if (!process.env.GITOPS_SECRETS_MASTER_KEY || process.env.GITOPS_SECRETS_MASTER_KEY.length < 16) {

throw `The 'GITOPS_SECRETS_MASTER_KEY' environment variable must be set to a string of 16 characters or more`;

}

return process.env.GITOPS_SECRETS_MASTER_KEY;

const salt = crypto.randomBytes(AES_SALT_BYTES);

const iv = crypto.randomBytes(AES_IV_BYTES);

// construct key

const key = crypto.pbkdf2Sync(masterKey(), salt, PBKDF2_ROUNDS, PBKDF2_KEYLEN, PBKDF2_DIGEST);

const cipher = crypto.createCipheriv(ALGORITHM, key, iv);

const cipherText = Buffer.concat([cipher.update(secrets, "utf8"), cipher.final()]);

const authTag = cipher.getAuthTag();

const combinedData = Buffer.concat([cipherText, authTag]);

return `${ENCODING_PREFIX}${salt.toString("base64")}-${iv.toString("base64")}-${combinedData.toString("base64")}`;

secrets = secrets.substring(ENCODING_PREFIX.length);

// decode file contents

const parts = secrets.split("-");

const salt = Buffer.from(parts[0], ENCODING);

const iv = Buffer.from(parts[1], ENCODING);

const data = Buffer.from(parts[2], ENCODING);

const cipherText = data.slice(0, data.length - AES_AUTH_TAG_BYTES);

const authTag = data.slice(data.length - AES_AUTH_TAG_BYTES);

// construct key

const key = crypto.pbkdf2Sync(masterKey(), salt, PBKDF2_ROUNDS, PBKDF2_KEYLEN, PBKDF2_DIGEST);

// decrypt cipher text

const decipher = crypto.createDecipheriv(ALGORITHM, key, iv).setAuthTag(authTag);

const decrypted = decipher.update(cipherText, "binary", "utf8") + decipher.final("utf8");

return decrypted;

const data = JSON.parse(decrypt(secrets));

if (options.populateEnv) {

process.env = { ...process.env, ...data };

}

return data;