOPS_AGE_KEY_FILE", "SOPS_AGE_KEY_CMD" env vars, or the literal "sops/age/keys.txt" for the default file location.
It's not strictly necessary to specify the identity - we could just use all identities that are loaded via the above methods, but I thought specifying would be useful for two reasons: 1. it lets users choose among the methods for a particular encryption if they have multiple configured, and 2. it serves as a reminder for users if they have multiple identities and forgot which they used.
Alternatives considered:
I'm happy to change the implementation.
AI Disclosure
I used Claude Code (Opus 5.5) to help work on the PR, including updating/adding tests. I wrote the help strings and this PR. I've already reviewed everything myself and tested it with the ssh agent plugin and an x25519 identity (instead of recipient).