## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.linux.amd64 # Move the binary in to your PATH mv sops-v3.11.0.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.11.0.checksums.txt \ --certificate sops-v3.11.0.checksums.pem \ --signature sops-v3.11.0.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.11.0.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.11.0.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.11.0.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.11.0 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.11.0` - `ghcr.io/getsops/sops:v3.11.0-alpine` ### Quay.io - `quay.io/getsops/sops:v3.11.0` - `quay.io/getsops/sops:v3.11.0-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.11.0 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump the go group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1845 * build(deps): Bump the go group with 5 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1850 * build(deps): Bump the ci group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1849 * build(deps): Bump the go group with 8 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1854 * build(deps): Bump tempfile from 3.19.1 to 3.20.0 in /functional-tests in the rust group by @dependabot[bot] in https://github.com/getsops/sops/pull/1853 * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the ci group by @dependabot[bot] in https://github.com/getsops/sops/pull/1852 * use bullet points for structure by @md42 in https://github.com/getsops/sops/pull/1844 * Introduce EncryptContext and DecryptContext for AWS, Azure, GCP, PGP and HashiCorp Vault by @matheuscscp in https://github.com/getsops/sops/pull/1848 * build(deps): Bump the go group with 5 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1856 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1857 * Allow injecting custom HTTP client for AWS, Azure, GCP and HashiCorp Vault by @matheuscscp in https://github.com/getsops/sops/pull/1838 * Update authors in main.go by @jvehent in https://github.com/getsops/sops/pull/1860 * build(deps): Bump the go group with 7 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1861 * Remove unmatched '`' from README.rst by @wasv in https://github.com/getsops/sops/pull/1863 * build(deps): Bump the go group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1867 * build(deps): Bump alpine from 3.21 to 3.22 in /.release in the docker group by @dependabot[bot] in https://github.com/getsops/sops/pull/1866 * build(deps): Bump the go group with 12 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1870 * build(deps): Bump github/codeql-action from 3.28.18 to 3.28.19 in the ci group by @dependabot[bot] in https://github.com/getsops/sops/pull/1869 * build(deps): Bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot[bot] in https://github.com/getsops/sops/pull/1871 * build(deps): Bump the go group with 12 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1872 * build(deps): Bump the ci group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1874 * build(deps): Bump the go group with 8 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1878 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1879 * build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in https://github.com/getsops/sops/pull/1882 * Fix Typo in README.rst by @inverted-tree in https://github.com/getsops/sops/pull/1881 * build(deps): Bump the go group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1884 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1883 * Correct Windows path to store keys.txt by @EshemMimi in https://github.com/getsops/sops/pull/1885 * build(deps): Bump the go group with 3 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1888 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1889 * build(deps): Bump the go group with 6 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1893 * Add "--value-file" option to "sops set [...]" by @bjornfor in https://github.com/getsops/sops/pull/1876 * Document XDG_CONFIG_HOME support on mac by @fredericrous in https://github.com/getsops/sops/pull/1897 * Fix Shamir threshold encoding for INI and ENV files by @felixfontein in https://github.com/getsops/sops/pull/1899 * build(deps): Bump the go group with 12 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1908 * build(deps): Bump serde_json from 1.0.140 to 1.0.142 in /functional-tests in the rust group by @dependabot[bot] in https://github.com/getsops/sops/pull/1907 * build(deps): Bump the ci group with 3 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1905 * Fix docs: mention all stores instead of just YAML, JSON, and BINARY by @felixfontein in https://github.com/getsops/sops/pull/1895 * Ensure temporary file for editing is only read-writable by owner by @felixfontein in https://github.com/getsops/sops/pull/1903 * Add `--value-stdin` option to `sops set` by @felixfontein in https://github.com/getsops/sops/pull/1894 * Collect age identity loading errors and only report if decryption failed by @felixfontein in https://github.com/getsops/sops/pull/1898 * add completion script. Resolves #1868 by @longxiucai in https://github.com/getsops/sops/pull/1892 * Resolves #1864. Adds Native List as an option for configuring keys. by @lucqui in https://github.com/getsops/sops/pull/1880 * Fix example.yaml file by @felixfontein in https://github.com/getsops/sops/pull/1909 * build(deps): Bump the go group with 15 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1912 * build(deps): Bump the ci group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1911 * build(deps): Bump the go group with 9 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1917 * build(deps): Bump the ci group with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1916 * build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in https://github.com/getsops/sops/pull/1920 * build(deps): Bump the go group with 14 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1923 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1921 * build(deps): Bump github/codeql-action from 3.29.9 to 3.29.11 in the ci group by @dependabot[bot] in https://github.com/getsops/sops/pull/1922 * Docs: remove paragraph on GPG/PGP keyservers by @felixfontein in https://github.com/getsops/sops/pull/1928 * Allow to configure --enable-local-keyservice and --keyservice through env variables by @felixfontein in https://github.com/getsops/sops/pull/1930 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1937 * fix: correct destination validation logic to detect all conflicts by @bruce-szalwinski-he in https://github.com/getsops/sops/pull/1936 * Switch from deprecated gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @sylr in https://github.com/getsops/sops/pull/1934 * INI: fix converting integers to strings; improve float and time.Time formatting by @felixfontein in https://github.com/getsops/sops/pull/1929 * feat(azkv): Skipping key-version will get latest key by @daogilvie in https://github.com/getsops/sops/pull/1919 * Fix keyservice client for unix domain sockets by @matheuscscp in https://github.com/getsops/sops/pull/1910 * README: fix argument order by @felixfontein in https://github.com/getsops/sops/pull/1940 * Allow non-complex non-string values in dotenv and exec-env by @billy4479 in https://github.com/getsops/sops/pull/1933 * Fix mention of macOS XDG_CONFIG_HOME fallback by @felixfontein in https://github.com/getsops/sops/pull/1944 * Improve age identity loading by @felixfontein in https://github.com/getsops/sops/pull/1931 * build(deps): Bump the rust group in /functional-tests with 4 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1948 * build(deps): Bump the ci group with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1949 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1954 * build(deps): Bump anchore/sbom-action from 0.20.5 to 0.20.6 in the ci group by @dependabot[bot] in https://github.com/getsops/sops/pull/1955 * Start documenting the configuration file format by @felixfontein in https://github.com/getsops/sops/pull/1946 * CI: Build with Go 1.24 and 1.25, release with 1.25 by @felixfontein in https://github.com/getsops/sops/pull/1945 * build(deps): Bump the go group across 1 directory with 21 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1956 * When encrypting, load the config only once by @felixfontein in https://github.com/getsops/sops/pull/1939 * build(deps): Bump the go group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/getsops/sops/pull/1958 * Ignore encryption selection options for binary store (and warn when they are used) by @felixfontein in https://github.com/getsops/sops/pull/1927 * AZKV: Also allow to omit version for AZKV keys specified in key groups by @felixfontein in https://github.com/getsops/sops/pull/1947 * Complex values in dotenv, and exec-env: do not print sensitive value in error message by @felixfontein in https://github.com/getsops/sops/pull/1959 * Release 3.11.0 by @felixfontein in https://github.com/getsops/sops/pull/1960 ## New Contributors * @md42 made their first contribution in https://github.com/getsops/sops/pull/1844 * @wasv made their first contribution in https://github.com/getsops/sops/pull/1863 * @inverted-tree made their first contribution in https://github.com/getsops/sops/pull/1881 * @EshemMimi made their first contribution in https://github.com/getsops/sops/pull/1885 * @bjornfor made their first contribution in https://github.com/getsops/sops/pull/1876 * @fredericrous made their first contribution in https://github.com/getsops/sops/pull/1897 * @longxiucai made their first contribution in https://github.com/getsops/sops/pull/1892 * @lucqui made their first contribution in https://github.com/getsops/sops/pull/1880 * @bruce-szalwinski-he made their first contribution in https://github.com/getsops/sops/pull/1936 * @sylr made their first contribution in https://github.com/getsops/sops/pull/1934 * @daogilvie made their first contribution in https://github.com/getsops/sops/pull/1919 * @billy4479 made their first contribution in https://github.com/getsops/sops/pull/1933 **Full Changelog**: https://github.com/getsops/sops/compare/v3.10.2...v3.11.0

