lib.ec.secret_store.Sops: Add store class #148
2026-10-17
lib.ec.secret_store.Sops: Add store class
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 5m0s
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 5m16s
CI / Packaging test (pull_request) Successful in 0s
CI / Packaging - Kali Linux (push) Successful in 4m37s
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 4m57s
CI / Packaging test (push) Successful in 0s
This commit adds a new class inheriting from secret_store.Base: Sops. The currently available classes allow to store secrets offline in a GPG-encrypted tarball, but those are not versioned. This commit allows to use a SOPS / AGE-encrypted Git repository as storage backend instead. The additions in detail: - Sops: the store implementation; the repository location comes from JW_SECRETS_SOPS_REPO, get() on an entry returns the decrypted serialized content, and a typed put (FT_SECRET) re-encrypts the entry wholesale - The age key comes from JW_SECRETS_SOPS_KEY_PATH only: the house variable is the sole input to the store, and SOPS_AGE_KEY_FILE is set on the sops subprocess per invocation, never read from the process environment; SopsKeyError is raised when the variable is not set - FileContext.create(): the sops:// scheme - The store's unit tests, covering the node types, the deploy and fetch round trip, the whole-entry get and put, the key resolution, and the default fallback Signed-off-by: Jan Lindemann <jan@janware.com> Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0 Signed-off-by: Jan Lindemann <jan@janware.com> Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0