Skip to content

Add support for OVH KMS in SOPS#1904

Closed
arunbhagyanath wants to merge 124 commits intogetsops:mainfrom
arunbhagyanath:feature/ovh-kms
Closed

Add support for OVH KMS in SOPS#1904
arunbhagyanath wants to merge 124 commits intogetsops:mainfrom
arunbhagyanath:feature/ovh-kms

Conversation

@arunbhagyanath
Copy link
Copy Markdown

@arunbhagyanath arunbhagyanath commented Aug 3, 2025

This PR adds support for encrypting and decrypting files using OVH Key Management Service.

Usage

export OVH_CERTIFICATE_FILE=/path/to/cert.pem
export OVH_CERTIFICATE_KEY_FILE=/path/to/key.pem

sops --ovh-kms "<rest-endpoint>/<your-key-id>" -e file.yaml > file.enc.yaml
sops -d file.enc.yaml

github-advanced-security[bot]
github-advanced-security AI found potential problems Aug 4, 2025
View reviewed changes
Comment thread cmd/sops/main.go
if err != nil {
return rotateOpts{}, err
}
rmMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "rm-kms", "rm-pgp", "rm-gcp-kms", "rm-azure-kv", "rm-hc-vault-transit", "rm-age", "rm-ovh-kms")

Check warning

Code scanning / CodeQL

Useless assignment to local variable

This definition of rmMasterKeys is never used.
Comment thread cmd/sops/main.go Outdated
return rotateOpts{}, err
}
var masterKeys []keys.MasterKey
masterKeys = append(masterKeys, addMasterKeys...)

Check warning

Code scanning / CodeQL

Useless assignment to local variable

This definition of masterKeys is never used.
cgetzen and others added 26 commits August 4, 2025 10:43
@cgetzen @abhagyanath-eiq
chore: omitempty optional metadata to reduce the size of stored config
0962171 
Signed-off-by: Charlie Getzen <charlie_g@regrello.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@sledzikowy @abhagyanath-eiq
Add abbility to set sops config location via envvar
72727aa 
Signed-off-by: sledzikowy <48012758+sledzikowy@users.noreply.github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5
9c8581d 
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.0.4 to 4.0.5.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md)
- [Commits](go-jose/go-jose@v4.0.4...v4.0.5)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@brianmcgee @abhagyanath-eiq
feat: add age plugin support
5d87a8d 
Signed-off-by: Brian McGee <brian@bmcgee.ie>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Check GnuPG decryption result for non-empty size.
f314088 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Consolidate passphrase reading functionality.
2b841d0 
Basically readPassphrase was replaced by readSecret in FiloSottile/age@c0e80ef
so we can just use that and stick to the latest version of cmd/age/tui.go.

Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Allow to encrypt and decrypt from stdin.
6111900 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @sabre1041 @abhagyanath-eiq
Fix typo.
1ec5597 
Co-authored-by: Andrew Block <andy.block@gmail.com>
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Small refactor; fix description.
cbebe6d 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Improve documentation.
d04b5e5 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the go group with 11 updates
fdbda5a 
Bumps the go group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto) | `1.1.5` | `1.1.6` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.36.2` | `1.36.3` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.29.7` | `1.29.8` |
| [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.17.60` | `1.17.61` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.63` | `1.17.64` |
| [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.37.19` | `1.38.0` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.77.1` | `1.78.0` |
| [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.33.15` | `1.33.16` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.34.0` | `0.35.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.222.0` | `0.223.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20250212204824-5a70512c5d8b` | `0.0.0-20250219182151-9fdb1cabc7b2` |

Updates `github.com/ProtonMail/go-crypto` from 1.1.5 to 1.1.6
- [Release notes](https://github.com/ProtonMail/go-crypto/releases)
- [Commits](ProtonMail/go-crypto@v1.1.5...v1.1.6)

Updates `github.com/aws/aws-sdk-go-v2` from 1.36.2 to 1.36.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@v1.36.2...v1.36.3)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.29.7 to 1.29.8
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@config/v1.29.7...config/v1.29.8)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.17.60 to 1.17.61
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.17.60...credentials/v1.17.61)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.63 to 1.17.64
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@feature/s3/manager/v1.17.63...feature/s3/manager/v1.17.64)

Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.37.19 to 1.38.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.38.0/CHANGELOG.md)
- [Commits](aws/aws-sdk-go-v2@service/kms/v1.37.19...service/s3/v1.38.0)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.77.1 to 1.78.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.77.1...service/s3/v1.78.0)

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.33.15 to 1.33.16
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/sns/v1.33.15...service/sns/v1.33.16)

Updates `golang.org/x/crypto` from 0.34.0 to 0.35.0
- [Commits](golang/crypto@v0.34.0...v0.35.0)

Updates `google.golang.org/api` from 0.222.0 to 0.223.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.222.0...v0.223.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250212204824-5a70512c5d8b to 0.0.0-20250219182151-9fdb1cabc7b2
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/ProtonMail/go-crypto
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the ci group with 5 updates
9dd6c2c 
Bumps the ci group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/cache](https://github.com/actions/cache) | `4.2.1` | `4.2.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `4.1.9` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.4.0` | `3.6.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.9.0` | `3.10.0` |
| [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` |

Updates `actions/cache` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c907a7...d4323d4)

Updates `actions/download-artifact` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@fa0a91b...cc20338)

Updates `docker/setup-qemu-action` from 3.4.0 to 3.6.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@4574d27...2910929)

Updates `docker/setup-buildx-action` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@f7ce87c...b5ca514)

Updates `slsa-framework/slsa-github-generator` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases)
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md)
- [Commits](slsa-framework/slsa-github-generator@v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: slsa-framework/slsa-github-generator
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump serde_json in /functional-tests in the rust group
8502354 
Bumps the rust group in /functional-tests with 1 update: [serde_json](https://github.com/serde-rs/json).

Updates `serde_json` from 1.0.139 to 1.0.140
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.139...v1.0.140)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Bump Rust version to 1.85.
c02c106 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@duthils @abhagyanath-eiq
goreleaser: add windows arm64
e69ad64 
Signed-off-by: Sebastien Duthil <duthils@duthils.net>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the go group with 13 updates
aae4ebb 
Bumps the go group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.29.8` | `1.29.9` |
| [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.17.61` | `1.17.62` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.64` | `1.17.65` |
| [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.38.0` | `1.38.1` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.78.0` | `1.78.1` |
| [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.33.16` | `1.33.17` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.35.0` | `0.36.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.35.0` | `0.37.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.30.0` | `0.31.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.29.0` | `0.30.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.223.0` | `0.224.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20250219182151-9fdb1cabc7b2` | `0.0.0-20250227231956-55c901821b1e` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.70.0` | `1.71.0` |

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.29.8 to 1.29.9
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@config/v1.29.8...config/v1.29.9)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.17.61 to 1.17.62
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.17.61...credentials/v1.17.62)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.64 to 1.17.65
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@feature/s3/manager/v1.17.64...feature/s3/manager/v1.17.65)

Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.38.0 to 1.38.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.38.1/CHANGELOG.md)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.38.0...service/s3/v1.38.1)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.78.0 to 1.78.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.78.0...service/s3/v1.78.1)

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.33.16 to 1.33.17
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/sns/v1.33.16...service/sns/v1.33.17)

Updates `golang.org/x/crypto` from 0.35.0 to 0.36.0
- [Commits](golang/crypto@v0.35.0...v0.36.0)

Updates `golang.org/x/net` from 0.35.0 to 0.37.0
- [Commits](golang/net@v0.35.0...v0.37.0)

Updates `golang.org/x/sys` from 0.30.0 to 0.31.0
- [Commits](golang/sys@v0.30.0...v0.31.0)

Updates `golang.org/x/term` from 0.29.0 to 0.30.0
- [Commits](golang/term@v0.29.0...v0.30.0)

Updates `google.golang.org/api` from 0.223.0 to 0.224.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.223.0...v0.224.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250219182151-9fdb1cabc7b2 to 0.0.0-20250227231956-55c901821b1e
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.70.0 to 1.71.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.70.0...v1.71.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the rust group in /functional-tests with 3 updates
86f0a5a 
Bumps the rust group in /functional-tests with 3 updates: [tempfile](https://github.com/Stebalien/tempfile), [serde](https://github.com/serde-rs/serde) and [serde_derive](https://github.com/serde-rs/serde).

