Skip to content

RT: secrets write read-back decrypts the .tmp as json (sops infers binary from the suffix)#14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
m4ttheweric merged 1 commit into from
Aug 21, 2026
Merged

RT: secrets write read-back decrypts the .tmp as json (sops infers binary from the suffix) #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/__tests__/linear.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -79,7 +79,7 @@ function fakeSecretsSeams(seedDomains: Record<string, Record<string, string>> =
removeFile: (p) => { files.delete(p); stats.delete(p); },
async run(cmd): Promise<SecretsExecResult> {
if (cmd[0] === "sops" && cmd[1] === "-d") {
const domain = domainFromPath(cmd[2]!);
const domain = domainFromPath(cmd[cmd.length - 1]!);
return { code: 0, stdout: JSON.stringify(domains.get(domain) ?? {}), stderr: "" };
}
if (cmd[0] === "sops" && cmd[1] === "-e") {
Expand Down
6 changes: 3 additions & 3 deletions lib/secrets/__tests__/store.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -128,7 +128,7 @@ class FakeSecretsExecSeam implements SecretsExecSeam {
this.calls.push({ cmd, opts: runOpts });

if (cmd[0] === "sops" && cmd[1] === "-d") {
const target = cmd[2]!;
const target = cmd[cmd.length - 1]!;
const staged = this.roundTrippablePlaintext.get(target);
if (staged !== undefined) return { code: 0, stdout: staged, stderr: "" };
return this.opts.decrypt ? this.opts.decrypt() : { code: 0, stdout: "{}", stderr: "" };
Expand DownExpand Up@@ -303,7 +303,7 @@ describe("writeSecret", () => {
expect(execSeam.calls.map((c) => c.cmd)).toEqual([
["sops", "-d", path],
["sops", "-e", "--filename-override", join("secrets", `${domain}.json`), "--output", outputTmp, staging],
["sops", "-d", outputTmp],
["sops", "-d", "--input-type", "json", "--output-type", "json", outputTmp],
]);
// The round-trip readback carries the same SOPS_AGE_KEY env as any other sops call — never argv.
expect(execSeam.calls[2]?.opts).toEqual({ env: { SOPS_AGE_KEY: "AGE-X" }, sensitive: true });
Expand DownExpand Up@@ -332,7 +332,7 @@ describe("writeSecret", () => {
const outputTmp = `${path}.${process.pid}.tmp`;
expect(execSeam.calls.map((c) => c.cmd)).toEqual([
["sops", "-e", "--filename-override", join("secrets", `${domain}.json`), "--output", outputTmp, stagingPath(domain)],
["sops", "-d", outputTmp],
["sops", "-d", "--input-type", "json", "--output-type", "json", outputTmp],
]);
expect(execSeam.files.get(path)).toBe(DEFAULT_CIPHERTEXT);
});
Expand Down
8 changes: 7 additions & 1 deletion lib/secrets/store.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -245,7 +245,13 @@ async function encryptDomain(
// sops creates outputTmpPath itself, at umask-derived (not 0600) perms.
execSeam.chmod(outputTmpPath, 0o600);

const decryptResult = await execSeam.run(["sops", "-d", outputTmpPath], { env, sensitive: true });
// sops picks the data store from the file extension; the `.tmp` suffix would
// select the binary store and fail on a JSON tree, so the read-back names
// the store explicitly (the real `.json` targets need no override).
const decryptResult = await execSeam.run(
["sops", "-d", "--input-type", "json", "--output-type", "json", outputTmpPath],
{ env, sensitive: true },
);
let roundTripped: Record<string, string> | undefined;
if (decryptResult.code === 0) {
try {
Expand Down
Loading