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64 # Move the binary in to your PATH mv sops-v3.10.2.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.10.2.checksums.txt \ --certificate sops-v3.10.2.checksums.pem \ --signature sops-v3.10.2.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.10.2.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.2.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.2.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.2 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.2` - `ghcr.io/getsops/sops:v3.10.2-alpine` ### Quay.io - `quay.io/getsops/sops:v3.10.2` - `quay.io/getsops/sops:v3.10.2-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.2 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump the go group with 13 updates by @dependabot in https://github.com/getsops/sops/pull/1834 * Use latest 1.24 Go version for release build by @hiddeco in https://github.com/getsops/sops/pull/1836 * Remove reserved keyword check from YAML store's `LoadPlainFile()` by @felixfontein in https://github.com/getsops/sops/pull/1829 * build(deps): Bump the go group with 9 updates by @dependabot in https://github.com/getsops/sops/pull/1839 * build(deps): Bump github/codeql-action from 3.28.13 to 3.28.15 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1840 * Release 3.10.2 release by @felixfontein in https://github.com/getsops/sops/pull/1841 **Full Changelog**: https://github.com/getsops/sops/compare/v3.10.1...v3.10.2

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.linux.amd64 # Move the binary in to your PATH mv sops-v3.10.1.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.10.1.checksums.txt \ --certificate sops-v3.10.1.checksums.pem \ --signature sops-v3.10.1.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.10.1.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.1.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.1/sops-v3.10.1.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.1.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.1 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.1` - `ghcr.io/getsops/sops:v3.10.1-alpine` ### Quay.io - `quay.io/getsops/sops:v3.10.1` - `quay.io/getsops/sops:v3.10.1-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.1 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1826 * Release 3.10.1 by @felixfontein in https://github.com/getsops/sops/pull/1827 **Full Changelog**: https://github.com/getsops/sops/compare/v3.10.0...v3.10.1

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.linux.amd64 # Move the binary in to your PATH mv sops-v3.10.0.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.10.0.checksums.txt \ --certificate sops-v3.10.0.checksums.pem \ --signature sops-v3.10.0.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.10.0.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.0.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.0.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.0 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.0` - `ghcr.io/getsops/sops:v3.10.0-alpine` ### Quay.io - `quay.io/getsops/sops:v3.10.0` - `quay.io/getsops/sops:v3.10.0-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.0 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump alpine from 3.18 to 3.21 in /.release in the docker group across 1 directory by @dependabot in https://github.com/getsops/sops/pull/1700 * Convert changelog to MarkDown by @felixfontein in https://github.com/getsops/sops/pull/1741 * build(deps): Bump the go group with 7 updates by @dependabot in https://github.com/getsops/sops/pull/1743 * build(deps): Bump the go group with 9 updates by @dependabot in https://github.com/getsops/sops/pull/1745 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1744 * build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1746 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1751 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1750 * Add --input-type option for filestatus subcommand by @felixfontein in https://github.com/getsops/sops/pull/1601 * Use SOPS_EDITOR before EDITOR by @felixfontein in https://github.com/getsops/sops/pull/1611 * Allow users to disable version check via environment variable by @nicklasfrahm in https://github.com/getsops/sops/pull/1684 * add duplicate section support to ini store by @reindlt in https://github.com/getsops/sops/pull/1452 * stores: test for duplicate keys, reserve keyword (yaml only now) by @holiman in https://github.com/getsops/sops/pull/1203 * Add same process option for exec-env by @ricmatsui in https://github.com/getsops/sops/pull/880 * outputs: add trailing newline at the end of JSON files by @duthils in https://github.com/getsops/sops/pull/1476 * set subcommand: add --idempotent flag that will not write the file if no change happened by @felixfontein in https://github.com/getsops/sops/pull/1754 * Encrypt and decrypt time.Time objects by @felixfontein in https://github.com/getsops/sops/pull/1759 * build(deps): Bump the go group with 8 updates by @dependabot in https://github.com/getsops/sops/pull/1763 * build(deps): Bump tempfile from 3.16.0 to 3.17.0 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1762 * build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1761 * fix(docs): typo in README.rst by @Paredev in https://github.com/getsops/sops/pull/1765 * Add SSH support for age by @haoqixu in https://github.com/getsops/sops/pull/1692 * make sure that tests do not pick keys.txt from user's HOME dir by @tomaszduda23 in https://github.com/getsops/sops/pull/1766 * support