The Performance Battle secrets management SOPS guide Snyk: A Practical Guide

import subprocess
import time
import json
import os
import tempfile
from typing import Dict, List, Tuple
import logging

# Configure logging to capture benchmark errors
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

class SecretsBenchmarker:
    """Benchmark encryption/decryption performance for SOPS and Snyk Secrets"""

    def __init__(self, sops_path: str = "sops", snyk_path: str = "snyk"):
        self.sops_path = sops_path
        self.snyk_path = snyk_path
        self.results: Dict[str, List[float]] = {"sops_encrypt": [], "sops_decrypt": [], "snyk_encrypt": [], "snyk_decrypt": []}

    def _generate_test_secrets(self, num_secrets: int = 10000) -> str:
        """Generate a temporary .env file with test secrets"""
        with tempfile.NamedTemporaryFile(mode='w+', suffix='.env', delete=False) as f:
            for i in range(num_secrets):
                f.write(f"SECRET_{i}=super_secure_value_{i}\n")
            return f.name

    def _cleanup_temp_file(self, filepath: str) -> None:
        """Safely remove temporary files"""
        try:
            if os.path.exists(filepath):
                os.unlink(filepath)
        except OSError as e:
            logger.error(f"Failed to cleanup {filepath}: {e}")

    def run_sops_benchmark(self, num_iterations: int = 5) -> None:
        """Run SOPS encryption/decryption benchmarks"""
        test_file = self._generate_test_secrets()
        encrypted_file = f"{test_file}.enc"

        try:
            # Verify SOPS is installed
            subprocess.run([self.sops_path, "--version"], check=True, capture_output=True)
        except subprocess.CalledProcessError:
            logger.error("SOPS not found. Install from https://github.com/mozilla/sops")
            return

        for _ in range(num_iterations):
            # Benchmark encryption
            start = time.perf_counter()
            try:
                subprocess.run(
                    [self.sops_path, "-e", test_file],
                    stdout=open(encrypted_file, 'w'),
                    stderr=subprocess.PIPE,
                    check=True
                )
                encrypt_time = time.perf_counter() - start
                self.results["sops_encrypt"].append(encrypt_time)
            except subprocess.CalledProcessError as e:
                logger.error(f"SOPS encryption failed: {e.stderr.decode()}")
                continue

            # Benchmark decryption
            start = time.perf_counter()
            try:
                subprocess.run(
                    [self.sops_path, "-d", encrypted_file],
                    stdout=subprocess.PIPE,
                    stderr=subprocess.PIPE,
                    check=True
                )
                decrypt_time = time.perf_counter() - start
                self.results["sops_decrypt"].append(decrypt_time)
            except subprocess.CalledProcessError as e:
                logger.error(f"SOPS decryption failed: {e.stderr.decode()}")
                continue

        self._cleanup_temp_file(test_file)
        self._cleanup_temp_file(encrypted_file)

    def run_snyk_benchmark(self, num_iterations: int = 5) -> None:
        """Run Snyk Secrets encryption/decryption benchmarks"""
        test_file = self._generate_test_secrets()
        encrypted_file = f"{test_file}.snyk"

        try:
            # Verify Snyk is installed
            subprocess.run([self.snyk_path, "--version"], check=True, capture_output=True)
        except subprocess.CalledProcessError:
            logger.error("Snyk not found. Install from https://github.com/snyk/snyk")
            return

        for _ in range(num_iterations):
            # Benchmark encryption (Snyk uses `snyk secrets encrypt`)
            start = time.perf_counter()
            try:
                subprocess.run(
                    [self.snyk_path, "secrets", "encrypt", test_file, "--out", encrypted_file],
                    stderr=subprocess.PIPE,
                    check=True
                )
                encrypt_time = time.perf_counter() - start
                self.results["snyk_encrypt"].append(encrypt_time)
            except subprocess.CalledProcessError as e:
                logger.error(f"Snyk encryption failed: {e.stderr.decode()}")
                continue

