lib.ec.secret_store.Sops: Add store class #148

Merged

Jan Lindemann merged 1 commit from jan/feature/20261017-lib-ec-secret-store-sops-add-store-class into master 2026-10-17 14:08:22 +02:00 AGit

Conversation 0 Commits 1 Files changed 4 +1066

Jan Lindemann commented 2026-10-17 13:58:01 +02:00

Owner

• Copy link
• Copy Markdown

lib.ec.secret_store.Sops: Add store class

This commit adds a new class inheriting from secret_store.Base: Sops. The currently available classes allow to store secrets offline in a GPG-encrypted tarball, but those are not versioned. This commit allows to use a SOPS / AGE-encrypted Git repository as storage backend instead.

The additions in detail:

• Sops: the store implementation; the repository location comes from JW_SECRETS_SOPS_REPO, get() on an entry returns the decrypted serialized content, and a typed put (FT_SECRET) re-encrypts the entry wholesale
• The age key comes from JW_SECRETS_SOPS_KEY_PATH only: the house variable is the sole input to the store, and SOPS_AGE_KEY_FILE is set on the sops subprocess per invocation, never read from the process environment; SopsKeyError is raised when the variable is not set
• FileContext.create(): the sops:// scheme
• The store's unit tests, covering the node types, the deploy and fetch round trip, the whole-entry get and put, the key resolution, and the default fallback

#### lib.ec.secret_store.Sops: Add store class This commit adds a new class inheriting from `secret_store`.Base: Sops. The currently available classes allow to store secrets offline in a GPG-encrypted tarball, but those are not versioned. This commit allows to use a `SOPS` / AGE-encrypted Git repository as storage backend instead. The additions in detail: - Sops: the store implementation; the repository location comes from `JW_SECRETS_SOPS_REPO`, `get()` on an entry returns the decrypted serialized content, and a typed put (`FT_SECRET`) re-encrypts the entry wholesale - The age key comes from `JW_SECRETS_SOPS_KEY_PATH` only: the house variable is the sole input to the store, and `SOPS_AGE_KEY_FILE` is set on the sops subprocess per invocation, never read from the process environment; SopsKeyError is raised when the variable is not set - `FileContext.create()`: the sops:// scheme - The store's unit tests, covering the node types, the deploy and fetch round trip, the whole-entry get and put, the key resolution, and the default fallback

Jan Lindemann added 1 commit 2026-10-17 13:58:01 +02:00

lib.ec.secret_store.Sops: Add store class ... 60a91c0692

This commit adds a new class inheriting from secret_store.Base: Sops. The
currently available classes allow to store secrets offline in a
GPG-encrypted tarball, but those are not versioned. This commit allows to
use a SOPS / AGE-encrypted Git repository as storage backend instead.

The additions in detail:

- Sops: the store implementation; the repository location comes from
  JW_SECRETS_SOPS_REPO, get() on an entry returns the decrypted serialized
  content, and a typed put (FT_SECRET) re-encrypts the entry wholesale
- The age key comes from JW_SECRETS_SOPS_KEY_PATH only: the house variable
  is the sole input to the store, and SOPS_AGE_KEY_FILE is set on the sops
  subprocess per invocation, never read from the process environment;
  SopsKeyError is raised when the variable is not set
- FileContext.create(): the sops:// scheme
- The store's unit tests, covering the node types, the deploy and fetch
  round trip, the whole-entry get and put, the key resolution, and the
  default fallback

Signed-off-by: Jan Lindemann <jan@janware.com>
Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0
Signed-off-by: Jan Lindemann <jan@janware.com>
Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0

Jan Lindemann scheduled this pull request to auto merge when all checks succeed 2026-10-17 13:58:02 +02:00

Jan Lindemann merged commit 60a91c0692 into master 2026-10-17 14:08:22 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

janware/jw-pkg!148

No description provided.