Allow `sops updatekeys` to work on a directory tree

[thewilli]

If #545 was finished, it would be really great for sops updatekeys to work on a directory tree.

Usecase: There is a .sops.yaml file in a repository with the keys of all team members. Whenever team members come or go, it would be easy to automate or just simplify the process of granting or revoking access to encrypted content.

[CryoMyst]

Currently I work around this by parsing the .sops.yaml manually and grep -Eing matching files to updatekeys against however it would be really good if this was implemented.

[felixfontein]

Since there is no fixed file pattern of how SOPS encrypted files are named, this is kind of hard to implement. It's generally best if you create a shell script which uses find to search for the pattern you are using in your project and then use xargs to run sops updatekeys on each of these files.

Using the patterns from .sops.yaml only works if there is no fallback rule (which all .sops.yaml files I'm using have, for example).

[manselmi]

It's generally best if you create a shell script which uses find to search for the pattern you are using in your project and then use xargs to run sops updatekeys on each of these files.

For example, I name my SOPS-encrypted files *.sops.*, which makes updating identity encryption keys and rotating data encryption keys as easy as

find -- "$(git rev-parse --show-toplevel)" \
  -type d -name .git -prune -o \
  -type f \( -name '*.sops.*' \! -name .sops.yaml \) \
  -print \
  -exec sops updatekeys --yes -- {} \; \
  -exec sops --in-place --rotate -- {} \;

[johncoopertr]

I'd also be interested in this, it seems like something SOPS should be able to do since it already has the information about what files are managed with SOPS. It's a common use-case on larger projects with changing development teams.

[johncoopertr]

Something like this works for me:

grep -ilrZ sops * | xargs -0 -r -n1 sops updatekeys --yes

Maybe I'm missing something (pretty new to SOPS) but couldn't we use the metadata in the files managed by SOPS to "discover" them? And not rely on any file patterns or regex?

[tcurdt]

I was totally flabbergasted to finde that sops updatekeys has no way to figure out which files to update - given we have all the path_regex in the .sops.yaml anyway. Sure we could write a cumbersome script that extracts the path_regex and uses them to find the files and then call sops updatekeys on them ... but ... that feels pretty awkward.

Seems like @johncoopertr contributed this functionality in this PR

👍

Really hope this gets accepted.