SOPS v3.8.0-rc.1

[hiddeco]

After a long period of silence, we are happy to share the announcement of release candidate v3.8.0-rc.1! 🎉

This announcement serves as the primary place to discuss this release, and report potential issues with this release candidate compared to v3.7.3. When you are running into an issue which can be reproduced with v3.7.3, please open a new issue instead.

For the full changelog, refer to the CHANGELOG.rst file, or the link to the release page above.

[mxm-tr]

Hi, when running a decryption using PGP keys with the v3.8.0-rc.1 version, we get a new error message on stdout.

We expect the decryption to try all PGP keys referenced in the .sops.yaml file, until it succeeds. In the v3.8.0-rc.1, each decryption attempt generates an error message on stdout:

Using v3.7.3: No output on stdout, resulting file OK

[user@laptop deployment-values ]$ sops --version
sops 3.7.3
[user@laptop deployment-values ]$ sops --config <(echo '') -d --ignore-mac --output ./out.yml ./inventory.secrets.yaml 

Using v3.8.0-rc.1: PGP decryption errors on stdout, resulting file OK

[user@laptop deployment-values ]$ sops-3.8 --config <(echo '') -d --ignore-mac --output ./out.yml ./inventory.secrets.yaml  
[PGP]    ERRO[0000] Decryption failed                             fingerprint=keyid1
[PGP]    ERRO[0000] Decryption failed                             fingerprint=keyid2
[PGP]    ERRO[0000] Decryption failed                             fingerprint=keyid3
[PGP]    ERRO[0000] Decryption failed                             fingerprint=keyid4
[user@laptop deployment-values ]$ sops-3.8 --version
sops 3.8.0-rc.1 (latest)

Let me know if you need any further information!

[hiddeco]

But https://github.com/getsops/sops/blob/v3.7.3/pgp/keysource.go#L233 🤔

[felixfontein]

That's an info logging, not an error logging.

[hiddeco]

OOH, this then makes this related to #1146 and is a regression.

[mxm-tr]

Thanks for looking into it 🙏

[felixfontein]

Fixed by #1281; I just tested with a binary built with that PR merged, and it no longer shows the warnings.