sops

package
v0.0.0-...-f761342 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 6, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Overview

Package sops integrates opencenter with SOPS and age for repository secret encryption, decryption, key management, configuration generation, and Git hooks.

This package owns process and filesystem behavior that is reusable without a terminal. Prompts, command output, and command-specific policy remain in cmd. Overlay file selection is centralized in overlayFilesToEncrypt; its exact order is observable through failures and tests, so callers must not reorder or broaden the list without explicit behavior coverage.

Similar-looking key loaders and file replacement paths currently preserve different empty-input, whitespace, mode, durability, and rollback semantics. Keep those paths local until characterization tests establish a shared policy.

Index

Constants

View Source 
const (
	// KeyringService is the service name for OS keyring storage
	KeyringService = "opencenter"

	// KeyringAccountSuffix is the suffix for keyring account names
	KeyringAccountSuffix = "-age-key"
)

Variables

This section is empty.

Functions

func CheckSOPSInstallation 

func CheckSOPSInstallation(ctx context.Context) error

CheckSOPSInstallation checks if SOPS is properly installed

func NewKeyManager 

func NewKeyManager(keyDir string) crypto.KeyManager

NewKeyManager creates a new key manager using the crypto utilities

func SetupSOPSEnvironment 

func SetupSOPSEnvironment(keyManager crypto.KeyManager, keyName string) error

SetupSOPSEnvironment sets up the SOPS environment for a specific key

func ValidateSOPSKeyAccess 

func ValidateSOPSKeyAccess(keyManager crypto.KeyManager, keyName string) error

ValidateSOPSKeyAccess validates that a key can be used for SOPS operations

Types

type AgeKeyPair 

type AgeKeyPair = crypto.AgeKeyPair

AgeKeyPair is an alias for crypto.AgeKeyPair for backward compatibility

type CommitConfig 

type CommitConfig struct {
	Message     string
	Author      string
	Email       string
	SignCommits bool
	DryRun      bool
	Verbose     bool
}

CommitConfig represents Git commit configuration

type DefaultEncryptor 

type DefaultEncryptor struct {
	// contains filtered or unexported fields
}

DefaultEncryptor implements Encryptor interface

func NewDefaultEncryptor 

func NewDefaultEncryptor(ageKeys, pgpKeys []string) *DefaultEncryptor

NewDefaultEncryptor creates a new SOPS encryptor

func (*DefaultEncryptor) DecryptFile 

func (e *DefaultEncryptor) DecryptFile(ctx context.Context, filePath string, outputPath string) error

DecryptFile decrypts a SOPS-encrypted file

func (*DefaultEncryptor) DecryptFilesParallel 

func (e *DefaultEncryptor) DecryptFilesParallel(ctx context.Context, filePaths []string, outputDir string, maxConcurrency int) error

DecryptFilesParallel decrypts multiple SOPS-encrypted files in parallel

func (*DefaultEncryptor) EditEncryptedFile 

func (e *DefaultEncryptor) EditEncryptedFile(ctx context.Context, filePath string) error

EditEncryptedFile opens an encrypted file for editing with SOPS

func (*DefaultEncryptor) EncryptFile 

func (e *DefaultEncryptor) EncryptFile(ctx context.Context, filePath string, config EncryptionConfig) error

EncryptFile encrypts a single file with SOPS

func (*DefaultEncryptor) EncryptFiles 

func (e *DefaultEncryptor) EncryptFiles(ctx context.Context, filePaths []string, config EncryptionConfig) error

EncryptFiles encrypts multiple files with SOPS sequentially

func (*DefaultEncryptor) EncryptFilesParallel 

func (e *DefaultEncryptor) EncryptFilesParallel(ctx context.Context, filePaths []string, config EncryptionConfig, maxConcurrency int) error

EncryptFilesParallel encrypts multiple files with SOPS in parallel

func (*DefaultEncryptor) GetEncryptedContent 

func (e *DefaultEncryptor) GetEncryptedContent(filePath string) (string, error)

