Add SSH support for age #1134

mstrangfeld · 2022-10-24T13:41:38Z

This MR implements #692

I realize there is already a MR #898 but it implements the ssh encryption as a completely new method.
I just patched the existing age module to also support ssh recipients and identities.

The behavior is the same as the original MR:
If there is no SOPS_AGE_SSH_PRIVATE_KEY env variable given, sops will check ~/.ssh/id_ed25519 and fallbacks to ~/.ssh/id_rsa.

Would love to hear some thoughts on this.

conorsch · 2022-10-25T06:23:36Z

Thanks for submitting. Took it for a spin; works splendidly over here. Here's approximately what I used to test:

#!/bin/bash
# review https://github.com/mozilla/sops/pull/1134
set -euo pipefail


# Make tempdir for test
d="$(mktemp -d)"
cd "$d" || exit 1
ssh_pubkey="$(cat ~/.ssh/id_ed25519.pub)"

cat <<END > .sops.yaml
---
creation_rules:
  - age: "$ssh_pubkey"
END
echo "Created sops config:"
cat .sops.yaml

cat <<END2 > example.yaml
---
foo: bar
END2

echo "Created vars file:"
cat example.yaml

sops -e -i example.yaml
echo "Encrypted vars file via ssh pubkey:"
cat example.yaml

echo "Attempting decryption of vars file:"
sops -d example.yaml

echo "SUCCESS!"

Tried it with a 4096-bit RSA key, and that worked fine, too. Would love to see this PR land.

lakano · 2023-02-08T14:47:21Z

Hi!
I've found this PR, and it's what we waiting to permit us to uses SOPS. Is this PR is abandoned or we just need to wait again?

kirek007 · 2023-02-09T15:58:17Z

Hey, I would also be interested in using ssh key :)

hiddeco · 2023-07-03T20:16:13Z

Thank you for your contribution! 🥑

Due to the size of this PR, I have scheduled it for next-next minor. As we do not want to unleash a flood of issues do to newly introduced functionalities on us while we have just taken over the project. I'll come back to this once v3.8.0 has been released.

In the meantime, it would be helpful if you could rebase your work and sign-off your commits. Thanks! 🙇

hiddeco

It took me some time (and I hope you are still around, @mstrangfeld!), but here is an initial round of review. Overall, it appears to be headed in the right direction, except for some minor nits and picks around details.

Thanks a lot for spending time on this, it appears to be the most requested thing at the moment. I promise my next review won't take this long. 🍇

age/keysource.go

hiddeco · 2023-10-11T20:44:52Z

age/keysource.go

-// SopsAgeKeyUserConfigPath). It will load all found references, and expects
-// at least one configuration to be present.
+// SopsAgeSshPrivateKeyEnv, SopsAgeKeyUserConfigPath). It will load all
+// found references, and expects at least one configuration to be present.
 func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {


As this is a method, it should continue to be above the newly introduced private functions.

age/keysource.go

hiddeco · 2023-10-11T20:58:39Z

age/keysource.go

+	sshKeyFilePath, ok := os.LookupEnv(SopsAgeSshPrivateKeyEnv)
+	if ok {
+		return getAgeSshIdentityFromPrivateKeyFile(sshKeyFilePath)
+	}
+
+	userHomeDir, err := os.UserHomeDir()
+	if err != nil || userHomeDir == "" {
+		log.Warnf("could not determine the user home directory: %v", err)
+		return nil, nil
+	}
+
+	sshEd25519PrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_ed25519")
+	if _, err := os.Stat(sshEd25519PrivateKeyPath); err == nil {
+		return getAgeSshIdentityFromPrivateKeyFile(sshEd25519PrivateKeyPath)
+	}
+
+	sshRsaPrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_rsa")
+	if _, err := os.Stat(sshRsaPrivateKeyPath); err == nil {
+		return getAgeSshIdentityFromPrivateKeyFile(sshRsaPrivateKeyPath)
+	}
+
+	return nil, nil


AFAIK, age lazily attempts to make use of the keys. Which makes me wonder if it would not be better to collect any found key which would match the behavior of loadIdentities().

