VSCode SOPS extension

Info

The homepage of this VSCode extension is located at https://github.com/noonvoyager/vscode-sops.

This project is based on signageos/vscode-sops.

Features

VSCode extension with underlying SOPS supports:

• Realtime editing of encrypted yaml, json, dotenv, plaintext, binary and ini files in-place in your project.
• Create new encrypted files using SOPS creation_rules when available.
• Explicitly encrypt the current file or files selected in the Explorer.
• Fully re-encrypt the current file or selected files with the latest SOPS configuration.
• Search ordinary plaintext files and decrypted SOPS content across the workspace without writing bulk plaintext files to disk.
• Load the project SOPS configuration normally, including settings such as stores.yaml.indent and stores.json.indent.
• Protect .sops.yaml, .sops.yml and the file referenced by SOPS_CONFIG from automatic or explicit encryption.

This extension works with binaries sops / age / ... installed via aquaproj/aqua.

Requirements

• Download and install SOPS.
• Make sure that sops is available in the $PATH environment variable, or configure sops.binPath.
• (optional) For dotenv support, install the DotENV extension first.

Commands

The explicit encryption commands do not depend on sops.creationEnabled. Files are overwritten only after the complete SOPS operation succeeds.

Workspace secret search performs a case-insensitive literal text search. SOPS configuration files are searched as ordinary plaintext files. The search does not create decrypted copies for every encrypted file, and match previews are hidden by default. Use the eye button in the SOPS 搜索结果 Explorer view to reveal or hide them. Opening an encrypted match creates only the same temporary single-file decrypted view used by normal editing.

Extension Settings

• sops.enabled: Enable or disable this extension (default: true).
• sops.beta: Enable or disable the beta extension instance (default: false).
• sops.binPath: Path to the SOPS binary (default: executable from $PATH).
• sops.configPath: Absolute or project-relative path to this extension's run-control file (default: ./.sopsrc). See Config file.
• sops.defaults.awsProfile: Default AWS profile (default: $AWS_PROFILE).
• sops.defaults.gcpCredentialsPath: Default GCP credentials path (default: $GOOGLE_APPLICATION_CREDENTIALS).
• sops.defaults.ageKeyFile: Default AGE key file (default: $SOPS_AGE_KEY_FILE).
• sops.creationEnabled: Try to encrypt matching plaintext files when they are saved (default: false).
• sops.defaults.ignoreMac: Disable MAC verification during decryption (default: false).
• sops.defaults.macOnlyEncrypted: Compute the MAC only over encrypted values (default: false).
• sops.search.maxFiles: Maximum number of files inspected by workspace secret search (default: 10000).
• sops.search.maxFileSizeEncryptedKb: Maximum inspected SOPS ciphertext file size in KiB (default: 1024, or 1 MiB).
• sops.search.maxFileSizePlaintextKb: Maximum inspected plaintext file size in KiB (default: 16384, or 16 MiB).
• sops.search.maxResults: Maximum number of retained matches (default: 2000).
• sops.search.concurrency: Maximum number of files processed concurrently (default: 2, maximum: 8).

Config file

The extension run-control file is named .sopsrc in the project root by default and uses YAML:

awsProfile: my-profile-1
gcpCredentialsPath: /home/user/Downloads/my-key.json
ageKeyFile: /home/user/age.txt

.sopsrc configures this VSCode extension. It is not the SOPS .sops.yaml configuration file.

SOPS differ

Optionally, add the following .gitattributes file to your project:

encrypted/*.{yaml,json,ini,env} diff=sopsdiffer

Then configure the diff command:

git config --global diff.sopsdiffer.textconv "sops decrypt"

License

MIT

Enjoy!