            # Benchmark decryption (Snyk uses `snyk secrets decrypt`)
            start = time.perf_counter()
            try:
                subprocess.run(
                    [self.snyk_path, "secrets", "decrypt", encrypted_file],
                    stdout=subprocess.PIPE,
                    stderr=subprocess.PIPE,
                    check=True
                )
                decrypt_time = time.perf_counter() - start
                self.results["snyk_decrypt"].append(decrypt_time)
            except subprocess.CalledProcessError as e:
                logger.error(f"Snyk decryption failed: {e.stderr.decode()}")
                continue

        self._cleanup_temp_file(test_file)
        self._cleanup_temp_file(encrypted_file)

    def print_results(self) -> None:
        """Print formatted benchmark results"""
        print("\n=== Benchmark Results (10,000 Secrets, 5 Iterations) ===")
        for metric, times in self.results.items():
            if times:
                avg = sum(times) / len(times)
                print(f"{metric}: Avg {avg:.3f}s, Min {min(times):.3f}s, Max {max(times):.3f}s")

if __name__ == "__main__":
    benchmarker = SecretsBenchmarker()
    logger.info("Starting SOPS benchmarks...")
    benchmarker.run_sops_benchmark()
    logger.info("Starting Snyk benchmarks...")
    benchmarker.run_snyk_benchmark()
    benchmarker.print_results()

#!/bin/bash
# SOPS Team Setup Script v1.0
# Installs SOPS, generates age keys, encrypts team secrets, and configures CI
# Requires: bash 4+, curl, git

set -euo pipefail
trap 'echo "Error occurred at line $LINENO. Cleaning up..."; cleanup' ERR

# Configuration
SOPS_VERSION="3.8.1"
AGE_VERSION="1.1.1"
INSTALL_DIR="/usr/local/bin"
SECRETS_DIR="./team-secrets"
PUBLIC_KEYS_DIR="./.sops-keys"

# Logging function
log() {
    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] $1"
}

# Cleanup function for temp files
cleanup() {
    if [[ -d "$TEMP_DIR" ]]; then
        log "Removing temporary directory $TEMP_DIR"
        rm -rf "$TEMP_DIR"
    fi
}

# Check if command exists
command_exists() {
    command -v "$1" >/dev/null 2>&1
}

# Install SOPS if not present
install_sops() {
    if command_exists sops; then
        local current_version=$(sops --version | awk '{print $2}')
        if [[ "$current_version" == "$SOPS_VERSION" ]]; then
            log "SOPS $SOPS_VERSION already installed"
            return
        fi
    fi
    log "Installing SOPS $SOPS_VERSION..."
    local os=$(uname -s | tr '[:upper:]' '[:lower:]')
    local arch=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
    local download_url="https://github.com/mozilla/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.${os}.${arch}"

    TEMP_DIR=$(mktemp -d)
    curl -L -o "$TEMP_DIR/sops" "$download_url"
    chmod +x "$TEMP_DIR/sops"
    sudo mv "$TEMP_DIR/sops" "$INSTALL_DIR/sops"
    log "SOPS $SOPS_VERSION installed successfully"
}

# Install age if not present
install_age() {
    if command_exists age; then
        local current_version=$(age --version | awk '{print $2}')
        if [[ "$current_version" == "$AGE_VERSION" ]]; then
            log "age $AGE_VERSION already installed"
            return
        fi
    fi
    log "Installing age $AGE_VERSION..."
    local os=$(uname -s | tr '[:upper:]' '[:lower:]')
    local arch=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
    local download_url="https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-${os}-${arch}.tar.gz"

    TEMP_DIR=$(mktemp -d)
    curl -L -o "$TEMP_DIR/age.tar.gz" "$download_url"
    tar -xzf "$TEMP_DIR/age.tar.gz" -C "$TEMP_DIR"
    chmod +x "$TEMP_DIR/age"
    sudo mv "$TEMP_DIR/age" "$INSTALL_DIR/age"
    log "age $AGE_VERSION installed successfully"
}

# Generate team age keys
generate_keys() {
    log "Generating team age keys..."
    mkdir -p "$PUBLIC_KEYS_DIR"
    # Generate admin key (used for key rotation)
    if [[ ! -f "$PUBLIC_KEYS_DIR/admin.txt" ]]; then
        age-keygen -o "$PUBLIC_KEYS_DIR/admin.txt" > /dev/null 2>&1
        log "Admin key generated: $PUBLIC_KEYS_DIR/admin.txt"
    fi
    # Generate CI key (no passphrase, used in pipelines)
    if [[ ! -f "$PUBLIC_KEYS_DIR/ci.txt" ]]; then
        age-keygen -o "$PUBLIC_KEYS_DIR/ci.txt" --no-passphrase > /dev/null 2>&1
        log "CI key generated: $PUBLIC_KEYS_DIR/ci.txt"
    fi
    # Extract public keys for SOPS configuration
    age-keygen -y "$PUBLIC_KEYS_DIR/admin.txt" > "$PUBLIC_KEYS_DIR/admin.pub"
    age-keygen -y "$PUBLIC_KEYS_DIR/ci.txt" > "$PUBLIC_KEYS_DIR/ci.pub"
    log "Public keys extracted to $PUBLIC_KEYS_DIR"
}

