Sops: [Question] Several encryption suffixes

[naadev]

Greetings...

I'm really glad to have discovered SOPS. It's really good stuff.

I'm working on a proposal to use SOPS as part of our standard security policies. In our case, I've found there could be, just to make it more transparent to final users that there are two suffix I'd like to see encrypted, in example all entries ending with:

• Password (i.e. ServicePassword)
• Key (i.e. ApiKey)

I'm wondering if there is any way to provide two suffixes when encrypting, I've tried with:

• sops -e --output file.sops --encrypted-suffix Password --encrypted-suffix Key file.json
• sops -e --output file.sops --encrypted-suffix Password,Key file.json

Is this a supported scenario somehow?

[autrilla]

That's not supported right now, but I guess we can turn this issue into a feature request for multiple encrypted/unencrypted suffixes :)

[jvehent]

Note for later, in case we decide to do this: don't use a regex or
interpreted string, since it could mess with the way people use it today,
but instead allow the flag to be set multiple times and turn it into an
[]string.

On Tue, Aug 13, 2019 at 9:21 AM Adrian Utrilla [e-mail]
wrote:

That's not supported right now, but I guess we can turn this issue into a
feature request for multiple encrypted/unencrypted suffixes :)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/mozilla/sops/issues/508?email_source=notifications&email_token=AADFPAKKE33MASCPND6QRJ3QEKYMTA5CNFSM4ILKUHX2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD4FUF4I#issuecomment-520831729,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AADFPALQLYNK2PP3TNT53ETQEKYMTANCNFSM4ILKUHXQ
.

[bobmhong]

I just discovered the same limitation today and would like to see the ability to pass a list of encrypted suffixes.

[naadev]

I will try to spare some time today to provide a pull request to work with list... :)

Sent from my iPhone

On 20 Aug 2019, at 01:41, Bob Hong <[email protected][e-mail]> wrote:

I just discovered the same limitation today and would like to see the ability to pass a list of encrypted suffixes.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/mozilla/sops/issues/508?email_source=notifications&email_token=ABMZ3CV4DQDOQ2QOG2IMILTQFMVQ7A5CNFSM4ILKUHX2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD4UTQBI#issuecomment-522795013, or mute the threadhttps://github.com/notifications/unsubscribe-auth/ABMZ3CUYXVI3GKXNKOBSVULQFMVQ7ANCNFSM4ILKUHXQ.

[autrilla]

I'm not sure multiple suffixes are worth implementing with #509 in the pipeline, as you can achieve the same behavior with both

[naadev]

That's what I was looking for... thank you @autrilla