fix(sops): encrypt from the temporary directory so the caller's .sops.yaml is never consulted

beddari commented

2026-09-20 17:27:24 +00:00

Owner

The first migration of a real vault failed: sops found the repository's .sops.yaml and refused the plaintext temp file, which matched no creation rule. Encryption now runs with the private temp dir as cwd and an absolute target, so only the configured recipients apply. Regression test under a hostile .sops.yaml. Published as 2026.09.20.2.

beddari added 1 commit

2026-09-20 17:27:24 +00:00

fix(sops): encrypt from the temporary directory so the caller's .sops.yaml is never consulted 4f60dd9be6

sops looks for .sops.yaml upward from its working directory and, having
found one, refuses an input file that matches none of its creation
rules, which the plaintext temporary file never does. Encryption now
runs with the private temporary directory as its working directory and
an absolute target, so the configured recipients are the only ones and a
repository's .sops.yaml is irrelevant to the vault. Regression test
under a .sops.yaml whose rules match nothing. 2026.09.20.2.

beddari merged commit c7bdedbe6d into main

2026-09-20 17:27:46 +00:00

beddari deleted branch sops-config

2026-09-20 17:27:46 +00:00

beddari referenced this pull request from a commit

2026-09-20 17:27:47 +00:00

Merge pull request 'fix(sops): encrypt from the temporary directory so the caller's .sops.yaml is never consulted' (#6) from sops-config into main

Rows
Columns

fix(sops): encrypt from the temporary directory so the caller's .sops.yaml is never consulted #6