Skip to content

feat: add TOML store #2031

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jcmfernandes wants to merge 7 commits into from
Closed

feat: add TOML store #2031

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
240015e
chore: add go-toml library to the module
jcmfernandes Jan 2, 2026
46ed1b4
feat: add TOML store
jcmfernandes Jan 2, 2026
76038c7
chore: wire things up
jcmfernandes Jan 2, 2026
16f62ab
refactor: use go-toml/v2 instead
jcmfernandes Jan 2, 2026
d7cbc32
test: add more tests by taking inspiration from the YAML suite
jcmfernandes Jan 2, 2026
39cd216
chore: keep alphabetical order
jcmfernandes Jan 3, 2026
8da3551
test: types
jcmfernandes Jan 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cmd/sops/common/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import (
"github.com/getsops/sops/v3/stores/dotenv"
"github.com/getsops/sops/v3/stores/ini"
"github.com/getsops/sops/v3/stores/json"
"github.com/getsops/sops/v3/stores/toml"
"github.com/getsops/sops/v3/stores/yaml"
"github.com/getsops/sops/v3/version"
"github.com/mitchellh/go-wordwrap"
Expand Down Expand Up @@ -55,6 +56,10 @@ func newJsonStore(c *config.StoresConfig) Store {
return json.NewStore(&c.JSON)
}

func newTomlStore(c *config.StoresConfig) Store {
return toml.NewStore(&c.TOML)
}

func newYamlStore(c *config.StoresConfig) Store {
return yaml.NewStore(&c.YAML)
}
Expand All @@ -64,6 +69,7 @@ var storeConstructors = map[Format]storeConstructor{
Dotenv: newDotenvStore,
Ini: newIniStore,
Json: newJsonStore,
Toml: newTomlStore,
Yaml: newYamlStore,
}

Expand Down
2 changes: 2 additions & 0 deletions cmd/sops/formats/formats.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ const (
Dotenv
Ini
Json
Toml
Yaml
)

Expand All @@ -18,6 +19,7 @@ var stringToFormat = map[string]Format{
"dotenv": Dotenv,
"ini": Ini,
"json": Json,
"toml": Toml,
"yaml": Yaml,
}

Expand Down
3 changes: 3 additions & 0 deletions config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,8 @@ type JSONBinaryStoreConfig struct {
Indent int `yaml:"indent"`
}

type TOMLStoreConfig struct{}

type YAMLStoreConfig struct {
Indent int `yaml:"indent"`
}
Expand All @@ -120,6 +122,7 @@ type StoresConfig struct {
INI INIStoreConfig `yaml:"ini"`
JSONBinary JSONBinaryStoreConfig `yaml:"json_binary"`
JSON JSONStoreConfig `yaml:"json"`
TOML TOMLStoreConfig `yaml:"toml"`
YAML YAMLStoreConfig `yaml:"yaml"`
}

Expand Down
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ require (
github.com/mitchellh/go-homedir v1.1.0
github.com/mitchellh/go-wordwrap v1.0.1
github.com/ory/dockertest/v3 v3.12.0
github.com/pelletier/go-toml/v2 v2.2.4
github.com/pkg/errors v0.9.1
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.11.1
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,8 @@ github.com/opencontainers/runc v1.2.8 h1:RnEICeDReapbZ5lZEgHvj7E9Q3Eex9toYmaGBsb
github.com/opencontainers/runc v1.2.8/go.mod h1:cC0YkmZcuvr+rtBZ6T7NBoVbMGNAdLa/21vIElJDOzI=
github.com/ory/dockertest/v3 v3.12.0 h1:3oV9d0sDzlSQfHtIaB5k6ghUCVMVLpAY8hwrqoCyRCw=
github.com/ory/dockertest/v3 v3.12.0/go.mod h1:aKNDTva3cp8dwOWwb9cWuX84aH5akkxXRvO7KCwWVjE=
github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down
108 changes: 54 additions & 54 deletions stores/stores.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,91 +36,91 @@ type SopsFile struct {
// in the SOPS file by checking for nil. This way we can show the user a
// helpful error message indicating that the metadata wasn't found, instead
// of showing a cryptic parsing error
Metadata *Metadata `yaml:"sops" json:"sops" ini:"sops"`
Metadata *Metadata `yaml:"sops" json:"sops" ini:"sops" toml:"sops"`
}

