DennisGaida raised accidental overwrites in Discussion #1976. I'd suggest an opt-in --no-clobber instead of changing the default or adding prompts.
With --output, the flag would fail without changing an existing destination, including symlinks, or exclusively create a new file. It would reject use without --output or with --in-place. Without the flag, behavior stays unchanged; shell redirection is outside this feature.
The explicit-output branches in cmd/sops/main.go currently use os.Create. Exclusive creation would avoid the race in a separate existence check.
I'd implement this across commands supporting --output, including legacy syntax, with tests for unchanged existing bytes and invalid combinations. Does this approach fit SOPS?
DennisGaida raised accidental overwrites in Discussion #1976. I'd suggest an opt-in
--no-clobberinstead of changing the default or adding prompts.With
--output, the flag would fail without changing an existing destination, including symlinks, or exclusively create a new file. It would reject use without--outputor with--in-place. Without the flag, behavior stays unchanged; shell redirection is outside this feature.The explicit-output branches in
cmd/sops/main.gocurrently useos.Create. Exclusive creation would avoid the race in a separate existence check.I'd implement this across commands supporting
--output, including legacy syntax, with tests for unchanged existing bytes and invalid combinations. Does this approach fit SOPS?