Updates `tempfile` from 3.17.1 to 3.18.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.17.1...v3.18.0)

Updates `serde` from 1.0.218 to 1.0.219
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.218...v1.0.219)

Updates `serde_derive` from 1.0.218 to 1.0.219
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.218...v1.0.219)

---
updated-dependencies:
- dependency-name: tempfile
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust
- dependency-name: serde
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust
- dependency-name: serde_derive
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump github/codeql-action in the ci group
446b4ae 
Bumps the ci group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).

Updates `github/codeql-action` from 3.28.10 to 3.28.11
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b56ba49...6bb031a)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the go group with 6 updates
af625be 
Bumps the go group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.21.0` | `1.21.1` |
| [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.50.0` | `1.51.0` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.65` | `1.17.66` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.78.1` | `1.78.2` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.224.0` | `0.226.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20250227231956-55c901821b1e` | `0.0.0-20250303144028-a0af3efb3deb` |

Updates `cloud.google.com/go/kms` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.21.0...dlp/v1.21.1)

Updates `cloud.google.com/go/storage` from 1.50.0 to 1.51.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@spanner/v1.50.0...spanner/v1.51.0)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.65 to 1.17.66
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@feature/s3/manager/v1.17.65...feature/s3/manager/v1.17.66)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.78.1 to 1.78.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.78.1...service/s3/v1.78.2)

Updates `google.golang.org/api` from 0.224.0 to 0.226.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.224.0...v0.226.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250227231956-55c901821b1e to 0.0.0-20250303144028-a0af3efb3deb
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/kms
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: cloud.google.com/go/storage
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump tempfile in /functional-tests in the rust group
45e4f71 
Bumps the rust group in /functional-tests with 1 update: [tempfile](https://github.com/Stebalien/tempfile).

Updates `tempfile` from 3.18.0 to 3.19.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.18.0...v3.19.0)

---
updated-dependencies:
- dependency-name: tempfile
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump docker/login-action in the ci group
53fbf56 
Bumps the ci group with 1 update: [docker/login-action](https://github.com/docker/login-action).

Updates `docker/login-action` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@9780b0c...74a5d14)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2
f8f1dbb 
Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.2.1 to 5.2.2.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v5.2.1...v5.2.2)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@danilobuerger @abhagyanath-eiq
Added SOPS_AGE_KEY_CMD option to age, fixes getsops#1323
19c27ac 
Signed-off-by: Danilo Bürger <danilo.buerger@helsing.ai>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@danilobuerger @abhagyanath-eiq
Use shlex instead of shellquote
4847ab1 
Signed-off-by: Danilo Bürger <danilo.buerger@helsing.ai>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the go group with 3 updates
161f27a 
Bumps the go group with 3 updates: [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go), [google.golang.org/api](https://github.com/googleapis/google-api-go-client) and [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto).

Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.17.0 to 1.17.1
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.17.0...sdk/azcore/v1.17.1)

Updates `google.golang.org/api` from 0.226.0 to 0.227.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.226.0...v0.227.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250303144028-a0af3efb3deb to 0.0.0-20250313205543-e70fdf4c4cb4
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the ci group with 5 updates
ee7a9d7 
Bumps the ci group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-go](https://github.com/actions/setup-go) | `5.3.0` | `5.4.0` |
| [actions/cache](https://github.com/actions/cache) | `4.2.2` | `4.2.3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.1` | `4.6.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.9` | `4.2.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.11` | `3.28.12` |

Updates `actions/setup-go` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@f111f33...0aaccfd)

Updates `actions/cache` from 4.2.2 to 4.2.3
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@d4323d4...5a3ec84)

Updates `actions/upload-artifact` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@4cec3d8...ea165f8)

Updates `actions/download-artifact` from 4.1.9 to 4.2.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@cc20338...95815c3)

Updates `github/codeql-action` from 3.28.11 to 3.28.12
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6bb031a...5f8171a)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
dependabot Bot and others added 19 commits August 4, 2025 10:43
@dependabot @abhagyanath-eiq
build(deps): Bump the ci group with 2 updates
d0911ec 
Bumps the ci group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).

