age (https://age-encryption.org/) for encryption

[jimmycuadra]

Any thoughts on including age as an alternative for PGP encryption?

[jvehent]

many thoughts :) most of them positive. That would also give us support for ssh key encryption, which is nice. any volunteers?

[jimmycuadra]

I don't enjoy Go much so I don't relish the idea of working on it myself, but I do love sops and would like to support it, so I might look into it. Is there a guide or some general pointers on introducing new encryption mechanisms?

[jvehent]

it's not a guide, but my PR on adding support for naclbox may be a good starting point: #569

[jimmycuadra]

Seems not possible right now, as the library parts of age are in an "internal package." I don't know Go well enough to have realized this before attempting to integrate it into sops for an hour or so. 🤦‍♂

[dadrian]

@jvehent Would you be amenable to an implementation that shells out to age, similar to how the PGP implementation works?

[jvehent]

The main issue is figuring out how to install that binary, as many users will only install sops and not age. gpg, by comparison, ships by default on most systems. But without that caveat, it is indeed an option.

@FiloSottile Do you have any plans to make age usable as a Go package?

[FiloSottile]

@FiloSottile Do you have any plans to make age usable as a Go package?

Yup, 100%! I have been slacking on it, but I'll work on it next week.

[thib92]

There is an open PR on age aiming to expose the internal methods so that it can be used as a library by any Go program. Good thing sops is in Go too :)

Once this is merged, I'd be happy to give it a try!

[jmhodges]

Age now has a library! https://pkg.go.dev/filippo.io/age@v1.0.0-beta4?tab=doc

Announcement from Filippo: https://twitter.com/FiloSottile/status/1277052167006945281?s=20

[jimmycuadra]

Basic support added in #688!

[supermarin]

Can someone close this issue? it's been resolved and the implementation is in develop

[si14]

Is there a chance this will get released soon? Or is using develop the official recommendation for the time being?