Sourced from github.com/getsops/sops/v3's releases.

v3.13.2

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.linux.amd64
Move the binary in to your PATH
mv sops-v3.13.2.linux.amd64 /usr/local/bin/sops
Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.checksums.sigstore.json
Verify the checksums file
cosign verify-blob sops-v3.13.2.checksums.txt 
--bundle sops-v3.13.2.checksums.sigstore.json 
--certificate-identity-regexp=https://github.com/getsops 
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.13.2.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.13.2.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.intoto.jsonl
</tr></table> 

... (truncated)

Sourced from github.com/getsops/sops/v3's changelog.

3.13.2

Improvements:

• Dependency updates (#2185), (#2193), (#2197), (#2212), (#2218), (#2229), (#2231), (#2231).
• Fix typos in documentation (#2221).

Bugfixes:

• When using --user in the sops exec-file and sops exec-env subcommands, supplementary groups are now reset to the ones of the supplied user (#2194).
• When using --user in the sops exec-file and sops exec-env subcommands, make sure that HOME, USER, and LOGNAME are set to the correct values for the supplied user (#2230).
• AWS KMS: Handle pointers when serializing AWS context (#2219).
• JSON store: Preverse large integers that fit into int64 (#2222).
• INI store: Restore old behavior of double-escaping newlines in metadata, and adjust code to handle both the 3.13.0/3.13.1 single-escaped newlines as well as double-escaped newlines (#2189).
• Fix panic when expecting a string for encrypted data, but when encountering something else (#2227).

Project changes:

• CI dependency updates (#2184), (#2192), (#2196), (#2211), (#2228), (#2236).
• Rust dependency updates for functional tests (#2191).
• Build alpine container in CI (#2217).
• Improve make test by unsetting all age environment variables (#2208).
• Shorten lines in MarkDown files (#2206).

• 15e36f9 Merge pull request #2232 from felixfontein/release-3.13.2
• 0d49dff Add changelog for 3.13.2.
• 72d9f5a Bump version to 3.13.2.
• 8a62945 Merge pull request #2236 from getsops/dependabot/github_actions/ci-35246068e4
• 59d36c6 build(deps): Bump the ci group with 2 updates
• ed14c0b Merge pull request #2233 from getsops/dependabot/go_modules/github.com/openco...
• ff43b27 build(deps): Bump github.com/opencontainers/runc from 1.2.8 to 1.3.6
• 1c13f06 Merge pull request #2231 from felixfontein/deps
• 818f7d9 Update all dependencies.
• bb4f688 Merge pull request #2206 from felixfontein/mdl2
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)