Warn the user when a file has multiple matching creation rules.

[cowingtonpost1]

If and until issue #1467 is implemented, I think that sops should somehow warn the user when encountering this scenario as to not leave secrets in plaintext.

keys:
- &host_a age1...
- &host_b age1...
creation_rules:

- key_groups:
  - age:
    - *host_a
    - *host_b
  path_regex: secrets.yaml$
  encrypted_regex: ^(a|b|c)$
- key_groups:
  - age:
    - *host_a
  path_regex: secrets.yaml$
  encrypted_regex: ^(d|e|f)$

This sops file results in the following secrets.yml:

a: ENC[AES256_GCM,data:Rg==,iv:Tt8wYhErFHA6w2ZhPY8v60FI0BGEfFCWB0sIWSyJhzo=,tag:fl2TsFHF3IvkoL7Wic7iEA==,type:str]
b: ENC[AES256_GCM,data:WA==,iv:NvHemU5jQ1KyFadXmE2phbzhjE5KNP/LqySvDFh5ijE=,tag:a7iKrN4rJ56IR96+ZEBRog==,type:str]
c: ENC[AES256_GCM,data:Cg==,iv:xXnc1xy/PZxn3xhYMT3yDCoMnukyI7m9fE4V7uUcVzE=,tag:6RFD60VDallY235zvN2pfQ==,type:str]
d: d
e: e
f: f
sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNGZhazB1eTFENUdsQzFC
            S0x1UThTdkZJbGVLZkZyanlzcHJaUTJjRHlBCmRMY3ZTOHdsTjhxSml1a053OHBv
            b0svRUlsblNIc2JOK2hWYmdGV1pUZzAKLS0tIDFqcGFzcHBhQWpBaUh2UjJJbU9T
            c1BobnpGOUFaNk13RVR6b2N1MXF2VmcK6K9lvHRPCnueUy+EmSNLauiLM6XcV383
            OiRfOXIZzADCQUjXyt+kXOiijM1DKj4CHx+IH04ldZsx7vASYR9RuQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1...
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOempDdTM0VmlxazlBdEFa
            NjdSTkNWVUdWbmFBMndMM3pqNlhsKzB5Y0I4CkV6OXpSWFkxZUZYWmtLdjZFang5
            MmRQZFBmLzlzOGo1V1ZjOEc2bTN0dU0KLS0tIHRSQzhucitJemNRd1Y1MHk5M0dK
            U3NqVVdGVjZEa3AwM044ZUNTSitGMncKOH/kIbOUrjDnLvGaA+18bV62oM5D0+HI
            tcv5TBJTP6G4ct6ww7ZVoipADzP4YTiTYR0+Q3CCLt27UxEKqnVARg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1...
    encrypted_regex: ^(a|b|c)$
    lastmodified: "2026-06-15T06:14:11Z"
    mac: ENC[AES256_GCM,data:fzfjuIuYKMm8dYmhYSf3MVeoOUw421xsaG7oERmb/UyBrDj5jVnVWbHoLPzuxnz18gemMg/6mDXiZ39K5ueDFog5WWLrfn443aATGoOUdpcukVrOEpFbY1q2ehznChFA91Y8Xx/K4eKzcsRv0oH1tUZNfN6/KA5HUh06wrPA9Vw=,iv:E2Yf6SiIYVr4QdDYfsgn8iu2gD9tkUQAUm7NepXUc/0=,tag:axLbYkucrrtHqsRbBLGBMg==,type:str]
    version: 3.13.1

The keys d, e and f are unencrypted even though there is a matching rule in the .sops.yaml file. Until and if having multiple creation rules is implemented, I think that a warning to the user is a good idea as this can leave secrets unencrypted.

[felixfontein]

To my knowledge it is extremely common to have multiple matching creation rules, so this would be very annoying to many users.

Warning about multiple rules with identical path_regex would be OK, but not about multiple matching rules in general.

[cowingtonpost1]

Yeah I think you're right in that the path_regex makes more sense instead. It also might be possible to make it more specific and only warn in cases where some secrets would not be encrypted. I'll admit I'm not a super experienced user, just someone who has ran into this a few times.

[felixfontein]

It also might be possible to make it more specific and only warn in cases where some secrets would not be encrypted. I'll admit I'm not a super experienced user, just someone who has ran into this a few times.

I think that's a quite expensive (both in terms of runtime, and code to write and maintain) for the benefits this brings.

Simply checking for duplicate path_regex values, on the other hand, is quite cheap, and IMO worth the effort.