Cipherleaf — a native macOS editor for age-encrypted SOPS files

[luzanovdm]

Hi! I've been working on Cipherleaf, an open-source macOS editor for existing SOPS documents encrypted with native age recipients.

I made it for a fairly specific workflow: changing one or two values without making a general-purpose editor or IDE the place where I handle the decrypted document. The app shows scalar paths, keeps values concealed until I reveal them, and shows a path-only change review before saving.
There are already editor and IDE integrations for SOPS. Cipherleaf isn't trying to replace them; if they fit your workflow, they're probably the simpler choice. This is another option for people who want a focused Mac app with a few checks around the edit: it confirms that the selected identity matches the document recipients, rejects externally changed files, preserves the existing recipient set, and verifies the staged document before atomically replacing the original ciphertext.
It currently supports existing YAML, JSON, and dotenv documents. Plaintext stays in memory and pipes; the app doesn't create a decrypted working file. Changes go through sops set --value-stdin and sops unset, and the age identity file remains at the path selected by the user. Cipherleaf doesn't create identities or encrypted documents, and it doesn't manage recipient rotation.
Project, installation instructions, and security model:
https://github.com/luzanovdm/cipherleaf

It's still a small project. I'd be glad to hear about files it doesn't handle correctly, rough edges in the workflow, or concerns with the security model.

Cipherleaf is independent and is not affiliated with the SOPS project.

[Dexmachi]

This has such a cool interface! I wish I could use something like this on Linux, it looks like a password manager

I like how you call the sops file the "policy", it matches how I use them perfectly