[lbarrosby]

Description of the change

readSecrets and readSealedSecrets skip every document that decodes to an empty object, and that includes documents that failed to parse. So with a multi-document input where one document is broken, kubeseal seals the others, silently drops the broken one and exits 0:

cat <<'YAML' | kubeseal --cert cert.pem -o yaml
apiVersion: v1
kind: Secret
metadata:
  name: s1
data:
  foo: YmFy
---
apiVersion: v1
kind: Secret
metadata:
  name: s2
data: [
YAML

Only s1 comes out and nothing is reported for s2. The same happens for --validate and --re-encrypt, which go through readSealedSecrets.

The change returns the decode error when the document is empty and the error is not io.EOF. Empty documents (a stray ---, comment-only documents) still decode without an error and are skipped as before.

Benefits

A typo in one document of a multi-document file is reported instead of producing a SealedSecret file that is missing a secret.

Possible drawbacks

Inputs that only worked because the broken part was ignored now fail. When the first document is malformed, the error is now the parse error instead of "no secrets found".

Applicable issues

None found.

Additional information

Added TestSealWithMalformedDocument and TestReadSealedSecretsWithMalformedDocument; both fail on main and pass with the change. go test ./pkg/kubeseal/ ./cmd/kubeseal/ passes.