WIUNIX ACADEMY
SOPS and age: rotate recipients, data keys and recovery access
Page 4 of 4. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment2 editable values
Keep evidence and clean up through the owning policy
Record artifact versions/digests and proof results, the exact tested encrypted revisions, independent new/recovery success, controlled old-key current failure and old-history success, consumer acceptance and the custody decision. This is the evidence needed to distinguish a rewrap from a completed migration.
No persistent service or host protection was changed. Do not publish or commit this lab, its key directory or a plaintext export. Retain/delete its exact files through the existing protected lab/secret-retention process after review; no broad recursive deletion or private-key destruction command is offered. Documentation and command syntax are reviewed here, not execution on every listed distribution or a guarantee for custom identities.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
- SOPS key management: updatekeys versus rotate
- SOPS configuration and encryption model
- SOPS security model
- SOPS 3.13.3 release and Cosign verification
- SOPS release artifact list
- SOPS signed-checksum artifact scope
- SOPS 3.13.3 age identity discovery
- SOPS 3.13.3 command flags
- age 1.3.2 release
- age Sigsum verification and public verification keys
- age key generation and public-recipient derivation
- age recipients and identities
- Official age installation channels
- Arch SOPS package channel
- Arch age package channel
- Debian 12 age channel
- Manjaro branch inspection
- Arch package transactions and partial upgrades
KEEP LEARNING