feat: add age plugin support #1641

brianmcgee · 2024-10-02T11:08:10Z

Another attempt at #1465 without bringing in so much code from age.

Instead, I created FiloSottile/age#591 upstream to expose PluginTerminalUI.

TODO

~~- [ ] update go.mod once FiloSottile/age#591 is merged~~

felixfontein · 2024-10-02T17:17:41Z

Thank you very much for this! I've marked it as a draft (we can put it back to ready once the upstream change is merged).

loa · 2024-10-03T06:33:34Z

go.mod

@@ -134,3 +134,5 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
+
+replace filippo.io/age => github.com/brianmcgee/age v0.0.0-20241002093043-152b6edfe56a


I guess this slipped in (or required to get the tests to pass), thanks for pushing this forward @brianmcgee !

That's what the todo is about above. Once upstream merges, I can remove that.

age/keysource.go

Ma27 · 2024-11-20T21:51:39Z

Using this, works fine for sops -d. However if I specify public keys for creation_rules in a .sops.yaml, sops will break when editing these files since parseRecipients doesn't know what to do with age-plugin-yubikey pubkeys.

I fixed this with the following patch on top:

From 64e77bd60f8ebc8a0a5c7f8602a6f5855c892fd3 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 20 Nov 2024 22:44:49 +0100
Subject: [PATCH] age/keysource: parse recipients using plugin system

Otherwise I get

    failed to parse input as Bech32-encoded age public key: malformed recipient "age1yubikey1...": invalid type "age1yubikey"

for `sops secrets/.../secrets.sops.yaml` in a directory with a
`.sops.yaml` that has creation rules with age1yubikey1* keys in its
creation rules.
---
 age/keysource.go | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/age/keysource.go b/age/keysource.go
index f04e4aff8..a9051c926 100644
--- a/age/keysource.go
+++ b/age/keysource.go
@@ -304,12 +304,21 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 
 // parseRecipient attempts to parse a string containing an encoded age public
 // key.
-func parseRecipient(recipient string) (*age.X25519Recipient, error) {
-	parsedRecipient, err := age.ParseX25519Recipient(recipient)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+func parseRecipient(recipient string) (age.Recipient, error) {
+	switch {
+	case strings.HasPrefix(recipient, "age1") && strings.Count(recipient, "1") > 1:
+		parsedRecipient, err := plugin.NewRecipient(recipient, tui.PluginTerminalUI)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as age key from age plugin: %w", err)
+		}
+		return parsedRecipient, nil
+	default:
+		parsedRecipient, err := age.ParseX25519Recipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+		}
+		return parsedRecipient, nil
 	}
-	return parsedRecipient, nil
 }
 
 // parseIdentities attempts to parse the string set of encoded age identities.
-- 
2.47.0

Feel free to pick this to your branch @brianmcgee :)

brianmcgee · 2024-11-21T09:04:19Z

@Ma27 applied the patch, thanks 👍

visualphoenix · 2024-12-11T17:11:15Z

+1 would be great to have this in sops

felixfontein · 2025-02-20T20:38:05Z

Since FiloSottile/age#591 doesn't seem to move forward at all (there isn't even any comment by the age maintainer, not even something like "this willl never happen" or "I still have to think about this"), so I think we have to proceed differently.

I just merged #1692, which actually vendors some of the code from https://github.com/FiloSottile/age/pull/591/files (basically ReadSecret with WithTerminal inlined). I think we should proceed similarly here, by modifying the tui.go added there to basically contain https://github.com/FiloSottile/age/blob/266c0940916da6bfa310fdd23156fbd70f9d90a0/tui/tui.go (resp. its original form).

I'd like to get #1400 resolved before merging this one, which can also use the readPassphrase function added by #1692. That way all three PRs (#1692, #1400, and this one) can share the same code vendored from age.

WDYT?

visualphoenix · 2025-02-20T23:47:06Z

I dream of a day I could use https://github.com/Foxboron/ssh-tpm-agent with sops…

Foxboron · 2025-02-21T08:31:48Z

@felixfontein An alternative is for sops to use the filippo/plugin branch as it contains the required changes for this to work.

I've moved this over in age-plugin-tpm and considering the low velocity of the project I suspect it should be fine.

