Method Encrypt

sops.go:523–577

Encrypt walks over the tree and encrypts all values with the provided cipher, except those whose key ends with the UnencryptedSuffix specified on the Metadata struct, those not ending with EncryptedSuffix, if EncryptedSuffix is provided (by default it is not), those not matching EncryptedRegex, if E

(key []byte, cipher Cipher)

// (all values if MACOnlyEncrypted is false, or only over values which end
// up encrypted if MACOnlyEncrypted is true).
func (tree Tree) Encrypt(key []byte, cipher Cipher) (string, error) {
	audit.SubmitEvent(audit.EncryptEvent{
		File: tree.FilePath,
	})
	hash := sha512.New()
	if tree.Metadata.MACOnlyEncrypted {
		// We initialize with known set of bytes so that a MAC with this setting
		// enabled is always different from a MAC with this setting disabled.
		hash.Write(MACOnlyEncryptedInitialization)
	}
	walk := func(branch TreeBranch) error {
		_, err := branch.walkBranch(branch, make([]string, 0), make([][]string, 0), func(in interface{}, path []string, commentsStack [][]string) (interface{}, error) {
			_, ok := in.(Comment)
			encrypted := tree.shouldBeEncrypted(path, commentsStack, ok)
			if !tree.Metadata.MACOnlyEncrypted || encrypted {
				// Only add to MAC if not a comment
				if !ok {
					bytes, err := ToBytes(in)
					if err != nil {
						return nil, fmt.Errorf("Could not convert %s to bytes: %s", in, err)
					}
					hash.Write(bytes)
				}
			}
			if encrypted {
				var err error
				pathString := strings.Join(path, ":") + ":"
				in, err = cipher.Encrypt(in, key, pathString)
				if err != nil {
					return nil, fmt.Errorf("Could not encrypt value: %s", err)
				}
				if ok && tree.Metadata.UnencryptedCommentRegex != "" {
					// If an encrypted comment matches tree.Metadata.UnencryptedCommentRegex, decryption will fail
					// as the MAC does not match, and the commented value will not be decrypted.
					// Note that cipher.Encrypt() returns a string, but we stored the result in an interface{}
					// variable, so we have to cast it back.
					matched, _ := regexp.Match(tree.Metadata.UnencryptedCommentRegex, []byte(in.(string)))
					if matched {
						return nil, fmt.Errorf("Encrypted comment %q matches UnencryptedCommentRegex! Make sure that UnencryptedCommentRegex cannot match an encrypted comment.", in)
					}
				}
			}
			return in, nil
		})
		return err
	}

	for _, branch := range tree.Branches {
		err := walk(branch)
		if err != nil {
			return "", fmt.Errorf("Error walking tree: %s", err)
		}
	}
	return fmt.Sprintf("%X", hash.Sum(nil)), nil
}

// Decrypt walks over the tree and decrypts all values with the provided cipher,
// except those whose key ends with the UnencryptedSuffix specified on the Metadata struct,