Initial authentik gitops app

scripts/lib/sops-sync-lib

@@ -0,0 +1,88 @@
+#!/usr/bin/env zsh
+
+matches_any_rule() {
+  local path="$1"
+  shift
+  local regex
+  for regex in "$@"; do
+    [[ -n "${regex}" ]] || continue
+    if [[ "${path}" =~ ${regex} ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+enc_to_plain() {
+  local enc="$1"
+  [[ "${enc}" == *.enc.yaml ]] || return 1
+  print -r -- "${enc%.enc.yaml}.yaml"
+}
+
+plain_to_enc() {
+  local plain="$1"
+  [[ "${plain}" == *.yaml ]] || return 1
+  if [[ "${plain}" == *.enc.yaml ]]; then
+    print -r -- "${plain}"
+  else
+    print -r -- "${plain%.yaml}.enc.yaml"
+  fi
+}
+
+hmac_sidecar_for_enc() {
+  local enc="$1"
+  print -r -- "${enc}.sync-hmac"
+}
+
+encrypt_plain_to_enc() {
+  local plain="$1"
+  local enc="$2"
+  sops --encrypt --input-type yaml --output-type yaml --output "${enc}" "${plain}"
+}
+
+decrypt_enc_to_plain() {
+  local enc="$1"
+  sops --decrypt "${enc}"
+}
+
+compute_hmac_for_file() {
+  local path="$1"
+  openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" "${path}" | awk '{print $NF}'
+}
+
+compute_hmac_for_stdin() {
+  openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" | awk '{print $NF}'
+}
+
+read_sidecar() {
+  local sidecar="$1"
+  [ -f "${sidecar}" ] || return 1
+  tr -d '\r\n' < "${sidecar}"
+}
+
+write_sidecar() {
+  local sidecar="$1"
+  local value="$2"
+  print -r -- "${value}" > "${sidecar}"
+}
+
+is_sops_encrypted_file() {
+  local path="$1"
+  [ -f "${path}" ] || return 1
+  grep -q 'sops:' "${path}" && grep -q 'ENC\[' "${path}"
+}
+
+has_unstaged_changes() {
+  local path="$1"
+  if git ls-files --error-unmatch -- "${path}" >/dev/null 2>&1; then
+    git diff --quiet -- "${path}" >/dev/null 2>&1
+    return $?
+  fi
+
+  if git diff --cached --name-only -- "${path}" | grep -Fxq "${path}"; then
+    git diff --quiet -- "${path}" >/dev/null 2>&1
+    return $?
+  fi
+
+  return 1
+}