bin/os-conf: update

1 files changed, 4 insertions, 1 deletions

diff --git a/bin/os-conf b/bin/os-conf
index 8ee143d..d6a31a1 100755
--- a/bin/os-conf
+++ b/bin/os-conf
@@ -49,11 +49,14 @@ handle_secret() {
 			tar -cz -f $archive -T - 2>/dev/null;
 			chown 1000:1000 $archive;
 		)"
+		# TODO: can we avoid re-encrypting every single time?
+		h=$(md5sum "$archive" | cut -d' ' -f1)
 		# encrypt the tarfile and amend some information that makes
 		# reconstructing easier
 		(
 			sops --config /dev/null --encrypt "$archive" 2>/dev/null |
-				jq -r '.sops.data_extension |= "tar.gz"'
+				jq -r '.sops.data_extension |= "tar.gz"' |
+				jq --arg h "$h" -r '.sops.data_hash |= $h'
 		) >"${archive}.enc"
 		printf "%s\n" "${archive}.enc"
 		;;