Documentation
¶
Overview ¶
Package secret implements the writ secret family: SOPS lifecycle operations scoped to registered layers.
Encrypt writes the `<file>.sops` sibling of each argument through the standard pipeline — one `encryption.encrypt_file` unit per file, one graph per containing layer, graphs and traces persisted to the execution store. Every argument must lie inside a registered layer's working tree (ruled 2026-08-10); the containing layer's root is the runtime environment's confinement root, which bounds `.sops.yaml` discovery to the layer and mechanically enforces the root-config shape. Plan: docs/plans/writ-secret-encrypt.md; architecture: docs/architecture/3.5.13-encryption-provider.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExecuteEncrypt ¶
ExecuteEncrypt runs the full encrypt operation.
Contain the arguments in registered layers, plan one graph per layer, and execute them.
Each argument's `<file>.sops` sibling is the destination — an existing sibling refuses before any planning, and the plaintext source is never deleted. Recipients and document format come from the `.sops.yaml` resolved within the containing layer (the confinement root); a file no creation rule governs fails the run with the resolver's error verbatim. Each graph persists via cli.WriteGraph before its run and each run's trace persists via cli.WriteTrace win or lose.
Parameters:
- `ctx`: the cancellation context for planning and execution.
- `cfg`: the resolved encrypt configuration.
Returns:
- `[]*op.Graph`: the plan, under --dry-run; nil when the run executed.
- `error`: non-nil when containment fails, a destination exists, planning fails, or a run fails.
Types ¶
type EncryptConfig ¶
type EncryptConfig struct {
// Files are the plaintext paths to encrypt; each must lie inside a registered layer's working tree.
Files []string
// DryRun serializes the planned graphs to stdout instead of executing them.
DryRun bool
// Verbose narrates per-run receipt paths via [cli.Note].
Verbose bool
}
EncryptConfig carries the resolved settings for one encrypt operation.
Source Files