Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move extraction of encryption and rotation options to separate functions #1389

Merged
merged 3 commits into from
Feb 6, 2024
Merged

Move extraction of encryption and rotation options to separate functions #1389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7b9d9f5
Simplify handling of encryption config (what to encrypt, key groups, …
felixfontein Dec 26, 2023
4b61117
Move extraction of rotate options to a separate function.
felixfontein Dec 26, 2023
d8ac0f1
Move master key compilation to extra function.
felixfontein Feb 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 2 additions & 17 deletions cmd/sops/edit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,7 @@ type editOpts struct {

type editExampleOpts struct {
editOpts
UnencryptedSuffix string
EncryptedSuffix string
UnencryptedRegex string
EncryptedRegex string
MACOnlyEncrypted bool
KeyGroups []sops.KeyGroup
GroupThreshold int
encryptConfig
}

type runEditorUntilOkOpts struct {
Expand All @@ -61,16 +55,7 @@ func editExample(opts editExampleOpts) ([]byte, error) {
}
tree := sops.Tree{
Branches: branches,
Metadata: sops.Metadata{
KeyGroups: opts.KeyGroups,
UnencryptedSuffix: opts.UnencryptedSuffix,
EncryptedSuffix: opts.EncryptedSuffix,
UnencryptedRegex: opts.UnencryptedRegex,
EncryptedRegex: opts.EncryptedRegex,
MACOnlyEncrypted: opts.MACOnlyEncrypted,
Version: version.Version,
ShamirThreshold: opts.GroupThreshold,
},
Metadata: metadataFromEncryptionConfig(opts.encryptConfig),
FilePath: path,
}

Expand Down
40 changes: 24 additions & 16 deletions cmd/sops/encrypt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,7 @@ import (
"github.com/mitchellh/go-wordwrap"
)

type encryptOpts struct {
Cipher sops.Cipher
InputStore sops.Store
OutputStore sops.Store
InputPath string
KeyServices []keyservice.KeyServiceClient
type encryptConfig struct {
UnencryptedSuffix string
EncryptedSuffix string
UnencryptedRegex string
Expand All @@ -29,6 +24,15 @@ type encryptOpts struct {
GroupThreshold int
}

type encryptOpts struct {
Cipher sops.Cipher
InputStore sops.Store
OutputStore sops.Store
InputPath string
KeyServices []keyservice.KeyServiceClient
encryptConfig
}

type fileAlreadyEncryptedError struct{}

func (err *fileAlreadyEncryptedError) Error() string {
Expand All @@ -55,6 +59,19 @@ func ensureNoMetadata(opts encryptOpts, branch sops.TreeBranch) error {
return nil
}

func metadataFromEncryptionConfig(config encryptConfig) sops.Metadata {
return sops.Metadata{
KeyGroups: config.KeyGroups,
UnencryptedSuffix: config.UnencryptedSuffix,
EncryptedSuffix: config.EncryptedSuffix,
UnencryptedRegex: config.UnencryptedRegex,
EncryptedRegex: config.EncryptedRegex,
MACOnlyEncrypted: config.MACOnlyEncrypted,
Version: version.Version,
ShamirThreshold: config.GroupThreshold,
}
}

func encrypt(opts encryptOpts) (encryptedFile []byte, err error) {
// Load the file
fileBytes, err := os.ReadFile(opts.InputPath)
Expand All @@ -77,16 +94,7 @@ func encrypt(opts encryptOpts) (encryptedFile []byte, err error) {
}
tree := sops.Tree{
Branches: branches,
Metadata: sops.Metadata{
KeyGroups: opts.KeyGroups,
UnencryptedSuffix: opts.UnencryptedSuffix,
EncryptedSuffix: opts.EncryptedSuffix,
UnencryptedRegex: opts.UnencryptedRegex,
EncryptedRegex: opts.EncryptedRegex,
MACOnlyEncrypted: opts.MACOnlyEncrypted,
Version: version.Version,
ShamirThreshold: opts.GroupThreshold,
},
Metadata: metadataFromEncryptionConfig(opts.encryptConfig),
FilePath: path,
}
dataKey, errs := tree.GenerateDataKeyWithKeyServices(opts.KeyServices)
Expand Down
Loading
Loading