search

Mic92 / sops-nix

Atomic secret provisioning for NixOS based on sops
MIT License
1.53k stars 139 forks source link

Error if key cant be decrypted #82

Open SuperSandro2000 opened 3 years ago

SuperSandro2000 commented 3 years ago

I messed um my .asc files and they couldn't be decrypted by sops which is silently ignored and you cannot edit your secrets file. It should throw an error or at least log such thing.

Mic92 commented 3 years ago

I am quite sure what you mean. This is the error message you should get if you cannot decrypt your file at deployment time: https://github.com/Mic92/sops-nix/issues/65#issue-792957254

Mic92 commented 3 years ago

If your error comes from the sops command line program this is unfortunately out of my possibilities. Sops has its own issue tracker for this. But I don't think this was your intention.

SuperSandro2000 commented 3 years ago

It comes from the sops cli or better or does not. The hook could check if the file type is valid and complain if not.

Mic92 commented 3 years ago

Do you mean sops-pgp-hook?

SuperSandro2000 commented 3 years ago

Yes

dasJ commented 2 years ago

@SuperSandro2000 We started recommending users to switch to age (and keys derived from ssh-ed25519 keys). The README will soon reflect that change. Since this is going to be the main way to do sops-nix in the future can you try it instead? This will entirely get rid of all hooks