add --encrypted-selector option #385
Conversation
dictcp
force-pushed
the
ft-encryptedSelector
branch
from
b39f0d6
to
797903e
Compare
dictcp
force-pushed
the
ft-encryptedSelector
branch
from
797903e
to
7eae407
Compare
Codecov Report
@@ Coverage Diff @@
## master #385 +/- ##
==========================================
+ Coverage 45.32% 45.69% +0.37%
==========================================
Files 12 12
Lines 1593 1604 +11
==========================================
+ Hits 722 733 +11
Misses 797 797
Partials 74 74
Continue to review full report at Codecov.
|
| @@ -133,6 +133,66 @@ func TestEncryptedSuffix(t *testing.T) { | |||
| } | |||
| } | |||
|
|
|||
|
|
|||
| func TestEncryptedSelector(t *testing.T) { | |||
There was a problem hiding this comment.
Can we add test cases for YAML lists?
| @@ -45,6 +45,7 @@ type Metadata struct { | |||
| PGPKeys []pgpkey `yaml:"pgp" json:"pgp"` | |||
| UnencryptedSuffix string `yaml:"unencrypted_suffix,omitempty" json:"unencrypted_suffix,omitempty"` | |||
| EncryptedSuffix string `yaml:"encrypted_suffix,omitempty" json:"encrypted_suffix,omitempty"` | |||
| EncryptedSelector string `yaml:"encrypted_selector,omitempty" json:"encrypted_selector,omitempty"` | |||
| @@ -318,6 +318,13 @@ func (tree Tree) Encrypt(key []byte, cipher Cipher) (string, error) { | |||
| } | |||
| } | |||
| } | |||
| if tree.Metadata.EncryptedSelector != "" { | |||
There was a problem hiding this comment.
This is good, but I think a better approach would be to convert the selector to a []string (in main.go, so the SOPS API itself would take the []string, and the command line will handle conversion) and then compare the slices. It saves us some computations we currently do for every decryption, and more importantly would provide a cleaner API to those using SOPS as a Go library.
What do you think?
| @@ -429,6 +429,7 @@ func main() { | |||
|
|
|||
| unencryptedSuffix := c.String("unencrypted-suffix") | |||
| encryptedSuffix := c.String("encrypted-suffix") | |||
| encryptedSelector := c.String("encrypted-selector") | |||
There was a problem hiding this comment.
You need to add the flag to the list of flags here: https://github.com/mozilla/sops/blob/457297faa309c5a0b4536ef5c808b5324e025fb6/cmd/sops/main.go#L409
|
This PR is stale and conflicts with a lot of other files. Should we close it? |
|
It can be reopened if needed, so I guess so. |
per #368, sometimes we need to pick only a subtree to encrypt (eg. Kubernetes secret). then it should be able to encrypt Kubernetes secret just like https://github.com/shyiko/kubesec