# Create SOPS configuration file
create_sops_config() {
    log "Creating .sops.yaml configuration..."
    cat > .sops.yaml << EOF
creation_rules:
  - path_regex: ${SECRETS_DIR}/.*\.yaml$
    key_groups:
      - age:
          - $(cat "$PUBLIC_KEYS_DIR/admin.pub")
          - $(cat "$PUBLIC_KEYS_DIR/ci.pub")
EOF
    log ".sops.yaml created with team public keys"
}

# Encrypt team secrets
encrypt_secrets() {
    log "Encrypting team secrets..."
    mkdir -p "$SECRETS_DIR"
    # Create sample secrets file if not exists
    if [[ ! -f "$SECRETS_DIR/production.yaml" ]]; then
        cat > "$SECRETS_DIR/production.yaml" << EOF
# Production secrets - encrypted with SOPS
database_url: postgres://user:password@prod-db:5432/app
api_key: sk_live_1234567890abcdef
jwt_secret: super_secure_jwt_secret_123
EOF
    fi
    # Encrypt the file
    sops -e "$SECRETS_DIR/production.yaml" > "$SECRETS_DIR/production.yaml.enc"
    mv "$SECRETS_DIR/production.yaml.enc" "$SECRETS_DIR/production.yaml"
    log "Secrets encrypted: $SECRETS_DIR/production.yaml"
}

# Main execution
log "Starting SOPS team setup..."
install_sops
install_age
generate_keys
create_sops_config
encrypt_secrets
log "SOPS setup complete! Decrypt secrets with: sops -d ${SECRETS_DIR}/production.yaml"
cleanup

const { execSync } = require('child_process');
const fs = require('fs');
const path = require('path');
const logger = require('winston');

// Configure winston logger
logger.configure({
    transports: [
        new logger.transports.Console({
            format: logger.format.combine(
                logger.format.timestamp(),
                logger.format.json()
            )
        })
    ]
});

/**
 * Snyk Secrets CI Integration Script
 * Scans, encrypts, and validates secrets in CI pipelines
 * Requires: @snyk/nodejs-cli, snyk secrets plugin, SNYK_TOKEN env var
 */
class SnykSecretsCI {
    constructor() {
        this.snykToken = process.env.SNYK_TOKEN;
        this.secretsDir = path.join(__dirname, 'secrets');
        this.encryptedDir = path.join(__dirname, 'encrypted-secrets');

        // Validate required environment variables
        if (!this.snykToken) {
            logger.error('SNYK_TOKEN is not set. Please set it before running.');
            process.exit(1);
        }
    }

    /**
     * Check if Snyk CLI is installed and authenticated
     */
    validateSnykInstall() {
        try {
            const version = execSync('snyk --version').toString().trim();
            logger.info(`Snyk CLI version: ${version}`);
        } catch (error) {
            logger.error('Snyk CLI not found. Install from https://github.com/snyk/snyk');
            throw new Error('Snyk CLI missing');
        }

        try {
            execSync('snyk auth --check', { env: { ...process.env, SNYK_TOKEN: this.snykToken } });
            logger.info('Snyk authentication valid');
        } catch (error) {
            logger.error('Snyk authentication failed. Check SNYK_TOKEN.');
            throw new Error('Snyk auth invalid');
        }
    }

    /**
     * Scan for unencrypted secrets in the repository
     */
    scanForSecrets() {
        logger.info('Scanning for unencrypted secrets...');
        try {
            const scanResult = execSync(
                'snyk secrets scan --json',
                { encoding: 'utf8' }
            );
            const results = JSON.parse(scanResult);
            if (results.vulnerabilities.length > 0) {
                logger.warn(`Found ${results.vulnerabilities.length} unencrypted secrets`);
                fs.writeFileSync(
                    path.join(__dirname, 'snyk-secrets-scan.json'),
                    JSON.stringify(results, null, 2)
                );
                return results.vulnerabilities;
            }
            logger.info('No unencrypted secrets found');
            return [];
        } catch (error) {
            logger.error(`Secret scan failed: ${error.message}`);
            throw error;
        }
    }

