1. The shape of a SOPS-encrypted file
Write what a SOPS-encrypted YAML looks like — KEYS stay readable, VALUES are ENC[...] ciphertext, plus a `sops` metadata block: • db_password: ENC[AES256_GCM,data:9aXb,type:str] • api_key: ENC[AES256_GCM,data:7yTz,type:str] • sops: – version: "3.8.1" – age: a list of ONE recipient entry with a `recipient:` field (any age1... string)
SOPS encrypts only the VALUES, leaving keys readable so the file still diffs cleanly in a pull request. Each value becomes an ENC[...] string. The `sops:` block is non-secret bookkeeping: the algorithm, a MAC for tamper-detection, the version, and — per backend — the WRAPPED data key. Here the backend is `age`, so `sops.age` lists the recipients who can decrypt. Any one configured recipient (or KMS key) can unwrap the file.