SOPS

No entries match these filters. Clear filters

1. v3.13.3 Jul 23, 2026 · release notes

   SOPS v3.13.3 adds INI to supported input/output formats and fixes decrypted sequence comments in MAC.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.13.3 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.13.3

   • ini added to the list of supported input/output file formats

   1 detail in Everything

2. v3.13.0 May 8, 2026 · release notes

   SOPS v3.13.0 adds GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. endpoint/universe env vars, Age multi-key env support, HC Vault URL allowlist, and YAML inline comment preservation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.13.0 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.13.0

   └──▷ TRY IT
   Point SOPS at a private or sovereign GCP KMS endpoint (e.g., a VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.-SC-restricted or gov-cloud endpoint) without modifying your .sops.yaml.
   copy

   $ export SOPS_GCP_KMS_ENDPOINT=https://cloudkms.myorg.example.com
   export SOPS_GCP_KMS_UNIVERSE_DOMAIN=myorg.example.com
   sops --encrypt --gcp-kms projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key secrets.yaml > secrets.enc.yaml

   Supply multiple Age identities in a single env var for environments where you can't use a key file (e.g., CI with several recipient keys).
   copy

   $ export SOPS_AGE_KEY="AGE-SECRET-KEY-1ABC... AGE-SECRET-KEY-1DEF..."
   sops --decrypt secrets.enc.yaml

   • Adds SOPS_GCP_KMS_ENDPOINT and SOPS_GCP_KMS_UNIVERSE_DOMAIN environment variables for pointing SOPS at custom or sovereign GCP KMS endpoints.
   • Allows multiple space-separated Age private keys in the SOPS_AGE_KEY environment variable, enabling multi-key Age workflows without key files.
   • Adds allowlist support for acceptable HashiCorp Vault URLs, restricting which Vault instances SOPS will contact.
   • Preserves YAML inline comments through encrypt/edit roundtrips, preventing comment loss on re-encryption.
   • The --indent global flag value is now correctly propagated to store configs, giving consistent indentation across output formats.

   +1 more show less

   • The sops exec-file subcommand now rejects non-local paths in --filename, hardening against path traversal misuse.

   6 details in Everything

3. v3.11.0 Sep 28, 2025 · release notes

   SOPS v3.11.0 adds new CLI flags for sops set, shell completions, env-var keyservice config, and Azure KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. latest-key support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.11.0 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.11.0

   └──▷ TRY IT
   Pipe a secret value into sops set from another command, avoiding shell history exposure.
   copy

   $ vault kv get -field=password secret/db | sops set secrets.yaml '["database"]["password"]' --value-stdin

   Configure the SOPS keyservice via environment variables instead of repeating flags on every invocation — handy for container or CI environments.
   copy

   $ export SOPS_ENABLE_LOCAL_KEYSERVICE=true
   export SOPS_KEYSERVICE=tcp://localhost:5000
   sops --decrypt secrets.yaml

   • Adds --value-file option to sops set to supply a replacement value from a file instead of inline.
   • Adds --value-stdin option to sops set to supply a replacement value from standard input.
   • Adds shell completion script generation (sops completion) to support tab-completion in shells.
   • Enables configuration of --enable-local-keyservice and --keyservice via environment variables.
   • Supports native list syntax for configuring keys in .sops.yaml.

   +4 more show less

   • Azure Key Vault: omitting a key version now automatically uses the latest key version.
   • Allows non-complex non-string values (integers, booleans, etc.) in dotenv and exec-env stores.
   • Introduces EncryptContext and DecryptContext for AWS, Azure, GCP, PGP, and HashiCorp Vault (library API).
   • Allows injecting a custom HTTP client for AWS, Azure, GCP, and HashiCorp Vault key providers (library API).

   9 details in Everything

4. v3.10.0 Mar 30, 2025 · release notes

   SOPS v3.10.0 adds age plugin/SSH/passphrase support, stdin encrypt/decrypt, and several new CLI flags

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.10.0 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.10.0

   └──▷ TRY IT
   Retrieve the age private key from a secrets manager at runtime instead of storing it on disk.
   copy

   $ SOPS_AGE_KEY_CMD='aws secretsmanager get-secret-value --secret-id my-age-key --query SecretString --output text' sops --decrypt secrets.enc.yaml

   • Adds --input-type option to the filestatus subcommand for specifying file type when checking encryption status
   • Introduces SOPS_EDITOR environment variable, consulted before EDITOR, for editor selection
   • Allows disabling the version check via environment variable
   • Adds --same-process option for exec-env subcommand to run commands in the same process
   • Adds --idempotent flag to the set subcommand to skip writing the file when no change occurred

