Feature request: support arrays for `age` and `pgp` fields in configuration

[johanfleury]

Hey.

It would be great to be able to set age and PGP keys as arrays of strings in the configuration. This would be more in phase with YAML style and would allow putting comments, e.g.:

creation_rules:
  - path_regex: \.sops\.yaml$
    […]
    age:
      - age1xxx # Foo
      - age1yyy  # Bar
    pgp:
      - XXX, # Foo
      - YYY  # Bar

I believe sops already turns the comma separated values into an array internally, so that shouldn’t change the logic too much.

[autrilla]

We'd have to do so in a backwards compatible way, which should be possible. It would be good for the internal sops format to also do this in encrypted files.

[johanfleury]

I’ve looked into it thinking I would be able to make a PR, but I couldn’t find any example on how to extend the YAML parser to make it parse a comma separated string value into []string.

If I understand correctly, one would create a new type (maybe an alias to []string) and define the UnmarshalYAML() function on that type to split the value. Is that correct?

[johanfleury]

I found a working example, I’ll try to make a PR.

[MaxRink]

at least for PGP there exists an workaround that already works
specify a keygroup and leave the needed keys at one and it will basically behave like the wanted feature

  - path_regex: \.bin/secrets.yaml$
    key_groups:
     - pgp:
        - 'k1'  # k1
        - 'k2'  # k2
        ...
        - "kn"  #kn
    encrypted_regex: '^.*(?i)(password)(?-i).*$'

[stawii]

Same for age since 50a89c8

creation_rules:
  - key_groups:
      - age:
          - age1aaaaaaaa
          - age1bbbbbbb

Note: this behavior seems to be "side effect" of Key groups.
It acts funny with just one group, totally ignoring (but still saving in output if defined) shamir_threshold value, and saving metadata without key_groups block. But.. it get's job done and that's what I wanted!