search

getsops / sops

Simple and flexible tool for managing secrets
https://getsops.io/
Mozilla Public License 2.0
17.07k stars 880 forks source link

Support key fetching from keybase.io #200

Open joemiller opened 7 years ago

joemiller commented 7 years ago

It would be great to be able to do this:

$ sops -r --add-pgp keybase:joemiller example.yaml

The GPG key for keybase.io user 'joemiller' would be fetched via HTTPS from https://keybase.io/joemiller/pgp_keys.asc

joemiller commented 7 years ago

Also 

export SOPS_PGP_FP="keybase:joemiller,keybase:foo,keybase:bar"
jvehent commented 7 years ago

What should this do under the hood? Download the public key into the pubring of the user, like gpg --recv-keys would, then use the fingerprint to create the document? Or should it bypass the pubring entirely (which is significantly more complex).

joemiller commented 7 years ago

@jvehent That is a good question and I don't know the right answer. If implementation is easier I think downloading into the user's pubring would be OK. It should also probably check and update the key if it has changed.

jvehent commented 7 years ago

I think downloading into the pubring is the most logical thing to do, but it might require calling out to the gpg binary which I really don't like (it's not portable). We might also want to support other providers. Github exposes public keys as well:

$ curl -s -H "Accept: application/vnd.github.cryptographer-preview" https://api.github.com/users/jvehent/gpg_keys |jq -r '.[].public_key'
xsBNBFF/69EBCADe79sqUKJHXTMW3tahbXPdQAnpFWXChjI9tOGbgxmse1eEGjPZQPFOPgu3O3iij6UOVh+LOkqccjJ8gZVLYMJzUQC+2RJ3jvXhti8xZ1hs2iEr65RjzUklHVZguf2Zv2X9Er8rnlW5xzplsVXNWnVvMDXyzx0ufC00dDbCwahLQnv6Vqq8BdUCSrvo/r7oAims8SyWE+ZObC+rw7u01Sut0ctnYrvklaM10+zkwGNOTszrduUykJUYMoFPU3I+QhaTw1K/nhs5lSgegxDUlgXI39I8wlRp/fynghRWPtYnMSMsbZrPtpSCflNGEStVBdVHZvj0T1fCist59zh2IqeHABEBAAE=