spb/tools-spboucher-ai

1{2  "slug": "sops",3  "name": "SOPS",4  "aliases": ["Mozilla SOPS", "Secrets OPerationS", "getsops"],5  "vendor": { "name": "SOPS project (CNCF)", "slug": "getsops", "website": "https://getsops.io" },6  "homepage_url": "https://getsops.io/",7  "docs_url": "https://getsops.io/docs/",8  "repo_url": "https://github.com/getsops/sops",9  "license_url": "https://github.com/getsops/sops/blob/main/LICENSE",10  "product_type": "cli-tool",11  "product_status": "active",12  "summary": "Command-line tool that encrypts the values of YAML, JSON, ENV and INI files with age, PGP or cloud KMS keys so secrets can be committed to git",13  "description": "SOPS is an open-source editor and encryption tool, originally created at Mozilla and now hosted under the getsops organization as a CNCF project, licensed under MPL-2.0. It encrypts only the values of structured files, leaving keys and structure readable, so an encrypted Kubernetes manifest or `.env` file still diffs sensibly in version control. Data keys are wrapped by one or more master keys: age or PGP keys for offline use, or AWS KMS, Google Cloud KMS, Azure Key Vault and HashiCorp Vault for identity-based access in the cloud.\n\nA `.sops.yaml` file maps path patterns to key sets, so a team can declare which identities may decrypt which files. `sops edit` opens the decrypted content in an editor and re-encrypts on save, `sops exec-env` runs a command with the decrypted values in its environment, and integrations exist for Flux, Helm, Ansible and Terraform.\n\nIt is a good fit for small teams who want secrets alongside code without running a server. It offers no dynamic secrets, rotation or audit trail beyond git history, and decrypted values end up on disk or in memory wherever they are used.",14  "capabilities": ["Value-level encryption of YAML, JSON, ENV, INI and binary files", "Master keys from age, PGP, AWS KMS, GCP KMS, Azure Key Vault and HashiCorp Vault", "Creation rules in .sops.yaml mapping paths to key groups", "Editor workflow and exec-env/exec-file commands", "Key rotation and multi-key groups with Shamir thresholds"],15  "workflows": ["Commit encrypted Kubernetes secrets to a GitOps repository", "Share a team .env file encrypted to each member's age key", "Decrypt configuration at deploy time with a cloud KMS identity"],16  "advantages": ["No server to operate", "Readable diffs of encrypted files", "Works offline with age or PGP"],17  "limitations": ["No dynamic secrets, rotation automation or access audit", "Decrypted values live on the consuming host", "Key management is left to the user or cloud KMS"],18  "prerequisites": ["age or PGP key, or access to a cloud KMS"],19  "audiences": ["Developers practicing GitOps", "Small teams avoiding a secrets server"],20  "alternatives": ["hashicorp-vault", "infisical", "1password"],21  "comparison_notes": "Vault and Infisical centralize secrets in a service with access control and dynamic credentials; SOPS keeps them in the repository and relies on key custody. 1Password's CLI can play a similar injection role for teams already using it.",22  "categories": [{ "slug": "secrets-management", "primary": true }],23  "tags": ["secrets", "encryption", "gitops", "cli", "open-source", "cncf", "kubernetes"],24  "use_cases": ["store-secrets"],25  "operating_systems": ["linux", "macos", "windows"],26  "execution_modes": ["local"],27  "interfaces": ["cli"],28  "deployment_models": ["desktop"],29  "integrations": ["age", "GnuPG", "AWS KMS", "Google Cloud KMS", "Azure Key Vault", "HashiCorp Vault", "Flux", "Helm", "Ansible"],30  "data_formats": ["YAML", "JSON", "ENV", "INI", "binary"],31  "languages": ["Go"],32  "source_model": "open-source",33  "license_spdx": "MPL-2.0",34  "pricing_model": ["open-source", "free"],35  "self_hostable": true,36  "sources": [37    { "url": "https://getsops.io/", "type": "official_site", "title": "SOPS: Secrets OPerationS", "supports": ["name", "summary", "capabilities"], "checked_at": "2026-11-02" },38    { "url": "https://getsops.io/docs/", "type": "official_docs", "title": "SOPS Documentation", "supports": ["capabilities", "data_formats", "integrations"], "checked_at": "2026-11-02" },39    { "url": "https://github.com/getsops/sops/blob/main/LICENSE", "type": "license_page", "title": "SOPS LICENSE (MPL-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" }40  ],41  "confidence": "high",42  "discovery_method": "editorial-research",43  "depth": "standard",44  "editorial_status": "reviewed",45  "visibility": "public",46  "featured": false,47  "author": "batch-B2"48}49