EDIT: Reading more of the code. I don't think it solves anything :/

brianmcgee · 2025-02-21T10:23:40Z

Since FiloSottile/age#591 doesn't seem to move forward at all (there isn't even any comment by the age maintainer, not even something like "this willl never happen" or "I still have to think about this"), so I think we have to proceed differently.

Agreed. I think the approach you laid out seems sensible.

felixfontein · 2025-02-24T18:59:52Z

I've merged the other PR (as well as some dependabot PRs).

brianmcgee · 2025-02-25T07:36:02Z

Ok cool, I'll have a look at rebasing this one today.

brianmcgee · 2025-02-25T12:29:43Z

@felixfontein I manually tested this with the age-plugin-fido2-hmac plugin.

Ramblurr · 2025-02-25T14:43:55Z

I'd like to test this PR too! Is this feature added transparently to the user? Or are there flags I need to pass to make it work?

brianmcgee · 2025-02-25T14:49:02Z

I'd like to test this PR too! Is this feature added transparently to the user? Or are there flags I need to pass to make it work?

It should be relatively transparent, you just need to pass an appropriate age key per the plugin you're using.

Here's an example of how I'm using it with age-plugin-fido2-hmac:

❯ SOPS_AGE_KEY=$(age-plugin-fido2-hmac -m) sops test.yml

My .sops.yaml file contains a key entry of the form age1fido2-hmac1xxxxxxxxxxx.

age/tui.go

felixfontein · 2025-02-25T21:15:47Z

I'll take a closer look at this during the next days. The issues reported by CodeQL can likely be ignored (I think they're the same as in #1692, I'll have to take a cloesr look).

age/tui.go

Signed-off-by: Brian McGee <brian@bmcgee.ie>

felixfontein · 2025-02-27T20:11:16Z

@Kranzes @Mic92 @brianmcgee and everyone else involved - thank you very much for your contributions!