// Metadata is stored in SOPS encrypted files, and it contains the information necessary to decrypt the file.
// This struct is just used for serialization, and SOPS uses another struct internally, sops.Metadata. It exists
// in order to allow the binary format to stay backwards compatible over time, but at the same time allow the internal
// representation SOPS uses to change over time.
type Metadata struct {
ShamirThreshold int `yaml:"shamir_threshold,omitempty" json:"shamir_threshold,omitempty"`
KeyGroups []keygroup `yaml:"key_groups,omitempty" json:"key_groups,omitempty"`
KMSKeys []kmskey `yaml:"kms,omitempty" json:"kms,omitempty"`
GCPKMSKeys []gcpkmskey `yaml:"gcp_kms,omitempty" json:"gcp_kms,omitempty"`
HCKmsKeys []hckmskey `yaml:"hckms,omitempty" json:"hckms,omitempty"`
AzureKeyVaultKeys []azkvkey `yaml:"azure_kv,omitempty" json:"azure_kv,omitempty"`
VaultKeys []vaultkey `yaml:"hc_vault,omitempty" json:"hc_vault,omitempty"`
AgeKeys []agekey `yaml:"age,omitempty" json:"age,omitempty"`
LastModified string `yaml:"lastmodified" json:"lastmodified"`
MessageAuthenticationCode string `yaml:"mac" json:"mac"`
PGPKeys []pgpkey `yaml:"pgp,omitempty" json:"pgp,omitempty"`
UnencryptedSuffix string `yaml:"unencrypted_suffix,omitempty" json:"unencrypted_suffix,omitempty"`
EncryptedSuffix string `yaml:"encrypted_suffix,omitempty" json:"encrypted_suffix,omitempty"`
UnencryptedRegex string `yaml:"unencrypted_regex,omitempty" json:"unencrypted_regex,omitempty"`
EncryptedRegex string `yaml:"encrypted_regex,omitempty" json:"encrypted_regex,omitempty"`
UnencryptedCommentRegex string `yaml:"unencrypted_comment_regex,omitempty" json:"unencrypted_comment_regex,omitempty"`
EncryptedCommentRegex string `yaml:"encrypted_comment_regex,omitempty" json:"encrypted_comment_regex,omitempty"`
MACOnlyEncrypted bool `yaml:"mac_only_encrypted,omitempty" json:"mac_only_encrypted,omitempty"`
Version string `yaml:"version" json:"version"`
ShamirThreshold int `yaml:"shamir_threshold,omitempty" json:"shamir_threshold,omitempty" toml:"shamir_threshold,omitempty"`
KeyGroups []keygroup `yaml:"key_groups,omitempty" json:"key_groups,omitempty" toml:"key_groups,omitempty"`
KMSKeys []kmskey `yaml:"kms,omitempty" json:"kms,omitempty" toml:"kms,omitempty"`
GCPKMSKeys []gcpkmskey `yaml:"gcp_kms,omitempty" json:"gcp_kms,omitempty" toml:"gcp_kms,omitempty"`
HCKmsKeys []hckmskey `yaml:"hckms,omitempty" json:"hckms,omitempty" toml:"hckms,omitempty"`
AzureKeyVaultKeys []azkvkey `yaml:"azure_kv,omitempty" json:"azure_kv,omitempty" toml:"azure_kv,omitempty"`
VaultKeys []vaultkey `yaml:"hc_vault,omitempty" json:"hc_vault,omitempty" toml:"hc_vault,omitempty"`
AgeKeys []agekey `yaml:"age,omitempty" json:"age,omitempty" toml:"age,omitempty"`
LastModified string `yaml:"lastmodified" json:"lastmodified" toml:"lastmodified"`
MessageAuthenticationCode string `yaml:"mac" json:"mac" toml:"mac"`
PGPKeys []pgpkey `yaml:"pgp,omitempty" json:"pgp,omitempty" toml:"pgp,omitempty"`
UnencryptedSuffix string `yaml:"unencrypted_suffix,omitempty" json:"unencrypted_suffix,omitempty" toml:"unencrypted_suffix,omitempty"`
EncryptedSuffix string `yaml:"encrypted_suffix,omitempty" json:"encrypted_suffix,omitempty" toml:"encrypted_suffix,omitempty"`
UnencryptedRegex string `yaml:"unencrypted_regex,omitempty" json:"unencrypted_regex,omitempty" toml:"unencrypted_regex,omitempty"`
EncryptedRegex string `yaml:"encrypted_regex,omitempty" json:"encrypted_regex,omitempty" toml:"encrypted_regex,omitempty"`
UnencryptedCommentRegex string `yaml:"unencrypted_comment_regex,omitempty" json:"unencrypted_comment_regex,omitempty" toml:"unencrypted_comment_regex,omitempty"`
EncryptedCommentRegex string `yaml:"encrypted_comment_regex,omitempty" json:"encrypted_comment_regex,omitempty" toml:"encrypted_comment_regex,omitempty"`
MACOnlyEncrypted bool `yaml:"mac_only_encrypted,omitempty" json:"mac_only_encrypted,omitempty" toml:"mac_only_encrypted,omitempty"`
Version string `yaml:"version" json:"version" toml:"version"`
}

