SOPS looks for the config file from the current working directory. Commit 597acb7 changed this for the Go version, the Python version does this too. However, the docs are not very clear at explaining this.

thx - that is interesting! What was the motivation? Not clear from the commit.

from the peanut gallery, a +1 for an 'ascending from target' M.O; In various repos where this might be used, it's typical to be rooted in the root directory.

This was the behavior of the Python version, and the Go version wants to keep compatibility with the Python version, so the commit I mentioned was basically fixing a bug. As to why the Python version uses cwd instead of the file's path, I do not know.

I'm interested in this as it would allow me to structure my repo in a way where different .sops.yaml config files could be used for different directories. At the moment I have to use one config file at the root of the directory that grows quite larg. Not terrible but could be nicer 😉

What is the status of this? Can it be worked on?
@jvehent From your comment I'm not sure if you are ok with the behavior being changed to "ascend from secret file location" or if you want some kind of combined behavior...

I don't think we can make any change to the current behavior until we have a reasonable approach to deciding which configuration file would take precedence when two configs exists in cwd and
file directory. I think the current approach, while limiting, has the benefit of being clearly understood and footgun-proof, which are important properties of any security tool.

A modest suggestion, so as not to break existing workflows but to allow adoption of the (IMHO!) clearly better (;-)) choice over time:

• search both hierarchies: CWD-and-up, and file-dir-and-up
• if only CWD-and-up is found, use that
• if only file-dir-and-up is found, use that
• if both are found, prefer the CWD-and-up unless an explicit marker has been placed in that file deferring to file-dir-and-up if present

This way, an existing user preserves behaviour as is; a new user wanting file-dir-and-up gets it as they have no clash; and an existing user can transition as they choose, requiring both a file-dir-and-up config file and an opt-in in their CWD-and-up file.

Here's a shell script to do the file-centric resolution in userland. You can use it like sops --config "$(sopsconfig path/to/file.yaml)" path/to/file.yaml

function sopsconfig() {
	CONFIG_DIR="$(dirname "$(realpath "$1")")"
	while [ ! -f "$CONFIG_DIR/.sops.yaml" ]; do
		if [ "$CONFIG_DIR" = "/" ]; then exit 1; fi
		CONFIG_DIR="$(dirname "$CONFIG_DIR")"
	done

	echo "$CONFIG_DIR/.sops.yaml"
}