for age identity with passphrase by @tomaszduda23 in https://github.com/getsops/sops/pull/1400 * build(deps): Bump the rust group in /functional-tests with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1768 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1769 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1770 * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 by @dependabot in https://github.com/getsops/sops/pull/1773 * feat: add age plugin support by @brianmcgee in https://github.com/getsops/sops/pull/1641 * Check GnuPG decryption result for non-empty size by @felixfontein in https://github.com/getsops/sops/pull/1776 * vendored age code: consolidate passphrase reading functionality by @felixfontein in https://github.com/getsops/sops/pull/1775 * Allow to encrypt and decrypt from stdin by @felixfontein in https://github.com/getsops/sops/pull/1690 * build(deps): Bump the go group with 11 updates by @dependabot in https://github.com/getsops/sops/pull/1784 * build(deps): Bump the ci group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1782 * build(deps): Bump serde_json from 1.0.139 to 1.0.140 in /functional-tests in the rust group; bump Rust to 1.85.0 by @dependabot in https://github.com/getsops/sops/pull/1783 * build(deps): Bump the go group with 13 updates by @dependabot in https://github.com/getsops/sops/pull/1797 * build(deps): Bump the rust group in /functional-tests with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1796 * build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1795 * build(deps): Bump the go group with 6 updates by @dependabot in https://github.com/getsops/sops/pull/1802 * build(deps): Bump tempfile from 3.18.0 to 3.19.0 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1800 * build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1801 * build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @dependabot in https://github.com/getsops/sops/pull/1806 * goreleaser: add windows arm64 by @duthils in https://github.com/getsops/sops/pull/1791 * Add a way to set sops config location via envvar by @sledzikowy in https://github.com/getsops/sops/pull/1701 * build(deps): Bump the go group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1809 * build(deps): Bump the ci group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1808 * build(deps): Bump tempfile from 3.19.0 to 3.19.1 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1807 * Support --config option in publish subcommand by @felixfontein in https://github.com/getsops/sops/pull/1779 * Fix caching of Metadata.DataKey by @felixfontein in https://github.com/getsops/sops/pull/1781 * Lint by @felixfontein in https://github.com/getsops/sops/pull/1780 * updatekeys subcommand: rename GroupQuorum to ShamirThreshold by @felixfontein in https://github.com/getsops/sops/pull/1631 * If --filename-override is specified, convert it to an absolute path same as regular filenames by @felixfontein in https://github.com/getsops/sops/pull/1793 * Add support for `oauth2.TokenSource` in GCP KMS by @matheuscscp in https://github.com/getsops/sops/pull/1794 * Added SOPS_AGE_KEY_CMD option to age, fixes #1323 by @danilobuerger in https://github.com/getsops/sops/pull/1811 * chore: omitempty metadata to reduce the size of stored config by @cgetzen in https://github.com/getsops/sops/pull/1571 * Improve Shamir Secret Sharing code by @felixfontein in https://github.com/getsops/sops/pull/1813 * Update all dependencies by @felixfontein in https://github.com/getsops/sops/pull/1814 * Run 'gofmt -w' on all .go files by @felixfontein in https://github.com/getsops/sops/pull/1817 * Add option to explicitly check for the latest version; deprecate current default of always doing that unless disabled by @felixfontein in https://github.com/getsops/sops/pull/1816 * Build using Go 1.24 and drop support for 1.22 by @hiddeco in https://github.com/getsops/sops/pull/1819 * Support `GOOGLE_OAUTH_ACCESS_TOKEN` for Google Cloud Platform by @marensofier in https://github.com/getsops/sops/pull/1578 * Warn about `.sops.yml` files found while searching for `.sops.yaml` by @felixfontein in https://github.com/getsops/sops/pull/1820 * Release 3.10.0 by @felixfontein in https://github.com/getsops/sops/pull/1815 * Added support for multiarch windows release binaries by @sabre1041 in https://github.com/getsops/sops/pull/1823 ## New Contributors * @reindlt made their first contribution in https://github.com/getsops/sops/pull/1452 * @ricmatsui made their first contribution in https://github.com/getsops/sops/pull/880 * @Paredev made their first contribution in https://github.com/getsops/sops/pull/1765 * @haoqixu made their first contribution in https://github.com/getsops/sops/pull/1692 * @brianmcgee made their first contribution in https://github.com/getsops/sops/pull/1641 * @sledzikowy made their first contribution in https://github.com/getsops/sops/pull/1701 * @matheuscscp made their first contribution in https://github.com/getsops/sops/pull/1794 * @danilobuerger made their first contribution in https://github.com/getsops/sops/pull/1811 * @cgetzen made their first contribution in https://github.com/getsops/sops/pull/1571 * @marensofier made their first contribution in https://github.com/getsops/sops/pull/1578 * @sabre1041 made their first contribution in https://github.com/getsops/sops/pull/1823 **Full Changelog**: https://github.com/getsops/sops/compare/v3.9.4...v3.10.0

