Get SOPS secrets as strings for build time use.

[rakino]

Here's a procedure to get SOPS secrets as strings (usable at build time, NOTE THAT these secrets will be made available in /gnu/store), in case it's useful:

(use-modules ((ice-9 popen) #:select (open-input-pipe close-pipe))
             ((rnrs io ports) #:select (get-string-all))
             ((sops secrets) #:select (sanitize-sops-key))

(define* (get-sops-secret key #:key file (number? #f))
  (let* ((cmd (format #f "sops --decrypt --extract '~a' '~a'"
                      (sanitize-sops-key key)
                      file))
         (port (open-input-pipe cmd))
         (secret (get-string-all port)))
    (close-pipe port)
    (if number?
        (string->number secret)
        secret)))

Usage:

(get-sops-secret '("some_key")
                 #:file "/path/to/some_file.yaml")

(get-sops-secret '("some_key")
                 #:file "/path/to/some_file.yaml"
                 #:number? #t)