VSCode SOPS extension

Info

The homepage of this VSCode extension is located at https://github.com/noonvoyager/vscode-sops.

This project is based on signageos/vscode-sops.

VSCode extension with underlying SOPS supports:

Realtime editing of encrypted yaml, json, dotenv, plaintext, binary and ini files in-place in your project.
Create new encrypted files using SOPS creation_rules when available.
Explicitly encrypt the current file or files selected in the Explorer.
Fully re-encrypt the current file or selected files with the latest SOPS configuration.
Load the project SOPS configuration normally, including settings such as stores.yaml.indent and stores.json.indent.
Protect .sops.yaml, .sops.yml and the file referenced by SOPS_CONFIG from automatic or explicit encryption.

This extension works with binaries sops / age / ... installed via aquaproj/aqua.

Download and install SOPS.
Make sure that sops is available in the $PATH environment variable, or configure sops.binPath.
(optional) For dotenv support, install the DotENV extension first.

Command	Description
`SOPS：加密当前文件`	Encrypt the plaintext file in the active editor in-place.
`SOPS：加密所选文件`	Encrypt files selected in the Explorer in-place.
`SOPS：重新加密当前文件`	Decrypt and fully re-encrypt the active file with the current configuration.
`SOPS：重新加密所选文件`	Decrypt and fully re-encrypt selected files with the current configuration.

The explicit encryption commands do not depend on sops.creationEnabled. Files are overwritten only after the complete SOPS operation succeeds.

sops.enabled: Enable or disable this extension (default: true).
sops.beta: Enable or disable the beta extension instance (default: false).
sops.binPath: Path to the SOPS binary (default: executable from $PATH).
sops.configPath: Absolute or project-relative path to this extension's run-control file (default: ./.sopsrc). See Config file.
sops.defaults.awsProfile: Default AWS profile (default: $AWS_PROFILE).
sops.defaults.gcpCredentialsPath: Default GCP credentials path (default: $GOOGLE_APPLICATION_CREDENTIALS).
sops.defaults.ageKeyFile: Default AGE key file (default: $SOPS_AGE_KEY_FILE).
sops.creationEnabled: Try to encrypt matching plaintext files when they are saved (default: false).
sops.defaults.ignoreMac: Disable MAC verification during decryption (default: false).
sops.defaults.macOnlyEncrypted: Compute the MAC only over encrypted values (default: false).

The extension run-control file is named .sopsrc in the project root by default and uses YAML:

awsProfile: my-profile-1
gcpCredentialsPath: /home/user/Downloads/my-key.json
ageKeyFile: /home/user/age.txt

.sopsrc configures this VSCode extension. It is not the SOPS .sops.yaml configuration file.

Optionally, add the following .gitattributes file to your project:

encrypted/*.{yaml,json,ini,env} diff=sopsdiffer

Then configure the diff command:

git config --global diff.sopsdiffer.textconv "sops decrypt"

Enjoy!