GetEncryptedContent returns the encrypted content of a file without decrypting

func (*DefaultEncryptor) IsFileEncrypted 

func (e *DefaultEncryptor) IsFileEncrypted(filePath string) (bool, error)

IsFileEncrypted checks if a file is encrypted with SOPS

func (*DefaultEncryptor) RotateKeys 

func (e *DefaultEncryptor) RotateKeys(ctx context.Context, filePath string, newAgeKeys, newPGPKeys []string) error

RotateKeys rotates SOPS encryption keys

type DefaultSOPSManager 

type DefaultSOPSManager struct {
	// contains filtered or unexported fields
}

DefaultSOPSManager implements SOPSManager interface

func NewDefaultSOPSManager 

func NewDefaultSOPSManager(keyManager crypto.KeyManager, encryptor Encryptor, logger *slog.Logger) *DefaultSOPSManager

NewDefaultSOPSManager creates a new SOPS manager with dependency injection

func NewSOPSManager 

func NewSOPSManager() *DefaultSOPSManager

NewSOPSManager creates a new SOPS manager with default implementations

func (*DefaultSOPSManager) CheckSOPSVersion 

func (m *DefaultSOPSManager) CheckSOPSVersion(ctx context.Context) (string, error)

CheckSOPSVersion checks if SOPS is available and returns version info

func (*DefaultSOPSManager) CreateSOPSConfig 

func (m *DefaultSOPSManager) CreateSOPSConfig(overlayPath string, cfg *v2.Config) error

CreateSOPSConfig creates a .sops.yaml configuration file

func (*DefaultSOPSManager) CreateSampleEncryptedSecrets 

func (m *DefaultSOPSManager) CreateSampleEncryptedSecrets(ctx context.Context, repoPath string, ageKey string) error

CreateSampleEncryptedSecrets creates sample encrypted secrets in the repository

func (*DefaultSOPSManager) EncryptOverlayFiles 

func (m *DefaultSOPSManager) EncryptOverlayFiles(ctx context.Context, overlayPath string, cfg *v2.Config) error

EncryptOverlayFiles encrypts sensitive files in an overlay directory

func (*DefaultSOPSManager) EncryptRepositorySecrets 

func (m *DefaultSOPSManager) EncryptRepositorySecrets(ctx context.Context, repoPath string, ageKey string) error

EncryptRepositorySecrets encrypts all sample secrets in a repository

func (*DefaultSOPSManager) GetEncryptor 

func (m *DefaultSOPSManager) GetEncryptor() Encryptor

GetEncryptor returns the encryptor

func (*DefaultSOPSManager) GetKeyManager 

func (m *DefaultSOPSManager) GetKeyManager() crypto.KeyManager

GetKeyManager returns the key manager

func (*DefaultSOPSManager) ValidateEncryption 

func (m *DefaultSOPSManager) ValidateEncryption(overlayPath string, cfg *v2.Config) error

ValidateEncryption validates that files are properly encrypted

type EncryptionConfig 

type EncryptionConfig struct {
	AgeKeys    []string
	PGPKeys    []string
	ConfigFile string
	InPlace    bool
	DryRun     bool
	Verbose    bool
}

EncryptionConfig represents SOPS encryption configuration

type Encryptor 

type Encryptor interface {
	EncryptFile(ctx context.Context, filePath string, config EncryptionConfig) error
	EncryptFiles(ctx context.Context, filePaths []string, config EncryptionConfig) error
	DecryptFile(ctx context.Context, filePath string, outputPath string) error
	IsFileEncrypted(filePath string) (bool, error)
	RotateKeys(ctx context.Context, filePath string, newAgeKeys, newPGPKeys []string) error
	GetEncryptedContent(filePath string) (string, error)
	EditEncryptedFile(ctx context.Context, filePath string) error
}

Encryptor interface for SOPS encryption/decryption operations

type EnhancedKeyManager 

type EnhancedKeyManager struct {
	// contains filtered or unexported fields
}

EnhancedKeyManager implements enhanced key management with OS keyring support

func NewEnhancedKeyManager 

func NewEnhancedKeyManager(keyDir string, logger *slog.Logger) *EnhancedKeyManager

