add specific status code for sops errors #1245

kaedwen · 2023-07-07T10:43:38Z

I would like to introduce explicit handling of sops errors to find out what did go wrong. This is a simple change without and we can know what went wrong during the run.

Signed-off-by: kaedwen <kaedwen@heinrich.blue>

felixfontein · 2023-08-24T04:35:00Z

sops.go

 }

 // MacMismatch occurs when the computed MAC does not match the expected ones
-const MacMismatch = sopsError("MAC mismatch")
+var MacMismatch = &SopsError{10, "MAC mismatch"}


Please note that there is already another exit code defined in cmd/sops/codes/codes.go. Please use the constants from there.

felixfontein · 2023-08-24T04:35:24Z

sops.go


 // MetadataNotFound occurs when the input file is malformed and doesn't have sops metadata in it
-const MetadataNotFound = sopsError("sops metadata not found")
+var MetadataNotFound = &SopsError{11, "sops metadata not found"}


There is no code yet for that, a new constant should be added to cmd/sops/codes/codes.go and used here.

This appears to be a 7 year old, unmaintained, unused, artifact from around the time things were still written in Python. As observed earlier in getsops#1234. As this now actively triggers a security warning due to an outdated dependency, remove it. Signed-off-by: Hidde Beydals <hidde@hhh.computer>

By addressing the bug in the introduced logic around the `GOOGLE_CREDENTIALS` environment variable. The variable is now only taken into account when set, and actually containing a value. Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Most of the rewritten key sources introduced `WithError` calls, which does not appear to go well with the UX of the CLI. This reverts it to be the semi equal to current `master`. During the diff, I noticed the current age implementation in master does make use of `WithError`. Which makes me wonder if errors are not returned twice at present in the CLI. Signed-off-by: Hidde Beydals <hello@hidde.co>

This commit renames the Go module from `go.mozilla.org/sops/v3` to `github.com/getsops/sops/v3` without a major version bump, to align with new stewardship. For more information around this change, refer to getsops#1246. For a one-liner to change the `go.mod` and any import paths in your Go project making use of this module, run: ``` find /path/to/repo -type f \( -name "*.go" -o -name "go.mod" \) -exec sed -i 's|go.mozilla.org/sops/v3|github.com/getsops/sops/v3|g' {} \; find /path/to/repo -type f \( -name "*.go" -o -name "go.mod" \) -exec sed -i '' 's|go.mozilla.org/sops/v3|github.com/getsops/sops/v3|g' {} \; ``` Signed-off-by: Hidde Beydals <hidde@hhh.computer>

This was historically used to generate https://go.mozilla.org/sops/, which is not under our control. Signed-off-by: Hidde Beydals <hidde@hhh.computer>

- github.com/aws/aws-sdk-go-v2 to v1.20.1 - github.com/aws/aws-sdk-go-v2/config to v1.18.33 - github.com/aws/aws-sdk-go-v2/credentials to v1.13.32 - github.com/aws/aws-sdk-go-v2/feature/s3/manager to v1.11.77 - github.com/aws/aws-sdk-go-v2/service/kms to v1.24.2 - github.com/aws/aws-sdk-go-v2/service/s3 to v1.38.2 - github.com/aws/aws-sdk-go-v2/service/sts to v1.21.2 Signed-off-by: Hidde Beydals <hidde@hhh.computer>

While also updating the deprecated API module to `cloud.google.com/go/kms/apiv1/kmspb`. Signed-off-by: Hidde Beydals <hidde@hhh.computer>

- github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.7.0 - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys to v1.0.0 This includes dealing with some breaking changes, which should be the last ones for the foreseeable future as they tagged it as the first MAJOR. Signed-off-by: Hidde Beydals <hidde@hhh.computer>