If so, it may be better to collect existing paths here and delegate the loading of them to loadIdentities(). Which would iterate over the returned paths, while calling getAgeSshIdentityFromPrivateKeyFile().

age/keysource.go

mstrangfeld · 2023-10-13T05:45:37Z

Hi @hiddeco, thanks for the review! I will rebase, sign-off the commits and try to implement your suggestions!
It might take a week or so, but I'm excited to get this feature done.

sylvorg · 2023-12-01T07:17:10Z

I hate to look like I'm trying rush this, but I'm really just very excited for this feature! 😅 So if I could just bump this...?

fiksn · 2023-12-21T14:55:07Z

The behavior is the same as the original MR: If there is no SOPS_AGE_SSH_PRIVATE_KEY env variable given, sops will check ~/.ssh/id_ed25519 and fallbacks to ~/.ssh/id_rsa.

Would love to hear some thoughts on this.

Reasonable behavior. What was a bit confusing for me was just when I've set SOPS_AGE_SSH_PRIVATE_KEY=file.key it automatically assumed there is also a file.key.pub. I mean I did ssh-keygen -y -f file.key > file.key.pub then but this should not really be necessary (or this assumption should at least be documented).

Signed-off-by: Marvin Strangfeld <[email protected]>

mstrangfeld · 2024-01-12T17:40:32Z

I finally had some time to do this. I am no longer actively using sops at the moment, so if anyone else wants to take over from here, please feel free to use and modify my code as you wish.

tarasglek · 2024-01-15T06:07:29Z

I wrote a blog post on using sops with ssh keys and github, might be relevant to someone here. https://taras.glek.net/post/github-to-sops-lighter-weight-secret-management/

overfl0 · 2024-04-25T14:53:12Z

Hi @hiddeco , would it be possible to take a look at this PR once again?
The PR has been created around 1.5 years ago and the original poster, after being asked to rebase it to the latest version of sops (and doing so), said that he's not actively using sops anymore.
As a result, I think that the longer it takes for this PR to be merged, the harder it will be for it to be merged in the future, with every other commit not related to this PR potentially messing something somewhere.

Maybe it would make sense to merge this now and then work on any potential refactoring in future versions, so that we already have something that's working that we can use.

patryk4815 · 2024-05-01T13:47:19Z

@overfl0 You can convert ssh-ed25519 key using ssh-to-age program ;)
https://github.com/Mic92/ssh-to-age/

elijah · 2024-05-28T17:06:30Z

This is a valuable feature - +1 - it would be great to see it merged and usable.

overfl0 · 2024-10-28T21:22:23Z

@felixfontein what would be needed for this PR to be merged? It has had milestone tags changed for a while, without any comment whether it's just waiting for someone to look at it and it's purely due to the lack of time or if some additional work is needed.
Any information would be appreciated.

I'm tagging you because hiddeco seems to have stopped contributing in February.

felixfontein

@overfl0 I guess someone needs to reboot this PR by creating a new one and resolving conflicts. I personally don't have very much time, but I can try to give this another review, but it probably makes more sense to wait for a new PR (one comment below which I noticed while glancing over it).

Right now (well, I guess since the beginning of this year) it seems that the maintainer team has very limited time, so not much happened... I tried to get 3.9.0 out in summer with all changes done until then (and some more that should really go in); everything that wasn't looking like it will get done very very soon at that point got moved to the next milestone.

felixfontein · 2024-10-30T20:06:18Z

age/keysource.go

@@ -24,6 +26,9 @@ const (
 	// SopsAgeKeyFileEnv can be set as an environment variable pointing to an
 	// age keys file.
 	SopsAgeKeyFileEnv = "SOPS_AGE_KEY_FILE"
+	// SopsAgeSshPrivateKeyEnv can be set as an environment variable pointing to
+	// a private SSH key file.
+	SopsAgeSshPrivateKeyEnv = "SOPS_AGE_SSH_PRIVATE_KEY"


I would include File here to avoid possible confusion with the contents of the private key.

Suggested change

SopsAgeSshPrivateKeyEnv = "SOPS_AGE_SSH_PRIVATE_KEY"

SopsAgeSshPrivateKeyEnvFile = "SOPS_AGE_SSH_PRIVATE_KEY_FILE"

overfl0 · 2024-10-30T23:25:42Z

Thanks for your response @felixfontein !
FYI @albinvass has done just that: he rebased this PR and created his own, 3 months ago: #1496
You may want to take a look at that PR and say how it looks. There seem to be a few automatic warnings for it, but I think that the reason nothing has been done about that is that people see that this PR here has been staying in limbo for 2 years so maybe there is no reason to spend time fixing anything.

