Conversation
Currently rekey re-encrypts all files. For my personal use-case, agenix would ideally only files that require rekeying, i.e. files where the identities changed. But I don’t think there’s an (easy) way to achieve that with `age` currently, as there’s no way to get the current recipients from an encrypted file? This change would allow the user to manually specifiy that only secrets that contain a given identity should be rekeyed. In my use-case this is handy as when I add a new server I want all secrets that are shared between servers (where the new identity was added) to be rekeyed, but I don’t want all secrets that are personal to different servers to also be rekeyed.
Pass -j PLUGIN parameter to age when decrypting, similar to how -i handles identity paths. This allows using data-less plugins for decryption.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Evaluate the relevant CLI rules once per command and pass filenames and rule paths to Nix as data. Previously rekey evaluated Nix once for the file list and twice per secret, while interpolated filenames broke on quotes and iteration differed between check and rekey.
Use one explicit operation and a shared, NUL-delimited filename loop. Edit and rekey call the same encryption/decryption helpers directly; rekey always decrypts, even with piped stdin. Piped edits still replace content without a private key, and
EDITOR=:retains its existing user-facing behavior. Conflicting operations now fail before evaluating rules or changing files.Single-file commands only force their selected rule. Check and decrypt do not evaluate armor settings. Paths containing spaces, quotes, backslashes, Nix-like text, and newlines remain literal.
This PR is based on #421 (which depends on #386) and incorporates the heads of #422, #295, and #360 to preserve pure-evaluation support, recipient filtering, and plugin identities. Those PRs remain unmerged; the additional commits are local integration commits for this branch. The final refactor is a separate commit for review.
Validation: package shellcheck and CLI tests; plugin and partial-encryption checks; new Linux/macOS rules tests count exactly one Nix invocation for each operation and cover unusual paths, lazy evaluation, recipient selection, piped rekey, empty rules, missing files, conflicting operations, unchanged edits, failed-editor preservation, and temporary plaintext cleanup. All-system test-flake evaluation passes.
Closes #401.