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.linux.amd64 # Move the binary in to your PATH mv sops-v3.10.0.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.10.0.checksums.txt \ --certificate sops-v3.10.0.checksums.pem \ --signature sops-v3.10.0.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.10.0.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.10.0.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.10.0/sops-v3.10.0.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.10.0.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.10.0 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.10.0` - `ghcr.io/getsops/sops:v3.10.0-alpine` ### Quay.io - `quay.io/getsops/sops:v3.10.0` - `quay.io/getsops/sops:v3.10.0-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.10.0 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump alpine from 3.18 to 3.21 in /.release in the docker group across 1 directory by @dependabot in https://github.com/getsops/sops/pull/1700 * Convert changelog to MarkDown by @felixfontein in https://github.com/getsops/sops/pull/1741 * build(deps): Bump the go group with 7 updates by @dependabot in https://github.com/getsops/sops/pull/1743 * build(deps): Bump the go group with 9 updates by @dependabot in https://github.com/getsops/sops/pull/1745 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1744 * build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1746 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1751 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1750 * Add --input-type option for filestatus subcommand by @felixfontein in https://github.com/getsops/sops/pull/1601 * Use SOPS_EDITOR before EDITOR by @felixfontein in https://github.com/getsops/sops/pull/1611 * Allow users to disable version check via environment variable by @nicklasfrahm in https://github.com/getsops/sops/pull/1684 * add duplicate section support to ini store by @reindlt in https://github.com/getsops/sops/pull/1452 * stores: test for duplicate keys, reserve keyword (yaml only now) by @holiman in https://github.com/getsops/sops/pull/1203 * Add same process option for exec-env by @ricmatsui in https://github.com/getsops/sops/pull/880 * outputs: add trailing newline at the end of JSON files by @duthils in https://github.com/getsops/sops/pull/1476 * set subcommand: add --idempotent flag that will not write the file if no change happened by @felixfontein in https://github.com/getsops/sops/pull/1754 * Encrypt and decrypt time.Time objects by @felixfontein in https://github.com/getsops/sops/pull/1759 * build(deps): Bump the go group with 8 updates by @dependabot in https://github.com/getsops/sops/pull/1763 * build(deps): Bump tempfile from 3.16.0 to 3.17.0 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1762 * build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1761 * fix(docs): typo in README.rst by @Paredev in https://github.com/getsops/sops/pull/1765 * Add SSH support for age by @haoqixu in https://github.com/getsops/sops/pull/1692 * make sure that tests do not pick keys.txt from user's HOME dir by @tomaszduda23 in https://github.com/getsops/sops/pull/1766 * support for age identity with passphrase by @tomaszduda23 in https://github.com/getsops/sops/pull/1400 * build(deps): Bump the rust group in /functional-tests with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1768 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1769 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1770 * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 by @dependabot in https://github.com/getsops/sops/pull/1773 * feat: add age plugin support by @brianmcgee in https://github.com/getsops/sops/pull/1641 * Check GnuPG decryption result for non-empty size by @felixfontein in https://github.com/getsops/sops/pull/1776 * vendored age code: consolidate passphrase reading functionality by @felixfontein in https://github.com/getsops/sops/pull/1775 * Allow to encrypt and decrypt from stdin by @felixfontein in https://github.com/getsops/sops/pull/1690 * build(deps): Bump the go group with 11 updates by @dependabot in https://github.com/getsops/sops/pull/1784 * build(deps): Bump the ci group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1782 * build(deps): Bump serde_json from 1.0.139 to 1.0.140 in /functional-tests in the rust group; bump Rust to 1.85.0 by @dependabot in https://github.com/getsops/sops/pull/1783 * build(deps): Bump the go group with 13 updates by @dependabot in https://github.com/getsops/sops/pull/1797 * build(deps): Bump the rust group in /functional-tests with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1796 * build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1795 * build(deps): Bump the go group with 6 updates by @dependabot in https://github.com/getsops/sops/pull/1802 * build(deps): Bump tempfile from 3.18.0 to 3.19.0 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1800 * build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1801 * build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @dependabot