Method Decrypt

sops.go:587–649

Decrypt walks over the tree and decrypts all values with the provided cipher, except those whose key ends with the UnencryptedSuffix specified on the Metadata struct, those not ending with EncryptedSuffix, if EncryptedSuffix is provided (by default it is not), those not matching EncryptedRegex, if E

(key []byte, cipher Cipher)

// (all values if MACOnlyEncrypted is false, or only over values which end
// up decrypted if MACOnlyEncrypted is true).
func (tree Tree) Decrypt(key []byte, cipher Cipher) (string, error) {
	log.Debug("Decrypting tree")
	audit.SubmitEvent(audit.DecryptEvent{
		File: tree.FilePath,
	})
	hash := sha512.New()
	if tree.Metadata.MACOnlyEncrypted {
		// We initialize with known set of bytes so that a MAC with this setting
		// enabled is always different from a MAC with this setting disabled.
		hash.Write(MACOnlyEncryptedInitialization)
	}
	walk := func(branch TreeBranch) error {
		_, err := branch.walkBranch(branch, make([]string, 0), make([][]string, 0), func(in interface{}, path []string, commentsStack [][]string) (interface{}, error) {
			c, isComment := in.(Comment)
			encrypted := tree.shouldBeEncrypted(path, commentsStack, isComment)
			var v interface{}
			if encrypted {
				var err error
				pathString := strings.Join(path, ":") + ":"
				if isComment {
					v, err = cipher.Decrypt(c.Value, key, pathString)
					if err != nil {
						// Assume the comment was not encrypted in the first place
						log.WithField("comment", c.Value).
							Warn("Found possibly unencrypted comment in file. " +
								"This is to be expected if the file being " +
								"decrypted was created with an older version of " +
								"SOPS.")
						v = c
					}
				} else if inStr, inIsStr := in.(string); inIsStr {
					v, err = cipher.Decrypt(inStr, key, pathString)
					if err != nil {
						return nil, fmt.Errorf("Could not decrypt value: %s", err)
					}
				} else {
					return nil, fmt.Errorf("Expected encrypted value as string, but got %T", in)
				}
			} else {
				v = in
			}
			if !tree.Metadata.MACOnlyEncrypted || encrypted {
				// Only add to MAC if not a comment
				if !isComment {
					bytes, err := ToBytes(v)
					if err != nil {
						return nil, fmt.Errorf("Could not convert %s to bytes: %s", in, err)
					}
					hash.Write(bytes)
				}
			}
			return v, nil
		})
		return err
	}
	for _, branch := range tree.Branches {
		err := walk(branch)
		if err != nil {