sopsy 2.0 · Secure Enclave · YubiKey · macOS + Linux
Secrets live in Git. Keys live in hardware.
Grace bootstraps the repo with a YubiKey
$ sopsy init -s yubikey- sopsy asks the YubiKey to create a private key inside one of its PIV slots. Grace types her PIN and touches the key.
- Only the public recipient comes back. The private key never leaves the YubiKey.
- sopsy writes the SOPS rules, the member list with Grace as admin, and a checksum that flags hand edits.
- It seeds an encrypted .env.encrypted and gitignores the plaintext .env, so it can never be committed by mistake.
Alan joins with his Mac, Grace approves
$ sopsy join "Alan Turing"$ sopsy approve "Alan Turing"- On Alan's Mac, sopsy join creates a key inside the Secure Enclave, unlocked by Touch ID.
- Alan's public recipient comes back. His private key stays in the chip.
- His key lands in .sopsy.yml as pending, on a branch, and he opens a pull request. He has no access yet.
- Grace, already a member, checks out the branch and runs sopsy approve.
- Her YubiKey unwraps the file's data key after a PIN and a touch. No plaintext is written to disk.
- sops re-wraps the data key for every member, now including Alan.
- Grace pushes the approval. Once the pull request merges, Alan can decrypt with Touch ID.
Encrypt .env into .env.encrypted
$ sopsy encrypt .env -o .env.encrypted- sopsy reads the plaintext .env from your working copy. It is gitignored and never leaves your machine.
- The recipients come from .sops.yaml: every member's public key plus the break-glass key.
- sops + age encrypt each value for every recipient. Names stay readable, so diffs and git blame still work.
- Commit .env.encrypted. sopsy check fails CI if a plaintext secret is ever tracked.
No hardware needed: encryption uses public keys only.
A CLI for SOPS · age · Secure Enclave · YubiKey
macOS + Linux ·new in v2.0.0 →
Encrypted secrets you can actually commit to Git.
Decrypt with Touch ID or a YubiKey
Plaintext is never in the repo, never in Slack. Sleep soundly at night.
sopsy encrypts the secrets in your .env, .yml, and .json files — values only, names left in the clear. The file stays diffable and git blame-able, so you can see exactly when each key appeared and who added it, then commit the whole thing without flinching. By default every teammate's key is minted in hardware: their Mac's Secure Enclave, or a YubiKey on Intel Macs and Linux. The repository's policy decides whether the OS keychain is allowed for machines with neither.
Hardware keys decrypt with Touch ID, or a YubiKey PIN and a touch. The private key never leaves the chip, and any current member can grant the next one access. sopsy run hands the secrets straight to your app, with no plaintext file at all. No server. No subscription. No plaintext in Slack — or anywhere for that matter.
Built on SOPS + age — the encryption tools teams already trust. sopsy just makes them delightful.
Further reading
Everything you need to run it for real.
Member guide
Join a sopsy-managed repo with sopsy join, get approved, the day-to-day workflow, and troubleshooting.
read ↗Owner guide
Bootstrap a repo, the join/approve membership lifecycle, offboarding, and break-glass procedures.
read ↗crates.io
Install with cargo, browse versions, and read the published crate metadata.
read ↗docs.rs
The full API documentation for the sopsy crate, generated from source.
read ↗Make SOPS delightful.
Small, fast, colorful, and macOS-first. Your secrets stay in Git — encrypted — while the key that decrypts them never leaves the chip.