in https://github.com/getsops/sops/pull/1806 * goreleaser: add windows arm64 by @duthils in https://github.com/getsops/sops/pull/1791 * Add a way to set sops config location via envvar by @sledzikowy in https://github.com/getsops/sops/pull/1701 * build(deps): Bump the go group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1809 * build(deps): Bump the ci group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1808 * build(deps): Bump tempfile from 3.19.0 to 3.19.1 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1807 * Support --config option in publish subcommand by @felixfontein in https://github.com/getsops/sops/pull/1779 * Fix caching of Metadata.DataKey by @felixfontein in https://github.com/getsops/sops/pull/1781 * Lint by @felixfontein in https://github.com/getsops/sops/pull/1780 * updatekeys subcommand: rename GroupQuorum to ShamirThreshold by @felixfontein in https://github.com/getsops/sops/pull/1631 * If --filename-override is specified, convert it to an absolute path same as regular filenames by @felixfontein in https://github.com/getsops/sops/pull/1793 * Add support for `oauth2.TokenSource` in GCP KMS by @matheuscscp in https://github.com/getsops/sops/pull/1794 * Added SOPS_AGE_KEY_CMD option to age, fixes #1323 by @danilobuerger in https://github.com/getsops/sops/pull/1811 * chore: omitempty metadata to reduce the size of stored config by @cgetzen in https://github.com/getsops/sops/pull/1571 * Improve Shamir Secret Sharing code by @felixfontein in https://github.com/getsops/sops/pull/1813 * Update all dependencies by @felixfontein in https://github.com/getsops/sops/pull/1814 * Run 'gofmt -w' on all .go files by @felixfontein in https://github.com/getsops/sops/pull/1817 * Add option to explicitly check for the latest version; deprecate current default of always doing that unless disabled by @felixfontein in https://github.com/getsops/sops/pull/1816 * Build using Go 1.24 and drop support for 1.22 by @hiddeco in https://github.com/getsops/sops/pull/1819 * Support `GOOGLE_OAUTH_ACCESS_TOKEN` for Google Cloud Platform by @marensofier in https://github.com/getsops/sops/pull/1578 * Warn about `.sops.yml` files found while searching for `.sops.yaml` by @felixfontein in https://github.com/getsops/sops/pull/1820 * Release 3.10.0 by @felixfontein in https://github.com/getsops/sops/pull/1815 ## New Contributors * @reindlt made their first contribution in https://github.com/getsops/sops/pull/1452 * @ricmatsui made their first contribution in https://github.com/getsops/sops/pull/880 * @Paredev made their first contribution in https://github.com/getsops/sops/pull/1765 * @haoqixu made their first contribution in https://github.com/getsops/sops/pull/1692 * @brianmcgee made their first contribution in https://github.com/getsops/sops/pull/1641 * @sledzikowy made their first contribution in https://github.com/getsops/sops/pull/1701 * @matheuscscp made their first contribution in https://github.com/getsops/sops/pull/1794 * @danilobuerger made their first contribution in https://github.com/getsops/sops/pull/1811 * @cgetzen made their first contribution in https://github.com/getsops/sops/pull/1571 * @marensofier made their first contribution in https://github.com/getsops/sops/pull/1578 **Full Changelog**: https://github.com/getsops/sops/compare/v3.9.4...v3.10.0

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64 # Move the binary in to your PATH mv sops-v3.9.4.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.9.4.checksums.txt \ --certificate sops-v3.9.4.checksums.pem \ --signature sops-v3.9.4.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.9.4.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.9.4.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.9.4.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.9.4 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.9.4` - `ghcr.io/getsops/sops:v3.9.4-alpine` ### Quay.io - `quay.io/getsops/sops:v3.9.4` - `quay.io/getsops/sops:v3.9.4-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.9.4 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump the go group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1727 * build(deps): Bump tempfile from 3.14.0 to 3.15.0 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1728 * build(deps): Bump the go group with 16 updates by @dependabot in https://github.com/getsops/sops/pull/1732 * build(deps): Bump the ci group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1730 * build(deps): Bump serde_json from 1.0.134 to 1.0.135 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1731 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1734 * build(deps): Bump serde_json from 1.0.135 to 1.0.137 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1735 * Fix ToString for AWS KMS to include role, context, and profile by @felixfontein in https://github.com/getsops/sops/pull/1733 * build(deps): Bump the ci group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1738 * build(deps): Bump the go group with 6 updates by @dependabot in https://github.com/getsops/sops/pull/1739 * Release 3.9.4 by @felixfontein in https://github.com/getsops/sops/pull/1740 **Full Changelog**: https://github.com/getsops/sops/compare/v3.9.3...v3.9.4

