What's new in 2.0.0
2.0 lets every member keep their key where it suits them, inside the bounds the repository sets. It adds commands that change one secret or feed secrets straight to a process, and it is honest about what rotating a key does and does not change.
Your key lives in the Secure Enclave (on-chip), a YubiKey (external hardware), the OS keychain or a plaintext file. init records which stores members may use, hardware only by default, and --store auto picks the strongest one your machine has. Hardware always comes before software, whatever order the list is in.
sopsy asks you to plug the YubiKey in instead of failing, reminds you to touch it after the PIN, and caches the PIN for the session with -c cached. Making a key without your YubiKey on you? Press e to use the Secure Enclave instead. Several keys fit on one YubiKey; pick one with --yubikey-slot.
sopsy run decrypts into the environment of one command and writes nothing to disk. One Touch ID per launch, not one per shell or per worktree. Exit codes and signals are the command's own.
sopsy set KEY asks for the value with hidden input, or reads it from stdin, so it never lands in your shell history or a process listing. sopsy unset removes a key. set needs sops 3.11 or newer.
sopsy recipient rotate replaces your key under the same name and approval: move to another store or YubiKey slot, or change a PIN or touch policy. It changes who can unwrap the data key, not the data key itself. After a lost or stolen key, add --new-data-key, then change the secret values.
Removing a recipient re-wraps the data key but keeps it, so anyone who decrypted before still could. sopsy rotate-data-key re-encrypts every managed file under a brand-new data key for the current recipients. Run it after offboarding, then commit.
sopsy deps installs whatever is missing: sops, age, age-plugin-se, age-plugin-yubikey and ykman. init runs it first (--skip-deps turns it off), and an interactive init sets up the break-glass key by default.
sopsy yubikey and sopsy enclave pass your arguments straight to age-plugin-yubikey and age-plugin-se, so you never need to remember the plugin's name.