   +15 more show less

   • Supports encryption and decryption of time.Time objects in YAML/JSON files
   • Adds SSH key support for age encryption
   • Adds support for age identities protected with a passphrase
   • Adds age plugin support, enabling external age key management plugins
   • Supports encrypting and decrypting directly from stdin
   • Adds SOPS_AGE_KEY_CMD option to retrieve the age key via an external command
   • Adds a way to set the sops config file location via an environment variable
   • Supports --config option in the publish subcommand
   • Adds support for oauth2.TokenSource in GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. integration
   • Supports GOOGLE_OAUTH_ACCESS_TOKEN for Google Cloud Platform authentication
   • Adds duplicate section support to the INI store
   • Adds a trailing newline at the end of JSON output files
   • Adds Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. binary releases and multiarch Windows release binaries
   • Warns when a .sops.yml file is found while searching for .sops.yaml
   • Adds option to explicitly check for the latest version on demand

   20 details in Everything

5. v3.9.1 Oct 4, 2024 · release notes

   SOPS v3.9.1 lets edit create new files and hardens encryption by rejecting empty key groups.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.9.1 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.9.1

   └──▷ TRY IT
   Bootstrap a brand-new encrypted secret file without creating a plaintext file first.
   copy

   $ sops edit secrets/new-service.yaml

   • Enables sops edit to create new encrypted files that don't yet exist on disk.
   • Refuses to encrypt when a key group is empty or no key groups are defined, preventing silently unprotected files.
   • The updatekeys subcommand now displays changes to shamir_threshold so operators can audit key-group threshold updates.

   3 details in Everything

6. v3.9.0 Jun 28, 2024 · release notes

   SOPS v3.9.0 adds explicit encryption/decryption subcommands, --mac-only-encrypted flag, and exec-env --pristine support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.9.0 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.9.0

   • Add --mac-only-encrypted flag to compute MAC only over values that end up encrypted
   • Introduce --pristine flag to sops exec-env to clear the environment before injecting secrets

   2 details in Everything

7. 3.8.0 Sep 15, 2023 · release notes

   SOPS 3.8.0 adds --disable-version-check and --input-type for updatekeys.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.0 https://github.com/getsops/sops.git
   # already have the repo? check out this version:
   $ git checkout 3.8.0

   └──▷ USE IT
   Check version in an air-gapped environment without triggering network calls.
   shell copy

   sops --disable-version-check --version

   Force the input format when updating keys for a non-default file type like JSON.
   shell copy

   sops --input-type json updatekeys sops.json

   • Adds --disable-version-check to allow offline --version checks
   • Adds --input-type flag to the updatekeys subcommand
   • Switches --version network requests from public DNS to GitHub endpoints

   3 details in Everything

8. v3.7.3 May 9, 2022 · release notes

   SOPS v3.7.3 adds GOOGLE_CREDENTIALS env var support and accepts KeyServiceServer in LocalClient.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.3 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.7.3

   • Add support for GCP Service Account within GOOGLE_CREDENTIALS
   • keyservice: accept KeyServiceServer in LocalClient

   2 details in Everything

9. v3.7.2 Mar 9, 2022 · release notes

   SOPS v3.7.2 adds arm64 releases and SOPS_AGE_KEY env var support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.2 https://github.com/mozilla/sops.git
   # already have the repo? check out this version:
   $ git checkout v3.7.2

   └──▷ USE IT
   Provide an age key directly via environment variable instead of using a sops-age-key file.
   shell copy

   SOPS_AGE_KEY='age1...' sops encrypt --age <public_key> myfile.yaml

   Run SOPS on Apple Silicon Macs using the new native arm64 binary.
   shell copy

   ./sops_darwin_arm64 --version

   • Adds linux and darwin arm64 platform support for binary releases
   • Supports the SOPS_AGE_KEY environment variable to provide age keys without a file

   2 details in Everything

10. v3.7.0 Mar 24, 2021 · release notes

    SOPS v3.7.0 adds age key management support and passes filename to exec-file hooks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.0 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout v3.7.0

    └──▷ USE IT
    Encrypt a secrets file using an age public key instead of GPG or AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves..
    shell copy

    sops --age age1ql3z7hjy54pw3hyww5ayyfg7zqg67ek58rpd3ysw56lklxt9hwsqf30v8p --encrypt config.yaml > config.enc.yaml

    • Adds support for age as a key management servicekey management serviceA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. (KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.), enabling encryption/decryption with age public keys alongside existing providers
    • Passes the filename to exec-file commands via the SOPS_FILEPATH environment variable, allowing dynamic configuration based on target file

    2 details in Everything

11. v3.6.1 Sep 14, 2020 · release notes

    Adds --unencrypted-regex flag and --input-type support for exec-file in SOPS v3.6.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.1 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout v3.6.1

    • Add support for --unencrypted-regex to exclude secrets from encryption.
    • Support --input-type for exec-file to specify the input format.
    • Use keys.openpgp.org instead of gpg.mozilla.org for key server.