NewEnhancedKeyManager creates a new enhanced key manager with OS keyring support

func (*EnhancedKeyManager) BackupKey 

func (m *EnhancedKeyManager) BackupKey(cluster string, passphrase string) ([]byte, error)

BackupKey exports an Age key to an encrypted backup file

func (*EnhancedKeyManager) DeleteKey 

func (m *EnhancedKeyManager) DeleteKey(cluster string) error

DeleteKey deletes an Age key from both keyring and file storage

func (*EnhancedKeyManager) ExportKeyToBase64 

func (m *EnhancedKeyManager) ExportKeyToBase64(cluster string, passphrase string) (string, error)

ExportKeyToBase64 exports a key backup as base64-encoded string

func (*EnhancedKeyManager) GenerateAdditionalKey 

func (m *EnhancedKeyManager) GenerateAdditionalKey(cluster string, keyIndex int) (*crypto.AgeKeyPair, error)

GenerateAdditionalKey generates an additional Age key for multi-key SOPS configuration

func (*EnhancedKeyManager) GenerateKey 

func (m *EnhancedKeyManager) GenerateKey(cluster string) (*crypto.AgeKeyPair, error)

GenerateKey generates a new Age key for a cluster

func (*EnhancedKeyManager) GenerateSOPSConfig 

func (m *EnhancedKeyManager) GenerateSOPSConfig(cluster string) (string, error)

GenerateSOPSConfig generates a .sops.yaml configuration with multi-key support

func (*EnhancedKeyManager) ImportKeyFromBase64 

func (m *EnhancedKeyManager) ImportKeyFromBase64(cluster string, backupBase64 string, passphrase string) error

ImportKeyFromBase64 imports a key from base64-encoded backup string

func (*EnhancedKeyManager) IsKeyringAvailable 

func (m *EnhancedKeyManager) IsKeyringAvailable() bool

IsKeyringAvailable checks if OS keyring is available on the current platform

func (*EnhancedKeyManager) ListClusterKeys 

func (m *EnhancedKeyManager) ListClusterKeys(cluster string) ([]*crypto.AgeKeyPair, error)

ListClusterKeys lists all keys for a specific cluster (primary and additional)

func (*EnhancedKeyManager) ListKeys 

func (m *EnhancedKeyManager) ListKeys() ([]string, error)

ListKeys lists all available Age keys from both keyring and file storage

func (*EnhancedKeyManager) MigrateToKeyring 

func (m *EnhancedKeyManager) MigrateToKeyring(cluster string) error

MigrateToKeyring migrates existing file-based keys to OS keyring

func (*EnhancedKeyManager) RestoreKey 

func (m *EnhancedKeyManager) RestoreKey(cluster string, backup []byte, passphrase string) error

RestoreKey restores an Age key from an encrypted backup

func (*EnhancedKeyManager) RetrieveKey 

func (m *EnhancedKeyManager) RetrieveKey(cluster string) (*crypto.AgeKeyPair, error)

RetrieveKey retrieves an Age key from the OS keyring or file storage

func (*EnhancedKeyManager) RotateClusterKeys 

func (m *EnhancedKeyManager) RotateClusterKeys(cluster string) error

RotateClusterKeys rotates all keys for a cluster by generating new keys

func (*EnhancedKeyManager) SetActor 

func (m *EnhancedKeyManager) SetActor(actor string)

SetActor sets the actor (user/system) performing key operations

func (*EnhancedKeyManager) SetAuditLogger 

func (m *EnhancedKeyManager) SetAuditLogger(logger interface{})

SetAuditLogger sets the audit logger for logging key operations

func (*EnhancedKeyManager) SetFallbackToFile 

func (m *EnhancedKeyManager) SetFallbackToFile(enabled bool)

SetFallbackToFile enables or disables fallback to file storage

func (*EnhancedKeyManager) SetKeyringEnabled 

func (m *EnhancedKeyManager) SetKeyringEnabled(enabled bool)

SetKeyringEnabled enables or disables OS keyring usage

func (*EnhancedKeyManager) StoreKey 

func (m *EnhancedKeyManager) StoreKey(cluster string, key *crypto.AgeKeyPair) error

