[[command]]
name = "sops"
description = "Mozilla SOPS — secrets-as-code editor that encrypts/decrypts YAML/JSON/ENV files in place using configurable KMS providers (AWS KMS, GCP KMS, Azure Key Vault, age, PGP). `--decrypt` reads an encrypted file and writes plaintext (to stdout by default, or in place with --in-place). `--encrypt` is the reverse. `--rotate` re-encrypts with a new data key. `edit` opens an interactive editor. `exec-env` / `exec-file` decrypt and run a child process with the decrypted secrets in the environment. `updatekeys` rewrites the metadata. KMS calls are network. Active project."
url = "https://github.com/getsops/sops"
researched_version = "sops 3.x"
level = "SafeWrite"
bare = false
standalone = [
    "--decrypt", "--decrypt-only-mac-mismatch",
    "--encrypt", "--encrypt-only-empty-keys",
    "--enable-local-keyservice", "--help",
    "--ignore-mac", "--in-place",
    "--mac-only-encrypted", "--rotate",
    "--show-master-keys", "--show-trace",
    "--unencrypted-fields-no-mac",
    "--verbose", "--version",
    "-d", "-e", "-h", "-i", "-r", "-s", "-v",
]
valued = [
    "--add-age", "--add-azure-kv", "--add-gcp-kms",
    "--add-hc-vault-transit", "--add-kms",
    "--add-pgp", "--age", "--aws-profile",
    "--azure-kv", "--config", "--decryption-order",
    "--encrypted-comment-regex", "--encrypted-regex",
    "--encrypted-suffix", "--extract", "--filename-override",
    "--gcp-kms", "--hc-vault-transit",
    "--input-type", "--keyservice",
    "--kms", "--mac-only-encrypted",
    "--output", "--output-type",
    "--pgp", "--rm-age", "--rm-azure-kv",
    "--rm-gcp-kms", "--rm-hc-vault-transit",
    "--rm-kms", "--rm-pgp",
    "--set", "--shamir-secret-sharing-quorum",
    "--shamir-secret-sharing-threshold",
    "--unencrypted-comment-regex",
    "--unencrypted-regex", "--unencrypted-suffix",
]
