From 92e9726a02af3a377e38658390315ccb72caf0ff Mon Sep 17 00:00:00 2001
From: Roy Dumblauskas <roydumblauskas@gmail.com>
Date: Fri, 16 Oct 2026 00:54:59 -0500
Subject: [PATCH] script fix

---
 virtual-machines/.sops.yaml     |  2 --
 virtual-machines/build-image.sh | 26 ++++++++++++++------------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/virtual-machines/.sops.yaml b/virtual-machines/.sops.yaml
index 9df042b..f6c2c25 100644
--- a/virtual-machines/.sops.yaml
+++ b/virtual-machines/.sops.yaml
@@ -3,7 +3,6 @@ keys:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
     - &nixos-homelab-00 age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    - &virtual age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
@@ -11,4 +10,3 @@ creation_rules:
           - *laptop
           - *desktop
           - *nixos-homelab-00
-          - *virtual
diff --git a/virtual-machines/build-image.sh b/virtual-machines/build-image.sh
index 772c86d..18fc633 100755
--- a/virtual-machines/build-image.sh
+++ b/virtual-machines/build-image.sh
@@ -108,22 +108,24 @@ sudo install -o root -g nixbld -m 0440 \
 # Requires mikefarah/yq v4 and simple comma-separated age fields.
 export AGE_PUBLIC_KEY
 
-if ! yq -e \
-    '.creation_rules | any(.[]; has("age"))' \
-    "$SOPS_CONFIG" >/dev/null; then
-    echo "No creation_rules with an age field found in .sops.yaml" >&2
+# Confirm at least one creation rule contains an age key group.
+if ! yq -e '
+  [.creation_rules[]
+   | select(.key_groups != null)
+   | .key_groups[]
+   | select(.age != null)]
+  | length > 0
+' "$SOPS_CONFIG" >/dev/null; then
+    echo "No creation_rules with key_groups.age found in .sops.yaml" >&2
     exit 1
 fi
 
+# Add the temporary public key to every age key group.
 yq -i '
-    (.creation_rules[] | select(has("age")) | .age) |= (
-        split(",")
-        | map(trim)
-        | map(select(. != ""))
-        | . + [strenv(AGE_PUBLIC_KEY)]
-        | unique
-        | join(",")
-    )
+  (.creation_rules[].key_groups[] | select(.age != null).age) +=
+    [strenv(AGE_PUBLIC_KEY)]
+  |
+  (.creation_rules[].key_groups[] | select(.age != null).age) |= unique
 ' "$SOPS_CONFIG"
 
 echo "Updating SOPS recipients for secrets in $VM_FOLDER..."