script fix

virtual-machines/.sops.yaml

@@ -3,7 +3,6 @@ keys:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
     - &nixos-homelab-00 age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    - &virtual age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
@@ -11,4 +10,3 @@ creation_rules:
           - *laptop
           - *desktop
           - *nixos-homelab-00
-          - *virtual

virtual-machines/build-image.sh

@@ -108,22 +108,24 @@ sudo install -o root -g nixbld -m 0440 \
 # Requires mikefarah/yq v4 and simple comma-separated age fields.
 export AGE_PUBLIC_KEY
 
-if ! yq -e \
+# Confirm at least one creation rule contains an age key group.
-    '.creation_rules | any(.[]; has("age"))' \
+if ! yq -e '
-    "$SOPS_CONFIG" >/dev/null; then
+  [.creation_rules[]
-    echo "No creation_rules with an age field found in .sops.yaml" >&2
+   | select(.key_groups != null)
+   | .key_groups[]
+   | select(.age != null)]
+  | length > 0
+' "$SOPS_CONFIG" >/dev/null; then
+    echo "No creation_rules with key_groups.age found in .sops.yaml" >&2
     exit 1
 fi
 
+# Add the temporary public key to every age key group.
 yq -i '
-    (.creation_rules[] | select(has("age")) | .age) |= (
+  (.creation_rules[].key_groups[] | select(.age != null).age) +=
-        split(",")
+    [strenv(AGE_PUBLIC_KEY)]
-        | map(trim)
+  |
-        | map(select(. != ""))
+  (.creation_rules[].key_groups[] | select(.age != null).age) |= unique
-        | . + [strenv(AGE_PUBLIC_KEY)]
-        | unique
-        | join(",")
-    )
 ' "$SOPS_CONFIG"
 
 echo "Updating SOPS recipients for secrets in $VM_FOLDER..."