SOPS and age: rotate recipients, data keys and recovery access

Test each identity independently against the same updated ciphertext and keep an encrypted dual-access checkpoint. Do not accept a success from a shell that may have found another user’s key. The file fingerprints show which ciphertext versions were tested; changing bytes alone proves no permission or content guarantee.

For a real migration, this overlap period includes every actual deployment/CI consumer and an independently exercised recovery route. A successful human workstation decrypt does not prove that a service account, hardware token or disaster-recovery host can use the new identity.

with_identity "$lab/keys/old.txt" decrypt --output /dev/null "$doc.enc.yaml" || exit 1
with_identity "$lab/keys/new.txt" decrypt --output /dev/null "$doc.enc.yaml" || exit 1
with_identity "$lab/keys/recovery.txt" decrypt --output /dev/null "$doc.enc.yaml" || exit 1
cp -- "$doc.enc.yaml" "$lab/dual-recipient.enc.yaml" || exit 1
sha256sum "$lab/before-old.enc.yaml" "$lab/dual-recipient.enc.yaml"

For this fixture, replace the policy with new plus recovery, inspect it and use the already-proven new identity for updatekeys. Then rotate the data key on that current file. Keep all flags before the filename and stop if either selected-file action fails.

Removing only the wrapper is insufficient when the old recipient may have learned the prior data key. Rotation gives this current ciphertext a new data key, but it cannot erase previously copied plaintext or old encrypted snapshots. No application password/API credential is changed by this panel.

cd "$lab/work" || exit 1
cat > .sops.yaml <<POLICY
creation_rules:
  - path_regex: ^rotation-demo\.enc\.yaml$
    age:
      - $new_recipient
      - $recovery_recipient
POLICY
cat .sops.yaml
with_identity "$lab/keys/new.txt" --config "$lab/work/.sops.yaml" updatekeys "$doc.enc.yaml" || exit 1
with_identity "$lab/keys/new.txt" rotate --in-place "$doc.enc.yaml" || exit 1

First prove new and recovery can still open the current file. Then prove the old identity still opens the retained old ciphertext, so the negative current-file test is not merely a broken old-key setup. Finally test that the normal SOPS decryption path cannot open the current wrappers with old alone.

The expected old-file success is the point: retirement cannot revoke somebody’s old copies. This negative test checks the current wrapper/access path, not every retained data key or plaintext. Keep the final encrypted checkpoint, the consumer rollout evidence and the recovery custody decision before actually retiring a real identity.

with_identity "$lab/keys/new.txt" decrypt --output /dev/null "$doc.enc.yaml" || exit 1
with_identity "$lab/keys/recovery.txt" decrypt --output /dev/null "$doc.enc.yaml" || exit 1
with_identity "$lab/keys/old.txt" decrypt --output /dev/null "$lab/before-old.enc.yaml" || exit 1
if with_identity "$lab/keys/old.txt" decrypt --output /dev/null "$doc.enc.yaml"; then
    printf '%s\n' 'STOP: old identity unexpectedly opens the current file.'
    exit 1
else
    printf '%s\n' 'Old identity cannot open current wrappers; historical ciphertext still opens.'
fi
cp -- "$doc.enc.yaml" "$lab/final-new.enc.yaml" || exit 1

This optional rollback deliberately reintroduces old-recipient access in the lab. Use it only for a routine migration rehearsal, never as an automatic response to a compromised-key incident. Verify recovery access to the saved checkpoint before copying it over this fixture’s current ciphertext.

The new-only policy file still describes the intended forward migration; restoring an old ciphertext does not reconcile that policy. Either repeat the reviewed forward steps or retain the lab as an explicitly rolled-back test. Do not represent it as a finished production retirement.

test -f "$lab/dual-recipient.enc.yaml" || exit 1
with_identity "$lab/keys/recovery.txt" decrypt --output /dev/null "$lab/dual-recipient.enc.yaml" || exit 1
cp -- "$lab/dual-recipient.enc.yaml" "$lab/work/$doc.enc.yaml" || exit 1
with_identity "$lab/keys/old.txt" decrypt --output /dev/null "$lab/work/$doc.enc.yaml" || exit 1
with_identity "$lab/keys/new.txt" decrypt --output /dev/null "$lab/work/$doc.enc.yaml" || exit 1