encryption

func DecryptContent ¶ added in v0.42.0

func DecryptContent(content []byte, format formats.Format) ([]byte, error)

DecryptContent decrypts SOPS-encrypted content using the supplied format. The format must be the one returned by DetectFormat for the same content.

func DecryptFile ¶

func DecryptFile(path string) ([]byte, error)

DecryptFile decrypts a SOPS-encrypted file at the given path and returns its contents as a byte slice.

func DecryptFileInPlace ¶ added in v0.74.0

func DecryptFileInPlace(path string) (bool, error)

DecryptFileInPlace decrypts a SOPS-encrypted file at the given path and overwrites it with the decrypted content. If the file is encrypted and successfully decrypted, it returns true. If the file is not encrypted, it returns false without modifying the file. The path must be absolute so that it cannot be resolved relative to an unexpected working directory.

func DecryptFilesInDirectory ¶ added in v0.42.0

func DecryptFilesInDirectory(repoPath, dirPath string) ([]string, error)

DecryptFilesInDirectory walks through the specified directory and decrypts all SOPS-encrypted files.

func DecryptToFile ¶ added in v0.119.0

func DecryptToFile(path string, encrypted []byte) (bool, error)

DecryptToFile decrypts encrypted and writes the plaintext to path, without ever placing the ciphertext itself on disk. It reports false and leaves path untouched when encrypted carries no SOPS metadata.

The path must be absolute so that it cannot be resolved relative to an unexpected working directory.

func DetectFormat ¶ added in v0.116.0

func DetectFormat(content []byte, path string) (formats.Format, bool)

DetectFormat returns the SOPS format that parses the content as an encrypted document, and whether such a format was found. The format is derived from the path extension, falling back to probing every supported format when the extension does not identify one. Callers must decrypt with the returned format, as detecting and decrypting with different formats either fails or emits the content in the wrong format.

func IsEncryptedFile ¶

func IsEncryptedFile(path string) (bool, error)

IsEncryptedFile checks if the file at the given path is a SOPS-encrypted file.

func SetupAgeKeyEnvVar ¶

func SetupAgeKeyEnvVar(t *testing.T)

SetupAgeKeyEnvVar sets the SOPS_AGE_KEY environment variable for testing purposes.

func SopsKeyIsSet ¶

func SopsKeyIsSet() bool

SopsKeyIsSet checks if an env var starting with SOPS_ is set. It runs only once and caches the result.