Expand description
SOPS value encryption: the ENC[AES256_GCM,...] strings.
Mirrors github.com/getsops/sops/v3/aes (v3.13.x). AES-256-GCM with a
32-byte nonce, the authentication tag stored separately, and the AAD equal
to the value’s tree path (e.g. "KEY:" for a top-level dotenv variable, or
"sops_mac"-style paths for the metadata MAC). An empty plaintext encrypts
to the empty string (no ENC[...] wrapper), exactly like SOPS.
Functions§
- decrypt
- Decrypt a SOPS value string under
keywithaad. - encrypt
- Encrypt
plainunderkeywithaad, returning the SOPS value string. - encrypt_
kind - Like
encryptbut with an explicit SOPS value type (e.g.comment).