Reject completely empty documents.

This only affects empty YAML files, since only these can contain zero documents.

Signed-off-by: Felix Fontein <felix@fontein.de>

cmd/sops/codes/codes.go

@@ -21,6 +21,7 @@ const (
 	ConfigFileNotFound                     int = 61
 	KeyboardInterrupt                      int = 85
 	InvalidTreePathFormat                  int = 91
+	NeedAtLeastOneDocument                 int = 92
 	NoFileSpecified                        int = 100
 	CouldNotRetrieveKey                    int = 128
 	NoEncryptionKeyFound                   int = 111

cmd/sops/encrypt.go

@@ -64,6 +64,9 @@ func encrypt(opts encryptOpts) (encryptedFile []byte, err error) {
 	if err != nil {
 		return nil, common.NewExitError(fmt.Sprintf("Error unmarshalling file: %s", err), codes.CouldNotReadInputFile)
 	}
+	if len(branches) < 1 {
+		return nil, common.NewExitError("File cannot be completely empty, it must contain at least one document", codes.NeedAtLeastOneDocument)
+	}
 	if err := ensureNoMetadata(opts, branches[0]); err != nil {
 		return nil, common.NewExitError(err, codes.FileAlreadyEncrypted)
 	}