I'm sure that if you acknowledge that PR and say there that there is an actual chance of it being merged in, that people will then be willing to help and iron it out.

mstrangfeld force-pushed the age-ssh branch from 51379de to 0fbb1a4 Compare October 24, 2022 13:52

mstrangfeld marked this pull request as draft October 24, 2022 13:56

mstrangfeld force-pushed the age-ssh branch from 0fbb1a4 to a9601d9 Compare October 25, 2022 13:04

mstrangfeld changed the base branch from master to develop October 25, 2022 13:04

mstrangfeld changed the title ~~WIP: Add ssh support for age~~ Add ssh support for age Oct 25, 2022

mstrangfeld marked this pull request as ready for review October 25, 2022 13:06

mstrangfeld force-pushed the age-ssh branch from a9601d9 to 41fd68d Compare October 25, 2022 14:04

techhazard mentioned this pull request Mar 11, 2023

understanding keys.txt Mic92/sops-nix#297

Open

hiddeco added this to the v3.9.0 milestone Jul 3, 2023

hiddeco added enhancement area/keyservice keyservice/age labels Jul 3, 2023

neongreen mentioned this pull request Aug 5, 2023

Add support for Age SSH #898

Closed

hiddeco changed the title ~~Add ssh support for age~~ Add SSH support for age Oct 11, 2023

hiddeco reviewed Oct 11, 2023

View reviewed changes

ysmood mentioned this pull request Jan 9, 2024

Support github id based public key encryption #1409

Open

mstrangfeld force-pushed the age-ssh branch from 41fd68d to 2f18cc0 Compare January 12, 2024 17:33

feat: add ssh support for age

b276843

Signed-off-by: Marvin Strangfeld <[email protected]>

mstrangfeld force-pushed the age-ssh branch from 2f18cc0 to b276843 Compare January 12, 2024 17:36

albinvass mentioned this pull request Apr 25, 2024

feat: add ssh support for age #1496

Open

felixfontein modified the milestones: v3.9.0, 3.10.0 Jun 26, 2024

felixfontein reviewed Oct 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SSH support for age #1134

Add SSH support for age #1134

mstrangfeld commented Oct 24, 2022

conorsch commented Oct 25, 2022

lakano commented Feb 8, 2023

kirek007 commented Feb 9, 2023

hiddeco commented Jul 3, 2023 •

edited

Loading

hiddeco left a comment

hiddeco Oct 11, 2023

hiddeco Oct 11, 2023

hiddeco Oct 11, 2023

mstrangfeld commented Oct 13, 2023

sylvorg commented Dec 1, 2023

fiksn commented Dec 21, 2023

mstrangfeld commented Jan 12, 2024

tarasglek commented Jan 15, 2024

overfl0 commented Apr 25, 2024 •

edited

Loading

patryk4815 commented May 1, 2024 •

edited

Loading

elijah commented May 28, 2024

overfl0 commented Oct 28, 2024

felixfontein left a comment

felixfontein Oct 30, 2024

overfl0 commented Oct 30, 2024

	SopsAgeSshPrivateKeyEnv = "SOPS_AGE_SSH_PRIVATE_KEY"
	SopsAgeSshPrivateKeyEnvFile = "SOPS_AGE_SSH_PRIVATE_KEY_FILE"

Add SSH support for age #1134

Are you sure you want to change the base?

Add SSH support for age #1134

Conversation

mstrangfeld commented Oct 24, 2022

conorsch commented Oct 25, 2022

lakano commented Feb 8, 2023

kirek007 commented Feb 9, 2023

hiddeco commented Jul 3, 2023 • edited Loading

hiddeco left a comment

Choose a reason for hiding this comment

hiddeco Oct 11, 2023

Choose a reason for hiding this comment

hiddeco Oct 11, 2023

Choose a reason for hiding this comment

hiddeco Oct 11, 2023

Choose a reason for hiding this comment

mstrangfeld commented Oct 13, 2023

sylvorg commented Dec 1, 2023

fiksn commented Dec 21, 2023

mstrangfeld commented Jan 12, 2024

tarasglek commented Jan 15, 2024

overfl0 commented Apr 25, 2024 • edited Loading

patryk4815 commented May 1, 2024 • edited Loading

elijah commented May 28, 2024

overfl0 commented Oct 28, 2024

felixfontein left a comment

Choose a reason for hiding this comment

felixfontein Oct 30, 2024

Choose a reason for hiding this comment

overfl0 commented Oct 30, 2024

hiddeco commented Jul 3, 2023 •

edited

Loading

overfl0 commented Apr 25, 2024 •

edited

Loading

patryk4815 commented May 1, 2024 •

edited

Loading