Updates `github/codeql-action` from 3.29.1 to 3.29.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@39edc49...181d5ee)

Updates `anchore/sbom-action` from 0.20.1 to 0.20.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@9246b90...cee1b8e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@dependabot @abhagyanath-eiq
build(deps): Bump the go group with 6 updates
f6afeec 
Bumps the go group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.18.0` | `1.18.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.39.0` | `0.40.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.41.0` | `0.42.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.33.0` | `0.34.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.32.0` | `0.33.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.240.0` | `0.241.0` |

Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/go-mgmt-sdk-release-guideline.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.18.0...sdk/azcore/v1.18.1)

Updates `golang.org/x/crypto` from 0.39.0 to 0.40.0
- [Commits](golang/crypto@v0.39.0...v0.40.0)

Updates `golang.org/x/net` from 0.41.0 to 0.42.0
- [Commits](golang/net@v0.41.0...v0.42.0)

Updates `golang.org/x/sys` from 0.33.0 to 0.34.0
- [Commits](golang/sys@v0.33.0...v0.34.0)

Updates `golang.org/x/term` from 0.32.0 to 0.33.0
- [Commits](golang/term@v0.32.0...v0.33.0)

Updates `google.golang.org/api` from 0.240.0 to 0.241.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.240.0...v0.241.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sys
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/term
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-version: 0.241.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@bjornfor @abhagyanath-eiq
Add "--value-file" option to "sops set [...]"
0ceb840 
This allows running "sops set [...]" without leaking secrets in process
listings.

To read secrets from stdin, use "/dev/stdin" as the file path.

Fixes getsops#729

Signed-off-by: Bjørn Forsman <bjorn.forsman@gmail.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@fredericrous @abhagyanath-eiq
Document XDG_CONFIG_HOME support on mac
2a3cd56 
fix getsops#1896

Signed-off-by: Frederic R. <zougi.fr@gmail.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@fredericrous @felixfontein @abhagyanath-eiq
double backticks on configuration directory list 1/2
0217af1 
Co-authored-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Frederic R. <zougi.fr@gmail.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@fredericrous @abhagyanath-eiq
double backticks on configuration directory list 2/2
60873e0 
Signed-off-by: Frederic R. <zougi.fr@gmail.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Add support for OVH KMS service
1248e94 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
929af74 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
b46c063 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
dd9292c 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
f135794 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
f47bea6 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Fix Shamir threshold encoding for INI and ENV files.
a9f602b 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @hiddeco @abhagyanath-eiq
Store floating point number without decimal places.
d9cb9e5 
Co-authored-by: Hidde Beydals <hiddeco@users.noreply.github.com>
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@felixfontein @abhagyanath-eiq
Also parse floating point numbers if they represent integers.
48d650c 
Signed-off-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@fredericrous @abhagyanath-eiq
Document XDG_CONFIG_HOME support on mac
3369f18 
fix getsops#1896

Signed-off-by: Frederic R. <zougi.fr@gmail.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Fix lint in README.rst
961b581 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@md42 @abhagyanath-eiq
use bullet points for structure
f5c25e6 
Signed-off-by: Martin Dürrmeier <857448+md42@users.noreply.github.com>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>

# Conflicts:
#	README.rst
@wasv @abhagyanath-eiq
Remove unmatched '`' from README.rst
2de6920 
This may seem extremely minor, but I'd (jokingly) argue it falls under UX, since I was confused and thought I had dirt on my screen screen due to this lone '`'.
It cost me a whole 5s, then another 5m to write this PR, but if it confuses at least 60 people a day then maybe its worth it?
Anyways, enjoy this extremely minor change that will hopefully eliminate a still really minor annoyance.

Signed-off-by: Bailey Stevens <me@mtxyz.me>
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
aa28541 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Update README.rst
56e3c9d 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@abhagyanath-eiq
Fix lint in README.rst
b6060b3 
Signed-off-by: Arun Bhagyanath <a.bhagyanath@eclecticiq.com>
@arunbhagyanath arunbhagyanath deleted the feature/ovh-kms branch August 4, 2025 11:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/keyservice enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.