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [getsops/sops](https://github.com/getsops/sops) | minor | `v3.9.4` -> `v3.10.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>getsops/sops (getsops/sops)</summary> ### [`v3.10.2`](https://github.com/getsops/sops/releases/tag/v3.10.2) [Compare Source](getsops/sops@v3.10.1...v3.10.2) #### Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64 ### Move the binary in to your PATH mv sops-v3.10.2.linux.amd64 /usr/local/bin/sops ### Make the binary executable chmod +x /usr/local/bin/sops ``` ##### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.sig ### Verify the checksums file cosign verify-blob sops-v3.10.2.checksums.txt \ --certificate sops-v3.10.2.checksums.pem \ --signature sops-v3.10.2.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell ### Verify the binary using the checksums file sha256sum -c sops-v3.10.2.checksums.txt --ignore-missing ``` ##### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.2.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell ### Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.intoto.jsonl ### Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.2.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.2 ``` #### Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ##### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.2` - `ghcr.io/getsops/sops:v3.10.2-alpine` ##### Quay.io - `quay.io/getsops/sops:v3.10.2` - `quay.io/getsops/sops:v3.10.2-alpine` ##### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.2 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ##### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). #### Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. #### What's Changed - build(deps): Bump the go group with 13 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1834 - Use latest 1.24 Go version for release build by [@hiddeco](https://github.com/hiddeco) in getsops/sops#1836 - Remove reserved keyword check from YAML store's `LoadPlainFile()` by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1829 - build(deps): Bump the go group with 9 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1839 - build(deps): Bump github/codeql-action from 3.28.13 to 3.28.15 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1840 - Release 3.10.2 release by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1841 **Full Changelog**: getsops/sops@v3.10.1...v3.10.2 ### [`v3.10.1`](https://github.com/getsops/sops/releases/tag/v3.10.1) [Compare Source](getsops/sops@v3.10.0...v3.10.1) #### Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.linux.amd64 ### Move the binary in to your PATH mv sops-v3.10.1.linux.amd64 /usr/local/bin/sops ### Make the binary executable chmod +x /usr/local/bin/sops ``` ##### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.sig ### Verify the checksums file cosign verify-blob sops-v3.10.1.checksums.txt \ --certificate sops-v3.10.1.checksums.pem \ --signature sops-v3.10.1.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell ### Verify the binary using the checksums file sha256sum -c sops-v3.10.1.checksums.txt --ignore-missing ``` ##### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.1.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell ### Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.intoto.jsonl ### Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.1.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.1 ``` #### Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ##### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.1` - `ghcr.io/getsops/sops:v3.10.1-alpine` ##### Quay.io - `quay.io/getsops/sops:v3.10.1` - `quay.io/getsops/sops:v3.10.1-alpine` ##### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.1 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ##### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). #### Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. #### What's Changed - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1826 - Release 3.10.1 by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1827 **Full Changelog**: getsops/sops@v3.10.0...v3.10.1 ### [`v3.10.0`](https://github.com/getsops/sops/releases/tag/v3.10.0) [Compare Source](getsops/sops@v3.9.4...v3.10.0) #### Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.linux.amd64 ### Move the binary in to your PATH mv sops-v3.10.0.linux.amd64 /usr/local/bin/sops ### Make the binary executable chmod +x /usr/local/bin/sops ``` ##### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.sig ### Verify the checksums file cosign verify-blob sops-v3.10.0.checksums.txt \ --certificate sops-v3.10.0.checksums.pem \ --signature sops-v3.10.0.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell ### Verify the binary using the checksums file sha256sum -c sops-v3.10.0.checksums.txt --ignore-missing ``` ##### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.0.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell ### Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.intoto.jsonl ### Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.0.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.0 ``` #### Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ##### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.0` - `ghcr.io/getsops/sops:v3.10.0-alpine` ##### Quay.io - `quay.io/getsops/sops:v3.10.0` - `quay.io/getsops/sops:v3.10.0-alpine` ##### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.0 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ##### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). #### Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. #### What's Changed - build(deps): Bump alpine from 3.18 to 3.21 in /.release in the docker group across 1 directory by [@dependabot](https://github.com/dependabot) in getsops/sops#1700 - Convert changelog to MarkDown by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1741 - build(deps): Bump the go group with 7 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1743 - build(deps): Bump the go group with 9 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1745 - build(deps): Bump the rust group in /functional-tests with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1744 - build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1746 - build(deps): Bump the go group with 12 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1751 - build(deps): Bump the ci group with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1750 - Add --input-type option for filestatus subcommand by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1601 - Use SOPS_EDITOR before EDITOR by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1611 - Allow users to disable version check via environment variable by [@nicklasfrahm](https://github.com/nicklasfrahm) in getsops/sops#1684 - add duplicate section support to ini store by [@reindlt](https://github.com/reindlt) in getsops/sops#1452 - stores: test for duplicate keys, reserve keyword (yaml only now) by [@holiman](https://github.com/holiman) in getsops/sops#1203 - Add same process option for exec-env by [@ricmatsui](https://github.com/ricmatsui) in getsops/sops#880 - outputs: add trailing newline at the end of JSON files by [@duthils](https://github.com/duthils) in getsops/sops#1476 - set subcommand: add --idempotent flag that will not write the file if no change happened by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1754 - Encrypt and decrypt time.Time objects by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1759 - build(deps): Bump the go group with 8 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1763 - build(deps): Bump tempfile from 3.16.0 to 3.17.0 in /functional-tests in the rust group by [@dependabot](https://github.com/dependabot) in getsops/sops#1762 - build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1761 - fix(docs): typo in README.rst by [@Paredev](https://github.com/Paredev) in getsops/sops#1765 - Add SSH support for age by [@haoqixu](https://github.com/haoqixu) in getsops/sops#1692 - make sure that tests do not pick keys.txt from user's HOME dir by [@tomaszduda23](https://github.com/tomaszduda23) in getsops/sops#1766 - support for age identity with passphrase by [@tomaszduda23](https://github.com/tomaszduda23) in getsops/sops#1400 - build(deps): Bump the rust group in /functional-tests with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1768 - build(deps): Bump the go group with 12 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1769 - build(deps): Bump the ci group with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1770 - build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 by [@dependabot](https://github.com/dependabot) in getsops/sops#1773 - feat: add age plugin support by [@brianmcgee](https://github.com/brianmcgee) in getsops/sops#1641 - Check GnuPG decryption result for non-empty size by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1776 - vendored age code: consolidate passphrase reading functionality by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1775 - Allow to encrypt and decrypt from stdin by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1690 - build(deps): Bump the go group with 11 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1784 - build(deps): Bump the ci group with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1782 - build(deps): Bump serde_json from 1.0.139 to 1.0.140 in /functional-tests in the rust group; bump Rust to 1.85.0 by [@dependabot](https://github.com/dependabot) in getsops/sops#1783 - build(deps): Bump the go group with 13 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1797 - build(deps): Bump the rust group in /functional-tests with 3 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1796 - build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1795 - build(deps): Bump the go group with 6 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1802 - build(deps): Bump tempfile from 3.18.0 to 3.19.0 in /functional-tests in the rust group by [@dependabot](https://github.com/dependabot) in getsops/sops#1800 - build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1801 - build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by [@dependabot](https://github.com/dependabot) in getsops/sops#1806 - goreleaser: add windows arm64 by [@duthils](https://github.com/duthils) in getsops/sops#1791 - Add a way to set sops config location via envvar by [@sledzikowy](https://github.com/sledzikowy) in getsops/sops#1701 - build(deps): Bump the go group with 3 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1809 - build(deps): Bump the ci group with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1808 - build(deps): Bump tempfile from 3.19.0 to 3.19.1 in /functional-tests in the rust group by [@dependabot](https://github.com/dependabot) in getsops/sops#1807 - Support --config option in publish subcommand by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1779 - Fix caching of Metadata.DataKey by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1781 - Lint by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1780 - updatekeys subcommand: rename GroupQuorum to ShamirThreshold by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1631 - If --filename-override is specified, convert it to an absolute path same as regular filenames by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1793 - Add support for `oauth2.TokenSource` in GCP KMS by [@matheuscscp](https://github.com/matheuscscp) in getsops/sops#1794 - Added SOPS_AGE_KEY_CMD option to age, fixes [#1323](getsops/sops#1323) by [@danilobuerger](https://github.com/danilobuerger) in getsops/sops#1811 - chore: omitempty metadata to reduce the size of stored config by [@cgetzen](https://github.com/cgetzen) in getsops/sops#1571 - Improve Shamir Secret Sharing code by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1813 - Update all dependencies by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1814 - Run 'gofmt -w' on all .go files by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1817 - Add option to explicitly check for the latest version; deprecate current default of always doing that unless disabled by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1816 - Build using Go 1.24 and drop support for 1.22 by [@hiddeco](https://github.com/hiddeco) in getsops/sops#1819 - Support `GOOGLE_OAUTH_ACCESS_TOKEN` for Google Cloud Platform by [@marensofier](https://github.com/marensofier) in getsops/sops#1578 - Warn about `.sops.yml` files found while searching for `.sops.yaml` by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1820 - Release 3.10.0 by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1815 - Added support for multiarch windows release binaries by [@sabre1041](https://github.com/sabre1041) in getsops/sops#1823 #### New Contributors - [@reindlt](https://github.com/reindlt) made their first contribution in getsops/sops#1452 - [@ricmatsui](https://github.com/ricmatsui) made their first contribution in getsops/sops#880 - [@Paredev](https://github.com/Paredev) made their first contribution in getsops/sops#1765 - [@haoqixu](https://github.com/haoqixu) made their first contribution in getsops/sops#1692 - [@brianmcgee](https://github.com/brianmcgee) made their first contribution in getsops/sops#1641 - [@sledzikowy](https://github.com/sledzikowy) made their first contribution in getsops/sops#1701 - [@matheuscscp](https://github.com/matheuscscp) made their first contribution in getsops/sops#1794 - [@danilobuerger](https://github.com/danilobuerger) made their first contribution in getsops/sops#1811 - [@cgetzen](https://github.com/cgetzen) made their first contribution in getsops/sops#1571 - [@marensofier](https://github.com/marensofier) made their first contribution in getsops/sops#1578 - [@sabre1041](https://github.com/sabre1041) made their first contribution in getsops/sops#1823 **Full Changelog**: getsops/sops@v3.9.4...v3.10.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

