Decrypting JSON files with a filename suffix other than .json displays blank output

[bhourigan]

This could be a known limitation and improper usage on my part, but I ran into an issue while encrypting a json file and redirecting the encrypted version to test.json.enc.

Creating a new file via sops test.json works as expected
Encrypting a file in place with sops -i -e test.json works as expected
Encrypting a file with sops -e test.json > test.json.enc renders the file unreadable, until test.json.enc is renamed to <something>.json

Steps to reproduce:

bash-3.2$ cat test.json
{
   "bar": "baz",
   "foo": ""
}
bash-3.2$ sops -e test.json > test.json.enc
please wait while a data encryption key is being generated and stored securely
bash-3.2$ sops -d test.json.enc
bash-3.2$ cat test.json.enc
{
    "bar": "ENC[AES256_GCM,data:XBgd,iv:RuJg8xWgkyvsDQb+u8zMzuVsB0OpWyAbsUi9xz8T0Ms=,tag:XTmtCVJ/nzsUr7c7zzbKtA==,type:str]",
    "foo": "ENC[AES256_GCM,data:,iv:5HPcYQ9i+ntnEklmLyY7fYAiPDWlGPOyagu238gE7hY=,tag:ZAlB6zZrgz9iXASjrcP5bg==,type:str]",
    "sops": {
        "lastmodified": "2016-02-03T16:40:59Z",
        "attention": "This section contains key material that should only be modified with extra care. See `sops -h`.",
        "mac": "ENC[AES256_GCM,data:sPBMhe9F3Bm1kGwO/kQvF295nVHKSaUzq/usH1V3yF3e1G1FTyt2FUx5HuX/nYuu5OqWpWzWoWNDqMYB1Rfyz3ZdWxhph0NT5X7HH7TSSadMtSib5HevgI6BJnUCmlcBuNPX6GWMQHPA3kN/yMGcjJAYD2r6Qd+s/vip9xT0Hxs=,iv:W6dUFubWGsaWLKdfgIWsQKe7heHmT7+Iuzyduu/AUy8=,tag:T9ugdVlJR/22kvAibwR2Qw==,type:str]",
        "version": 1.4,
        "kms": [
REDACTED
        ],
        "pgp": [
REDACTED
        ]
    }
}
bash-3.2$ sops --help | grep Version
Version 1.4 - See the Readme at github.com/mozilla/sops

[jvehent]

This is expected, but not documented. sops uses the file extension to figure out which encryption/decryption method to use. yaml and json treat the files as data trees, whereas everything else is treated as a binary blob.

You encrypted the file with a json extension, which treated it as a data tree, but attempted to decrypt with a enc extension, or binary blob, which failed because the expected format wasn't present.

If you want to change the extension of a file without changing its type, you need to use --input-type and --output-type.

I'll add some documentation. Thanks for reporting it 👍