Sops

SOPS + age vault for swamp: one encrypted file per secret. put encrypts {"value": …} to the configured age recipients into <secretsDir>/<key>.enc.json and needs nothing but their public keys, so a writer can store a value for readers whose identities it does not hold: a human without the cluster key, or a workflow that mints a credential. get decrypts one file, list walks the directory without decrypting, delete removes the file. A key with / becomes a directory path; git history is per secret, and no write touches any other secret. Forked from @zocc/sops-age (Apache-2.0), see NOTICE.md; that provider keeps every secret in one file and decrypts it all to write. sops runs with an argument vector, never a shell; values reach it through a private temporary directory, never as an argument. Decryption is the caller's unless configured: ageKeyFile names a path, ageKeyName a file beside sops's own keys.txt that is used when it exists, so a vault config can name a process key without an operator's home path, and a YubiKey identity works unchanged where the file is absent. swamp vault migrate <vault> --to-type @dataverket/sops splits an existing single-file vault.