StoreKey stores an Age key in the OS keyring

type GitIntegrator 

type GitIntegrator struct {
	// contains filtered or unexported fields
}

GitIntegrator handles Git operations with SOPS-encrypted files

func NewGitIntegrator 

func NewGitIntegrator(repoPath string, encryptor Encryptor) *GitIntegrator

NewGitIntegrator creates a new Git integrator

func (*GitIntegrator) CheckForChanges 

func (g *GitIntegrator) CheckForChanges(ctx context.Context) (bool, error)

CheckForChanges checks if there are uncommitted changes

func (*GitIntegrator) CloneRepository 

func (g *GitIntegrator) CloneRepository(ctx context.Context, repoURL, targetDir, branch string) error

CloneRepository clones a Git repository

func (*GitIntegrator) CommitEncryptedFiles 

func (g *GitIntegrator) CommitEncryptedFiles(ctx context.Context, cfg *v2.Config, commitCfg CommitConfig) error

CommitEncryptedFiles commits SOPS-encrypted files to Git

func (*GitIntegrator) ConfigureSOPSDiff 

func (g *GitIntegrator) ConfigureSOPSDiff(ctx context.Context) error

ConfigureSOPSDiff configures Git to use SOPS for diffing encrypted files

func (*GitIntegrator) CreateCommitMessage 

func (g *GitIntegrator) CreateCommitMessage(cfg *v2.Config, operation string) string

CreateCommitMessage generates a commit message for overlay changes

func (*GitIntegrator) CreateGitIgnore 

func (g *GitIntegrator) CreateGitIgnore() error

CreateGitIgnore creates a .gitignore file with SOPS-specific entries

func (*GitIntegrator) GetCurrentBranch 

func (g *GitIntegrator) GetCurrentBranch(ctx context.Context) (string, error)

GetCurrentBranch returns the current Git branch

func (*GitIntegrator) GetLastCommitHash 

func (g *GitIntegrator) GetLastCommitHash(ctx context.Context) (string, error)

GetLastCommitHash returns the hash of the last commit

func (*GitIntegrator) GetRemoteURL 

func (g *GitIntegrator) GetRemoteURL(ctx context.Context, remote string) (string, error)

GetRemoteURL returns the remote URL for the repository

func (*GitIntegrator) PushChanges 

func (g *GitIntegrator) PushChanges(ctx context.Context, remote, branch string) error

PushChanges pushes committed changes to remote repository

func (*GitIntegrator) SetupGitAttributes 

func (g *GitIntegrator) SetupGitAttributes() error

SetupGitAttributes creates a .gitattributes file for SOPS files

func (*GitIntegrator) ValidateGitConfig 

func (g *GitIntegrator) ValidateGitConfig(ctx context.Context) error

ValidateGitConfig validates Git configuration for SOPS operations

func (*GitIntegrator) ValidateRepository 

func (g *GitIntegrator) ValidateRepository() error

ValidateRepository validates that the directory is a valid Git repository

type KeyInfo 

type KeyInfo = crypto.KeyInfo

KeyInfo is an alias for crypto.KeyInfo for backward compatibility

type KeyManager 

type KeyManager = crypto.KeyManager

KeyManager is an alias for crypto.KeyManager for backward compatibility

type SOPSManager 

type SOPSManager interface {
	// Key management operations
	GetKeyManager() crypto.KeyManager

	// Encryption operations
	GetEncryptor() Encryptor

	// High-level operations
	EncryptOverlayFiles(ctx context.Context, overlayPath string, cfg *v2.Config) error
	CreateSOPSConfig(overlayPath string, cfg *v2.Config) error
	ValidateEncryption(overlayPath string, cfg *v2.Config) error
	CreateSampleEncryptedSecrets(ctx context.Context, repoPath string, ageKey string) error
	EncryptRepositorySecrets(ctx context.Context, repoPath string, ageKey string) error
	CheckSOPSVersion(ctx context.Context) (string, error)
}

SOPSManager interface for managing SOPS operations

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.