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 # Move the binary in to your PATH mv sops-v3.9.3.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.9.3.checksums.txt \ --certificate sops-v3.9.3.checksums.pem \ --signature sops-v3.9.3.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.9.3.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.9.3.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.9.3.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.9.3 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.9.3` - `ghcr.io/getsops/sops:v3.9.3-alpine` ### Quay.io - `quay.io/getsops/sops:v3.9.3` - `quay.io/getsops/sops:v3.9.3-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.9.3 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * build(deps): Bump the go group with 10 updates by @dependabot in https://github.com/getsops/sops/pull/1699 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1698 * build(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @dependabot in https://github.com/getsops/sops/pull/1703 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1708 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1707 * CI: add 'persist-credentials: false' to checkout actions by @felixfontein in https://github.com/getsops/sops/pull/1704 * build(deps): Bump filippo.io/age from 1.2.0 to 1.2.1 by @dependabot in https://github.com/getsops/sops/pull/1710 * Bump golang.org/x/net to 0.33.0 to address CVE-2024-45338 by @felixfontein in https://github.com/getsops/sops/pull/1714 * build(deps): Bump the go group across 1 directory with 13 updates by @dependabot in https://github.com/getsops/sops/pull/1715 * build(deps): Bump serde_json from 1.0.133 to 1.0.134 in /functional-tests in the rust group by @dependabot in https://github.com/getsops/sops/pull/1716 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1717 * GnuPG: do not incorrectly trim fingerprint in presence of exclamation marks for specfic subkey selection by @felixfontein in https://github.com/getsops/sops/pull/1720 * Tests: use container images from https://github.com/getsops/ci-container-images by @felixfontein in https://github.com/getsops/sops/pull/1722 * updatekeys subcommand: fix input-type CLI flag being ignored by @felixfontein in https://github.com/getsops/sops/pull/1721 * Update all Go dependencies by @felixfontein in https://github.com/getsops/sops/pull/1723 * build(deps): Bump the rust group in /functional-tests with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1725 * Release 3.9.3 by @felixfontein in https://github.com/getsops/sops/pull/1724 **Full Changelog**: https://github.com/getsops/sops/compare/v3.9.2...v3.9.3

## Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell # Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.amd64 # Move the binary in to your PATH mv sops-v3.9.1.linux.amd64 /usr/local/bin/sops # Make the binary executable chmod +x /usr/local/bin/sops ``` ### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell # Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.sig # Verify the checksums file cosign verify-blob sops-v3.9.1.checksums.txt \ --certificate sops-v3.9.1.checksums.pem \ --signature sops-v3.9.1.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell # Verify the binary using the checksums file sha256sum -c sops-v3.9.1.checksums.txt --ignore-missing ``` ### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.9.1.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell # Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.intoto.jsonl # Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.9.1.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.9.1 ``` ## Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ### GitHub Container Registry - `ghcr.io/getsops/sops:v3.9.1` - `ghcr.io/getsops/sops:v3.9.1-alpine` ### Quay.io - `quay.io/getsops/sops:v3.9.1` - `quay.io/getsops/sops:v3.9.1-alpine` ### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.9.1 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). ## Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. ## What's Changed * Explicitly mark goreleaser's version, to avoid confusion with the Go version by @felixfontein in https://github.com/getsops/sops/pull/1548 * build(deps): Bump the go group with 8 updates by @dependabot in https://github.com/getsops/sops/pull/1550 * build(deps): Bump github/codeql-action from 3.25.10 to 3.25.11 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1551 * Fix the URL used for determining the latest SOPS version by @felixfontein in https://github.com/getsops/sops/pull/1553 * build(deps): Bump the ci group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1555 * build(deps): Bump the go group with 11 updates by @dependabot in https://github.com/getsops/sops/pull/1554 * build(deps): Bump the go group with 10 updates by @dependabot in https://github.com/getsops/sops/pull/1558 * build(deps): Bump the ci group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1559 * build(deps): Bump the go group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1562 * build(deps): Bump the ci group across 1 directory with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1564 * build(deps): Bump the go group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1565 * build(deps): Bump github/codeql-action from 3.25.13 to 3.25.15 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1566 * build(deps): Bump github.com/docker/docker from 27.0.1+incompatible to 27.1.0+incompatible by @dependabot in https://github.com/getsops/sops/pull/1568 * build(deps): Bump the go group with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1575 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1574 * build(deps): Bump github.com/docker/docker from 27.1.0+incompatible to 27.1.1+incompatible by @dependabot in https://github.com/getsops/sops/pull/1581 * build(deps): Bump the ci group with 3 updates by @dependabot in https://github.com/getsops/sops/pull/1584 * Note on the name of the configuration file by @ErraticMaker in https://github.com/getsops/sops/pull/1569 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1586 * build(deps): Bump the go group across 1 directory with 15 updates by @dependabot in https://github.com/getsops/sops/pull/1589 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1590 * build(deps): Bump the go group with 7 updates by @dependabot in https://github.com/getsops/sops/pull/1593 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1592 * tests: ignore env var SOPS_AGE_KEY_FILE by @duthils in https://github.com/getsops/sops/pull/1595 * build(deps): Bump the go group with 12 updates by @dependabot in https://github.com/getsops/sops/pull/1602 * build(deps): Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 by @dependabot in https://github.com/getsops/sops/pull/1603 * updatekeys subcommand: actually use option `--shamir-secret-sharing-threshold` by @felixfontein in https://github.com/getsops/sops/pull/1608 * Added example of having age recipients in .sops.yaml by @felixfontein in https://github.com/getsops/sops/pull/1607 * GitHub Actions linter for Rust formatting by @duthils in https://github.com/getsops/sops/pull/1604 * github actions: set rust version globally by @duthils in https://github.com/getsops/sops/pull/1612 * Fix `--config` being ignored by `loadConfig` by @lopter in https://github.com/getsops/sops/pull/1613 * build(deps): Bump the go group with 4 updates by @dependabot in https://github.com/getsops/sops/pull/1618 * build(deps): Bump github/codeql-action from 3.26.6 to 3.26.7 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1619 * unit tests: add coverage for unset by @duthils in https://github.com/getsops/sops/pull/1617 * sops_test: homogenize use of asserts by @duthils in https://github.com/getsops/sops/pull/1622 * sops_test: add more tests on errors by @duthils in https://github.com/getsops/sops/pull/1624 * Add 'check' task to CI that makes sure everything is green by @felixfontein in https://github.com/getsops/sops/pull/1621 * build(deps): Bump the go group with 10 updates by @dependabot in https://github.com/getsops/sops/pull/1629 * build(deps): Bump github/codeql-action from 3.26.7 to 3.26.8 in the ci group by @dependabot in https://github.com/getsops/sops/pull/1628 * refactor: specify missing file in error message by @t3hmrman in https://github.com/getsops/sops/pull/1625 * CI: Build with Go 1.22 and 1.23; update Vault to 1.14 by @reneleonhardt in https://github.com/getsops/sops/pull/1531 * Allow edit subcommand to create files by @felixfontein in https://github.com/getsops/sops/pull/1596 * Build release with Go 1.22.x by @felixfontein in https://github.com/getsops/sops/pull/1615 * GHA: fix checkout action version by @felixfontein in https://github.com/getsops/sops/pull/1630 * Do not encrypt if a key group is empty, or there are no key groups by @felixfontein in https://github.com/getsops/sops/pull/1600 * updatekeys subcommand: show changes in shamir_threshold by @felixfontein in https://github.com/getsops/sops/pull/1609 * Dependabot: fix config for Docker, add config for Rust/Cargo by @felixfontein in https://github.com/getsops/sops/pull/1632 * build(deps): Bump the ci group with 2 updates by @dependabot in https://github.com/getsops/sops/pull/1634 * build(deps): Bump the go group with 7 updates by @dependabot in https://github.com/getsops/sops/pull/1635 * Add Cargo.lock for better reproducability of functional tests by @felixfontein in https://github.com/getsops/sops/pull/1637 * build(deps): Bump the go group with 7 updates by @dependabot in https://github.com/getsops/sops/pull/1639 * build(deps): Bump the rust group in /functional-tests with 5 updates by @dependabot in https://github.com/getsops/sops/pull/1638 * Update all go deps with 'go get -t -u ./...' by @felixfontein in https://github.com/getsops/sops/pull/1640 * Do not ignore errors when trying to parse a config file by @felixfontein in https://github.com/getsops/sops/pull/1614 * Release 3.9.1 by @felixfontein in https://github.com/getsops/sops/pull/1642 ## New Contributors * @ErraticMaker made their first contribution in https://github.com/getsops/sops/pull/1569 * @lopter made their first contribution in https://github.com/getsops/sops/pull/1613 * @t3hmrman made their first contribution in https://github.com/getsops/sops/pull/1625 * @reneleonhardt made their first contribution in https://github.com/getsops/sops/pull/1531 **Full Changelog**: https://github.com/getsops/sops/compare/v3.9.0...v3.9.1