path_regex is matching on relative path of working directory only

[kentso]

I have such set up in .sops.yaml which is located in the project root:

creation_rules:
    - path_regex: .*staging.*
      key_groups:
      - kms:
        - arn: 'arn:aws:kms:*:**:key/aa'
          role: arn:aws:iam::**:role/staging-role
          context:
            Environment: staging

    - path_regex: .*production.*
      key_groups:
      - kms:
        - arn: 'arn:aws:kms:*:**:key/aa'
          role: arn:aws:iam::**:role/production-role
          context:
            Environment: production

    - kms: 'arn:aws:kms:*:**:key/bb'

When I try to encrypt my secret

• current working director: <project_root>/asia/production/a/b/c/
• command: sops secrets.enc.yaml

The encrypted file did not use the expected rule for production, instead it used the fallback rule which is using kms key arn:aws:kms:*:**:key/bb.

To make this work, I need to specify the matching regex part in the path like this:

• current working director: <project_root>/asia/production/a/b/c/
• command: sops ../../../../production/a/b/c/secrets.enc.yaml

or

• current working director: <project_root>/
• command: sops asia/production/a/b/c/secrets.enc.yaml

i.e. production must be in the path passing to sops.

There is no extra explanation in README saying what path path_regex is matching to.
https://github.com/mozilla/sops#using-sops-yaml-conf-to-select-kms-pgp-for-new-files

I am expecting path_regex with be matching the path starting from the .sops.yaml it belongs to. Then my first case will work as expected.

PS. I have not tested but I think it is possible to create a .sops.yaml under every environment (e.g. /asia/prodcution/.sops.yaml, /eu/staging/.sops.yaml) to achieve what I want to do. However it will be tedious as the environment combination can grow large.

[autrilla]

This is kind of like #242

[autrilla]

I think a simple solution that would do what you want is expanding the path here:

https://github.com/mozilla/sops/blob/8f804bce1c96267fac61278e98f462f9413cda37/cmd/sops/main.go#L433

Such that for instance if you call sops secrets.enc.yaml, it would evaluate secrets.enc.yaml to the full path.

[kentso]

Thanks for the answer.
I have created a pull request #466
Can you have a check?

[autrilla]

Fixed by #466