89 lines
1.7 KiB
Bash
89 lines
1.7 KiB
Bash
#!/usr/bin/env zsh
|
|
|
|
matches_any_rule() {
|
|
local path="$1"
|
|
shift
|
|
local regex
|
|
for regex in "$@"; do
|
|
[[ -n "${regex}" ]] || continue
|
|
if [[ "${path}" =~ ${regex} ]]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
|
|
enc_to_plain() {
|
|
local enc="$1"
|
|
[[ "${enc}" == *.enc.yaml ]] || return 1
|
|
print -r -- "${enc%.enc.yaml}.yaml"
|
|
}
|
|
|
|
plain_to_enc() {
|
|
local plain="$1"
|
|
[[ "${plain}" == *.yaml ]] || return 1
|
|
if [[ "${plain}" == *.enc.yaml ]]; then
|
|
print -r -- "${plain}"
|
|
else
|
|
print -r -- "${plain%.yaml}.enc.yaml"
|
|
fi
|
|
}
|
|
|
|
hmac_sidecar_for_enc() {
|
|
local enc="$1"
|
|
print -r -- "${enc}.sync-hmac"
|
|
}
|
|
|
|
encrypt_plain_to_enc() {
|
|
local plain="$1"
|
|
local enc="$2"
|
|
sops --encrypt --input-type yaml --output-type yaml --output "${enc}" "${plain}"
|
|
}
|
|
|
|
decrypt_enc_to_plain() {
|
|
local enc="$1"
|
|
sops --decrypt "${enc}"
|
|
}
|
|
|
|
compute_hmac_for_file() {
|
|
local path="$1"
|
|
openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" "${path}" | awk '{print $NF}'
|
|
}
|
|
|
|
compute_hmac_for_stdin() {
|
|
openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" | awk '{print $NF}'
|
|
}
|
|
|
|
read_sidecar() {
|
|
local sidecar="$1"
|
|
[ -f "${sidecar}" ] || return 1
|
|
tr -d '\r\n' < "${sidecar}"
|
|
}
|
|
|
|
write_sidecar() {
|
|
local sidecar="$1"
|
|
local value="$2"
|
|
print -r -- "${value}" > "${sidecar}"
|
|
}
|
|
|
|
is_sops_encrypted_file() {
|
|
local path="$1"
|
|
[ -f "${path}" ] || return 1
|
|
grep -q 'sops:' "${path}" && grep -q 'ENC\[' "${path}"
|
|
}
|
|
|
|
has_unstaged_changes() {
|
|
local path="$1"
|
|
if git ls-files --error-unmatch -- "${path}" >/dev/null 2>&1; then
|
|
git diff --quiet -- "${path}" >/dev/null 2>&1
|
|
return $?
|
|
fi
|
|
|
|
if git diff --cached --name-only -- "${path}" | grep -Fxq "${path}"; then
|
|
git diff --quiet -- "${path}" >/dev/null 2>&1
|
|
return $?
|
|
fi
|
|
|
|
return 1
|
|
}
|