type keygroup struct {
PGPKeys []pgpkey `yaml:"pgp,omitempty" json:"pgp,omitempty"`
KMSKeys []kmskey `yaml:"kms,omitempty" json:"kms,omitempty"`
GCPKMSKeys []gcpkmskey `yaml:"gcp_kms,omitempty" json:"gcp_kms,omitempty"`
HCKmsKeys []hckmskey `yaml:"hckms,omitempty" json:"hckms,omitempty"`
AzureKeyVaultKeys []azkvkey `yaml:"azure_kv,omitempty" json:"azure_kv,omitempty"`
VaultKeys []vaultkey `yaml:"hc_vault" json:"hc_vault"`
AgeKeys []agekey `yaml:"age" json:"age"`
PGPKeys []pgpkey `yaml:"pgp,omitempty" json:"pgp,omitempty" toml:"pgp,omitempty"`
KMSKeys []kmskey `yaml:"kms,omitempty" json:"kms,omitempty" toml:"kms,omitempty"`
GCPKMSKeys []gcpkmskey `yaml:"gcp_kms,omitempty" json:"gcp_kms,omitempty" toml:"gcp_kms,omitempty"`
HCKmsKeys []hckmskey `yaml:"hckms,omitempty" json:"hckms,omitempty" toml:"hckms,omitempty"`
AzureKeyVaultKeys []azkvkey `yaml:"azure_kv,omitempty" json:"azure_kv,omitempty" toml:"azure_kv,omitempty"`
VaultKeys []vaultkey `yaml:"hc_vault" json:"hc_vault" toml:"hc_vault"`
AgeKeys []agekey `yaml:"age" json:"age" toml:"age"`
}

type pgpkey struct {
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
Fingerprint string `yaml:"fp" json:"fp"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
Fingerprint string `yaml:"fp" json:"fp" toml:"fp"`
}

type kmskey struct {
Arn string `yaml:"arn" json:"arn"`
Role string `yaml:"role,omitempty" json:"role,omitempty"`
Context map[string]*string `yaml:"context,omitempty" json:"context,omitempty"`
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
AwsProfile string `yaml:"aws_profile" json:"aws_profile"`
Arn string `yaml:"arn" json:"arn" toml:"arn"`
Role string `yaml:"role,omitempty" json:"role,omitempty" toml:"role,omitempty"`
Context map[string]*string `yaml:"context,omitempty" json:"context,omitempty" toml:"context,omitempty"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
AwsProfile string `yaml:"aws_profile" json:"aws_profile" toml:"aws_profile"`
}

type gcpkmskey struct {
ResourceID string `yaml:"resource_id" json:"resource_id"`
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
ResourceID string `yaml:"resource_id" json:"resource_id" toml:"resource_id"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
}

type vaultkey struct {
VaultAddress string `yaml:"vault_address" json:"vault_address"`
EnginePath string `yaml:"engine_path" json:"engine_path"`
KeyName string `yaml:"key_name" json:"key_name"`
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
VaultAddress string `yaml:"vault_address" json:"vault_address" toml:"vault_address"`
EnginePath string `yaml:"engine_path" json:"engine_path" toml:"engine_path"`
KeyName string `yaml:"key_name" json:"key_name" toml:"key_name"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
}

type azkvkey struct {
VaultURL string `yaml:"vault_url" json:"vault_url"`
Name string `yaml:"name" json:"name"`
Version string `yaml:"version" json:"version"`
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
VaultURL string `yaml:"vault_url" json:"vault_url" toml:"vault_url"`
Name string `yaml:"name" json:"name" toml:"name"`
Version string `yaml:"version" json:"version" toml:"version"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
}

type agekey struct {
Recipient string `yaml:"recipient" json:"recipient"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
Recipient string `yaml:"recipient" json:"recipient" toml:"recipient"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
}

type hckmskey struct {
KeyID string `yaml:"key_id" json:"key_id"`
CreatedAt string `yaml:"created_at" json:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc"`
KeyID string `yaml:"key_id" json:"key_id" toml:"key_id"`
CreatedAt string `yaml:"created_at" json:"created_at" toml:"created_at"`
EncryptedDataKey string `yaml:"enc" json:"enc" toml:"enc"`
}

// MetadataFromInternal converts an internal SOPS metadata representation to a representation appropriate for storage
Expand Down
Loading
Loading