    /**
     * Encrypt all secrets in the secrets directory
     */
    encryptSecrets() {
        logger.info('Encrypting secrets with Snyk...');
        if (!fs.existsSync(this.secretsDir)) {
            logger.warn(`Secrets directory ${this.secretsDir} does not exist. Creating...`);
            fs.mkdirSync(this.secretsDir, { recursive: true });
        }

        fs.mkdirSync(this.encryptedDir, { recursive: true });
        const secretFiles = fs.readdirSync(this.secretsDir).filter(file => file.endsWith('.env'));

        secretFiles.forEach(file => {
            const filePath = path.join(this.secretsDir, file);
            const encryptedPath = path.join(this.encryptedDir, `${file}.enc`);
            try {
                execSync(
                    `snyk secrets encrypt ${filePath} --out ${encryptedPath}`,
                    { stdio: 'inherit' }
                );
                logger.info(`Encrypted ${file} to ${encryptedPath}`);
            } catch (error) {
                logger.error(`Failed to encrypt ${file}: ${error.message}`);
            }
        });
    }

    /**
     * Validate encrypted secrets can be decrypted
     */
    validateDecryption() {
        logger.info('Validating secret decryption...');
        const encryptedFiles = fs.readdirSync(this.encryptedDir).filter(file => file.endsWith('.enc'));

        encryptedFiles.forEach(file => {
            const filePath = path.join(this.encryptedDir, file);
            try {
                const decrypted = execSync(
                    `snyk secrets decrypt ${filePath}`,
                    { encoding: 'utf8' }
                );
                if (decrypted.includes('SECRET_')) {
                    logger.info(`Successfully decrypted ${file}`);
                } else {
                    logger.warn(`Decrypted ${file} but no expected content found`);
                }
            } catch (error) {
                logger.error(`Failed to decrypt ${file}: ${error.message}`);
            }
        });
    }

    /**
     * Run full CI pipeline steps
     */
    run() {
        try {
            this.validateSnykInstall();
            const vulnerabilities = this.scanForSecrets();
            if (vulnerabilities.length > 0) {
                logger.warn('Vulnerabilities found. Encrypting secrets...');
                this.encryptSecrets();
            }
            this.validateDecryption();
            logger.info('Snyk Secrets CI pipeline completed successfully');
        } catch (error) {
            logger.error(`CI pipeline failed: ${error.message}`);
            process.exit(1);
        }
    }
}

// Execute if run directly
if (require.main === module) {
    const ci = new SnykSecretsCI();
    ci.run();
}

module.exports = SnykSecretsCI;

# GitHub Actions workflow for quarterly SOPS key rotation
name: Rotate SOPS Age Keys
on:
  schedule:
    - cron: '0 0 1 */3 *' # Run every 3 months
jobs:
  rotate-keys:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate new age key
        run: |
          age-keygen -o new_age_key.txt --no-passphrase
          age-keygen -y new_age_key.txt > new_age_key.pub
      - name: Update .sops.yaml
        run: |
          # Add new public key to .sops.yaml key groups
          sed -i "/age:/a\          - $(cat new_age_key.pub)" .sops.yaml
      - name: Re-encrypt all secrets
        run: |
          find ./secrets -name "*.yaml" -exec sops -e {} \;
      - name: Commit changes
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: "Rotate SOPS age keys (quarterly)"

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/snyk-pre-commit/snyk-pre-commit
    rev: v1.0.2
    hooks:
      - id: snyk-secrets-scan
        args: ["--severity-threshold", "high"]
        exclude: "\\.sops$|\\.enc$" # Ignore SOPS encrypted files
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ["--baseline", ".secrets-baseline.yaml"]

# Run annual benchmark (save results to compare year-over-year)
python3 secrets_benchmarker.py > 2024-benchmark-results.txt
# Compare to previous year
diff 2023-benchmark-results.txt 2024-benchmark-results.txt

secrets-management-benchmarks/
├── benchmarks/
│   └── secrets_benchmarker.py       # Benchmark script from Section 3
├── sops-setup/
│   └── setup-sops.sh                # SOPS team setup script from Section 4
├── snyk-setup/
│   └── snyk-ci.js                   # Snyk CI integration script from Section 5
├── .github/
│   └── workflows/
│       └── rotate-sops-keys.yml     # Key rotation workflow from Tip 1
├── .pre-commit-config.yaml          # Pre-commit config from Tip 2
├── .sops.yaml                       # Sample SOPS configuration
└── README.md                        # Full guide and setup instructions