sops

package

v1.325.0 Latest Latest Go to latest Published: Aug 14, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Package sops implements a SOPS-encrypted, age-backed vault.

This section is empty.

This section is empty.

func DecryptFile(src, keyPath string) ([]byte, error)

DecryptFile decrypts a SOPS-encrypted file and returns its plaintext.

func EncryptFile(src, target, recipient string) error

EncryptFile encrypts src with SOPS and age and writes ciphertext to target.

func ResolveAgeKey(explicitKeyFile, fallbackDir string) (recipient string, keyPath string, err error)

ResolveAgeKey resolves an existing age key or generates one in fallbackDir.

func ValidateConfiguration(ageKey string) error

ValidateConfiguration ensures an age key is available for SOPS operations.

type Options struct {
	Path         string
	AgeKey       string
	WithComments bool
	FileIO       util.FileIO
}

Options configures a SOPS-encrypted file-backed vault.

type SopsVault struct {
	// contains filtered or unexported fields
}

SopsVault stores vault YAML encrypted with SOPS and age.

func New(opts Options) (*SopsVault, error)

New creates a SOPS-encrypted file-backed vault.

func NewLazy(opts Options) *SopsVault

NewLazy creates a vault whose path and key configuration are validated on first use.

func (v *SopsVault) Load() (*files.InstallVault, error)

Load reads, validates, decrypts, and parses the configured vault file.

func (v *SopsVault) LoadOrCreate() (*files.InstallVault, error)

LoadOrCreate loads the vault or returns an empty vault if the file does not exist.

func (v *SopsVault) Save(data *files.InstallVault) error

Save encrypts and writes vault data to the configured path.