    3 details in Everything

12. v3.6.0 Jul 15, 2020 · release notes

    SOPS v3.6.0 adds Hashicorp Vault support, recursive publish, JSON array-of-arrays, and new publish flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • sops publish now supports --recursive flag for publishing all files in a directory
    • sops publish now supports --omit-extensions flag for omitting the extension in the destination path
    • Adds support for encrypting data through the use of Hashicorp Vault
    • SOPS now supports JSON arrays of arrays

    4 details in Everything

13. v3.5.0 Nov 21, 2019 · release notes

    Adds sops exec-env and sops exec-file commands to run applications with secrets injected

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    └──▷ USE IT
    Run a command with decrypted secrets available as environment variables without writing them to disk.
    shell copy

    sops exec-env 'path/to/secrets.yaml' 'echo $MY_SECRET_KEY'

    Write decrypted secrets to a temporary file and execute a program that reads from that path.
    shell copy

    sops exec-file 'path/to/secrets.yaml' 'myapp --config /tmp/sops-xxxxx.json'

    • Adds the sops exec-env command to inject SOPS secrets as environment variables for a single command execution
    • Adds the sops exec-file command to write SOPS secrets to a temporary file and execute a command

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tags must now require a v prefix (e.g., v1.0.0) for version identification
    • !The primary Go module path is renamed to go.mozilla.org/sops/v3, requiring an import path update
14. 3.4.0 Sep 12, 2019 · release notes

    SOPS 3.4.0 adds sops publish command, Azure Auth, Vault/config options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0

    • Adds the sops publish subcommand to push encrypted secrets to S3, GCS, or Hashicorp Vault
    • Adds Azure Keyvault configuration support to the sops config file
    • Adds the encrypted_regex option to the sops config file for targeted encryption

    3 details in Everything

15. 3.3.0 Apr 18, 2019 · release notes

    SOPS 3.3.0 adds YAML multi-doc, INI support, GPG key server env var and AWS CLI profiles

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0 https://github.com/mozilla/sops.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0

    └──▷ USE IT
    Specify the GPG key server via environment variable for signing/decrypting
    shell copy

    SOPS_GPG_KEYSERVER=keyserver.ubuntu.com sops -d secrets.yaml.gpg

    Use AWS CLI profile prod and KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. alias for encryption instead of raw ARN
    shell copy

    sops -e --aws-kms-alias 'alias/my-key' --aws-profile prod secrets.json

    • Adds multi-document support for YAML files
    • Support referencing AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. keys by their alias
    • Adds support for INI files
    • Supports AWS CLI profiles in ~/.aws/credentials or AWS_PROFILE environment variable
    • Enables comment lines in .env files (lines starting with #) to be preserved during encryption/decryption

    +1 more show less

    • Added a way to specify the GPG key server to use through the SOPS_GPG_KEYSERVER environment variable

    6 details in Everything

16. 3.0.5 May 15, 2018 · release notes

    SOPS 3.0.5 introduces initial workspace auditing support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.5 https://github.com/getsops/sops.git
    # already have the repo? check out this version:
    $ git checkout 3.0.5

    └──▷ TRY IT
    Audit the current directory for SOPS configuration issues
    copy

    $ sops audit .

17. 3.0.3 Apr 11, 2018 · release notes

    SOPS 3.0.3 adds nested --set support, binary I/O flags, suffix config keys, and encrypted-suffix option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.3 https://github.com/getsops/sops.git
    # already have the repo? check out this version:
    $ git checkout 3.0.3

    • --set flag now works with nested data structures (e.g., .a.b=c)
    • New encrypted_suffix option (mirror of existing unencrypted_suffix)
    • Allows specifying unencrypted_suffix and encrypted_suffix rules in .sops.yaml
    • Adds flags to force binary input (--input-type=binary) and output (--output-type=binary) formats

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !filename_regex is deprecated in favor of path_regex
18. 3.0.0 Oct 10, 2017 · release notes

    SOPS 3.0 adds Shamir secret sharing, Keyservice forwarding, GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., and sops keysync command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/getsops/sops.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    └──▷ TRY IT
    Configure a group requiring both a PGP key and an AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. key to decrypt a file using Shamir secret sharing.
    copy

    $ sops groups --add 'group_name: pgp/0xABC123, aws_kms/arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'

    Run the keyservice daemon to allow other SOPS instances to access your local GPG agent via a socket.
    copy

    $ sops keyservice /tmp/sops-keys.sock

    • Adds sops groups subcommand to configure Shamir secret sharing using the .sops.yaml config file
    • Adds sops keyservice subcommand to forward access to a local master key over a socket
    • Adds Google Compute Platform KMS as a supported encryption provider
    • Enables encryption of comments by default

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Versions in SOPS 1.X files are re-encoded as strings, breaking backward compatibility with older SOPS versions