sops-nix icon indicating copy to clipboard operation
sops-nix copied to clipboard

marshal nested secrets value to string

Open iosmanthus opened this issue 1 year ago • 8 comments

This pull request marshals nested secret values according to the format of the secret file.

iosmanthus avatar Dec 13 '23 13:12 iosmanthus

Seem the serialized yaml value has some newline, I should trim the output string.

iosmanthus avatar Dec 13 '23 16:12 iosmanthus

So the idea is that we can have yaml and json encrypted without having to put them in strings? Would be nice to extend the test case those those as well: https://github.com/Mic92/sops-nix/blob/master/pkgs/sops-install-secrets/nixos-test.nix

The script to update secrets is here: https://github.com/Mic92/sops-nix/blob/master/pkgs/sops-install-secrets/test-assets/sops-edit

Mic92 avatar Dec 13 '23 17:12 Mic92

So the idea is that we can have yaml and json encrypted without having to put them in strings? Would be nice to extend the test case those those as well: master/pkgs/sops-install-secrets/nixos-test.nix

The script to update secrets is here: master/pkgs/sops-install-secrets/test-assets/sops-edit

The basic idea is to support any value in a nested secret. However, I found some edge cases for this pull request:

  1. It supports the value of the secret to be a number but shows as a string in the template rendering, I might add some type of information into the placeholder.
  2. If the secret is a string formed by numbers, like "113", the rendered template would be like: ""123"".

I would add some tests to nixos-test.nix, and some unit tests for recurseSecretKey.

iosmanthus avatar Dec 14 '23 06:12 iosmanthus

Maybe it should only render arrays and hashmaps?

Mic92 avatar Dec 14 '23 10:12 Mic92

Maybe it should only render arrays and hashmaps?

Perhaps we should marshal nested secrets only in JSON format because it is indent-insensitive. The YAML nested secrets are difficult to fit in the template due to indentation issues.

iosmanthus avatar Jun 06 '24 10:06 iosmanthus