Documentation
¶
Overview ¶
Package sops provides SOPS decryption and encryption detection over the getsops library. Decryption is config-free — the encrypted file carries its own recipients and is unlocked with ambient identities — so the client holds no configuration. (Encryption discovery and signing live elsewhere: encryption per-file via getsops.)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsEncrypted ¶
IsEncrypted reports whether data contains SOPS metadata or age armor.
Parameters:
- data: content to inspect
Returns:
- bool: true if the data appears to be SOPS-encrypted
func IsSecretFile ¶
IsSecretFile reports whether a filename indicates a SOPS-encrypted file.
Parameters:
- filename: filename to check (path or basename)
Returns:
- bool: true if the filename ends with .sops, .sops.yaml, or .sops.json
Types ¶
type Client ¶
type Client struct{}
Client provides SOPS operations over getsops. It carries no configuration: decryption needs none.
func (*Client) Decrypt ¶
Decrypt decrypts SOPS-encrypted data. Format is inferred from sourcePath extension. Plaintext data passes through unchanged.
Parameters:
- data: encrypted (or plaintext) content
- sourcePath: original file path used to determine SOPS format
Returns:
- []byte: decrypted content (or unchanged plaintext)
- error: decryption error
type Encrypter ¶
type Encrypter struct {
// contains filtered or unexported fields
}
Encrypter encrypts cleartext for the SOPS recipients resolved from the `.sops.yaml` governing a target path.
It owns the per-session config-discovery cache — `visited` memoizes the upward [locate] walk per start directory, so a subtree's chain is computed once. One Encrypter is held per encryption provider, which is itself per-RuntimeEnvironment; concurrent encryption runs under gather, so the cache is mutex-guarded. getsops does all crypto: this type only locates the config and drives the getsops encrypt flow.
func NewEncrypter ¶
func NewEncrypter() *Encrypter
NewEncrypter returns an Encrypter with an empty discovery cache.
Returns:
- `*Encrypter`: a ready encrypter.
func (*Encrypter) Encrypt ¶
Encrypt encrypts data for the SOPS recipients governing sourcePath and returns the encrypted SOPS document.
Discovery walks up from sourcePath's directory to rootDir, then the XDG fallback, to locate the `.sops.yaml` chain (via [locate], cached). getsops resolves the first config whose creation rule matches sourcePath into recipients, and the document is emitted in the format inferred from sourcePath.
Parameters:
- `data`: the cleartext to encrypt.
- `sourcePath`: the target file's path; selects the creation rule and the document format.
- `rootDir`: the upper boundary for the `.sops.yaml` walk (the RuntimeEnvironment Root directory).
Returns:
- `[]byte`: the encrypted SOPS document.
- `error`: discovery, resolution, or encryption failure.
Source Files