brianmcgee force-pushed the feat/age-plugins branch from 8818c76 to 0903e65 Compare October 2, 2024 11:08

felixfontein marked this pull request as draft October 2, 2024 17:16

felixfontein added this to the 3.10.0 milestone Oct 2, 2024

Mic92 mentioned this pull request Oct 3, 2024

age-plugin support #1465

Closed

loa reviewed Oct 3, 2024

View reviewed changes

Mic92 mentioned this pull request Oct 12, 2024

add sops-yubikey support Mic92/sops-nix#516

Closed

brianmcgee force-pushed the feat/age-plugins branch from 0903e65 to a4a8dac Compare October 29, 2024 09:52

matdibu reviewed Oct 29, 2024

View reviewed changes

age/keysource.go Outdated Show resolved Hide resolved

brianmcgee force-pushed the feat/age-plugins branch from a4a8dac to ba04e40 Compare October 29, 2024 11:16

brianmcgee force-pushed the feat/age-plugins branch 3 times, most recently from 81f1b4a to 0607eae Compare November 21, 2024 09:03

Enzime mentioned this pull request Dec 12, 2024

feat: add age plugin support age-sops/sops#6

Merged

felixfontein added area/keyservice keyservice/age labels Dec 24, 2024

brianmcgee force-pushed the feat/age-plugins branch from 0607eae to eca80c2 Compare December 24, 2024 17:00

Ramblurr mentioned this pull request Dec 29, 2024

feat: add age plugin and fido2 hmac support Mic92/sops-nix#680

Closed

felixfontein mentioned this pull request Jan 11, 2025

Age malformed recipient - invalid type "age1yubikey" #1103

Closed

nicdumz mentioned this pull request Jan 13, 2025

feat: allow plugin users to create a ClientUI FiloSottile/age#611

Open

felixfontein mentioned this pull request Feb 23, 2025

support for age identity with passphrase #1400

Merged

brianmcgee force-pushed the feat/age-plugins branch from eca80c2 to 3a2eda4 Compare February 25, 2025 12:28

brianmcgee marked this pull request as ready for review February 25, 2025 12:30

github-advanced-security bot found potential problems Feb 25, 2025

View reviewed changes

age/tui.go Dismissed Show dismissed Hide dismissed

age/tui.go Dismissed Show dismissed Hide dismissed

age/tui.go Dismissed Show dismissed Hide dismissed

felixfontein requested a review from a team February 25, 2025 21:16

felixfontein reviewed Feb 26, 2025

View reviewed changes

age/tui.go Outdated Show resolved Hide resolved

age/tui.go Outdated Show resolved Hide resolved

feat: add age plugin support

6157d86

Signed-off-by: Brian McGee <brian@bmcgee.ie>

brianmcgee force-pushed the feat/age-plugins branch from 3a2eda4 to 6157d86 Compare February 27, 2025 09:06

felixfontein approved these changes Feb 27, 2025

View reviewed changes

felixfontein merged commit 1b99a29 into getsops:main Feb 27, 2025
15 checks passed

felixfontein mentioned this pull request Feb 27, 2025

vendored age code: consolidate passphrase reading functionality #1775

Merged

tiferrei mentioned this pull request Mar 10, 2025

Add support for sk- (hardware-backed) ed25519 keys Mic92/ssh-to-age#35

Closed

haslersn mentioned this pull request Aug 20, 2025

Update sops to 3.10.* for age plugin support viaduct-ai/kustomize-sops#294

Open

feat: add age plugin support #1641

feat: add age plugin support #1641

Uh oh!

Conversation

brianmcgee commented Oct 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TODO

Uh oh!

felixfontein commented Oct 2, 2024

Uh oh!

loa Oct 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brianmcgee Oct 3, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Ma27 commented Nov 20, 2024

Uh oh!

brianmcgee commented Nov 21, 2024

Uh oh!

visualphoenix commented Dec 11, 2024

Uh oh!

felixfontein commented Feb 20, 2025

Uh oh!

visualphoenix commented Feb 20, 2025

Uh oh!

Foxboron commented Feb 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianmcgee commented Feb 21, 2025

Uh oh!

felixfontein commented Feb 24, 2025

Uh oh!

brianmcgee commented Feb 25, 2025

Uh oh!

brianmcgee commented Feb 25, 2025

Uh oh!

Ramblurr commented Feb 25, 2025

Uh oh!

brianmcgee commented Feb 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felixfontein commented Feb 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felixfontein commented Feb 27, 2025

Uh oh!

Uh oh!

brianmcgee commented Oct 2, 2024 •

edited

Loading

loa Oct 3, 2024 •

edited

Loading

Foxboron commented Feb 21, 2025 •

edited

Loading