Pass SOPS_AGE_RECIPIENT environment variable to SOPS_AGE_KEY_CMD

Signed-off-by: Defelo <mail@defelo.de>

README.rst

@@ -241,7 +241,8 @@ You can override the default lookup by:
 
 - setting the environment variable **SOPS_AGE_KEY_FILE**;
 - setting the **SOPS_AGE_KEY** environment variable;
-- providing a command to output the age keys by setting the **SOPS_AGE_KEY_CMD** environment variable..
+- providing a command to output the age keys by setting the **SOPS_AGE_KEY_CMD** environment variable.
+  This command can read the age recipient for which to return the private key from the **SOPS_AGE_RECIPIENT** environment variable.
 
 The contents of this key file should be a list of age X25519 identities, one
 per line. Lines beginning with ``#`` are considered comments and ignored. Each

age/keysource.go

@@ -32,6 +32,10 @@ const (
 	// SopsAgeKeyCmdEnv can be set as an environment variable with a command
 	// to execute that returns the age keys.
 	SopsAgeKeyCmdEnv = "SOPS_AGE_KEY_CMD"
+	// SopsAgeRecipientEnv is passed as an environment variable to the command
+	// set in SopsAgeKeyCmdEnv and contains the Bech32-encoded age public key
+	// for which the private key should be returned.
+	SopsAgeRecipientEnv = "SOPS_AGE_RECIPIENT"
 	// SopsAgeSshPrivateKeyFileEnv can be set as an environment variable pointing to
 	// a private SSH key file.
 	SopsAgeSshPrivateKeyFileEnv = "SOPS_AGE_SSH_PRIVATE_KEY_FILE"
@@ -382,7 +386,9 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, []string, errSet) {
 		if err != nil {
 			errs = append(errs, fmt.Errorf("failed to parse command %s from %s: %w", ageKeyCmd, SopsAgeKeyCmdEnv, err))
 		} else {
-			out, err := exec.Command(args[0], args[1:]...).Output()
+			cmd := exec.Command(args[0], args[1:]...)
+			cmd.Env = append(os.Environ(), fmt.Sprintf("%s=%s", SopsAgeRecipientEnv, key.Recipient))
+			out, err := cmd.Output()
 			if err != nil {
 				errs = append(errs, fmt.Errorf("failed to execute command %s from %s: %w", ageKeyCmd, SopsAgeKeyCmdEnv, err))
 			} else {

age/keysource_test.go

@@ -510,6 +510,26 @@ func TestMasterKey_loadIdentities(t *testing.T) {
 		assert.Len(t, unusedLocations, 5)
 	})
 
+	t.Run(SopsAgeRecipientEnv, func(t *testing.T) {
+		tmpDir := t.TempDir()
+		// Overwrite to ensure local config is not picked up by tests
+		overwriteUserConfigDir(t, tmpDir)
+
+		t.Setenv(SopsAgeKeyCmdEnv, fmt.Sprintf("bash -c 'if [[ $SOPS_AGE_RECIPIENT = %s ]]; then echo %s; fi'", mockRecipient, mockIdentity))
+
+		key := &MasterKey{Recipient: mockRecipient}
+		got, unusedLocations, errs := key.loadIdentities()
+		assert.Len(t, errs, 0)
+		assert.Len(t, got, 1)
+		assert.Len(t, unusedLocations, 5)
+
+		key = &MasterKey{Recipient: mockRecipient + "abc"}
+		got, unusedLocations, errs = key.loadIdentities()
+		assert.Len(t, errs, 0)
+		assert.Len(t, got, 0)
+		assert.Len(t, unusedLocations, 6)
+	})
+
 	t.Run("cmd error", func(t *testing.T) {
 		tmpDir := t.TempDir()
 		// Overwrite to ensure local config is not picked up by tests