getsops/sops

SOPS, short for Secrets OPerationS, is a command-line tool for safely keeping configuration secrets, passwords, API keys, certificates, inside ordinary text files that you can commit to a code repository. The problem it solves is that real applications need these values in files like YAML, JSON, ENV, INI, or binary blobs, but checking those files in unencrypted leaks the secrets, and encrypting the whole file as one opaque blob makes diffs and code review unreadable. SOPS encrypts only the values, leaving the keys and overall structure visible, so a teammate can see that there is a "db.password" field and how it relates to neighbouring settings without ever seeing its cleartext contents. The way it works is described in the README. Each secret value is wrapped with AES-256-GCM, and the underlying data key used for that encryption is itself encrypted once per recipient using one or more external key services: AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, the age encryption tool, or PGP. Each recipient's wrapped copy of the key is stored in a "sops" section at the bottom of the file. As long as one of those methods is still usable, the file can be decrypted, which makes key rotation and multi-team access straightforward. The everyday workflow is essentially one command, "sops edit", which decrypts the file into your usual editor, watches for changes, and re-encrypts on save. There is also a Go library for decrypting from inside another application. You would use SOPS to keep production credentials in git alongside the infrastructure code that needs them, with permissions enforced by the cloud key service rather than by ad-hoc sharing. It is written in Go.