encryption

func DecryptContent ¶ added in v0.42.0

func DecryptContent(content []byte, format formats.Format) ([]byte, error)

DecryptContent decrypts SOPS-encrypted content using the supplied format. The format must be the one returned by DetectFormat for the same content.

func DecryptFile ¶

func DecryptFile(path string) ([]byte, error)

DecryptFile decrypts a SOPS-encrypted file at the given path and returns its contents as a byte slice.

func DecryptFileInPlace ¶ added in v0.74.0

func DecryptFileInPlace(path string) (bool, error)

DecryptFileInPlace decrypts a SOPS-encrypted file at the given path and overwrites it with the decrypted content. If the file is encrypted and successfully decrypted, it returns true. If the file is not encrypted, it returns false without modifying the file. The path must be absolute so that it cannot be resolved relative to an unexpected working directory.

func DecryptFilesInDirectory ¶ added in v0.42.0

func DecryptFilesInDirectory(repoPath, dirPath string) ([]string, error)

DecryptFilesInDirectory walks through the specified directory and decrypts all SOPS-encrypted files. A file that cannot be decrypted aborts the walk.

func DecryptFilesInDirectoryTolerant ¶ added in v0.120.0

func DecryptFilesInDirectoryTolerant(repoPath, dirPath string, onFileError func(path string, err error)) ([]string, error)

DecryptFilesInDirectoryTolerant behaves like DecryptFilesInDirectory, except that a file which cannot be decrypted is reported to onFileError and left untouched instead of aborting the walk.

This is for callers that decrypt speculatively, without knowing which files are actually going to be used: a repository may legitimately contain secrets encrypted for a different recipient, and those must not make the whole directory unusable. Callers that know a file is required must still fail on it themselves - reaching a file that is still ciphertext is an error there.

func DecryptToFile ¶ added in v0.119.0

func DecryptToFile(path string, encrypted []byte) (bool, error)

DecryptToFile decrypts encrypted and writes the plaintext to path, without ever placing the ciphertext itself on disk. It reports false and leaves path untouched when encrypted carries no SOPS metadata.

The path must be absolute so that it cannot be resolved relative to an unexpected working directory.

func DetectFormat ¶ added in v0.116.0

func DetectFormat(content []byte, path string) (formats.Format, bool)

DetectFormat returns the SOPS format that parses the content as an encrypted document, and whether such a format was found. The format is derived from the path extension, falling back to probing every supported format when the extension does not identify one. Callers must decrypt with the returned format, as detecting and decrypting with different formats either fails or emits the content in the wrong format.

func IsEncryptedFile ¶

func IsEncryptedFile(path string) (bool, error)

IsEncryptedFile checks if the file at the given path is a SOPS-encrypted file.

func SetupAgeKeyEnvVar ¶

func SetupAgeKeyEnvVar(t *testing.T)

SetupAgeKeyEnvVar sets the SOPS_AGE_KEY environment variable for testing purposes.

func SopsKeyIsSet ¶

func SopsKeyIsSet() bool

SopsKeyIsSet checks if an env var starting with SOPS_ is set. It runs only once and caches the result.